@@ -112,7 +112,7 @@ This query finds the argument passed in each call to ``File::create``:
112
112
113
113
from CallExpr call
114
114
where call.getStaticTarget().(Function).getCanonicalPath() = "<std::fs::File>::create"
115
- select call.getArgList(). getArg(0)
115
+ select call.getArg(0)
116
116
117
117
Unfortunately this will only give the expression in the argument, not the values which could be passed to it.
118
118
So we use local data flow to find all expressions that flow into the argument:
@@ -125,7 +125,7 @@ So we use local data flow to find all expressions that flow into the argument:
125
125
from CallExpr call, DataFlow::ExprNode source, DataFlow::ExprNode sink
126
126
where
127
127
call.getStaticTarget().(Function).getCanonicalPath() = "<std::fs::File>::create" and
128
- sink.asExpr().getExpr() = call.getArgList(). getArg(0) and
128
+ sink.asExpr().getExpr() = call.getArg(0) and
129
129
DataFlow::localFlow(source, sink)
130
130
select source, sink
131
131
@@ -139,7 +139,7 @@ We can vary the source, for example, making the source the parameter of a functi
139
139
from CallExpr call, DataFlow::ParameterNode source, DataFlow::ExprNode sink
140
140
where
141
141
call.getStaticTarget().(Function).getCanonicalPath() = "<std::fs::File>::create" and
142
- sink.asExpr().getExpr() = call.getArgList(). getArg(0) and
142
+ sink.asExpr().getExpr() = call.getArg(0) and
143
143
DataFlow::localFlow(source, sink)
144
144
select source, sink
145
145
@@ -234,9 +234,9 @@ The following global taint-tracking query finds places where a string literal is
234
234
predicate isSink(DataFlow::Node node) {
235
235
// any argument going to a parameter called `password`
236
236
exists(Function f, CallExpr call, int index |
237
- call.getArgList(). getArg(index) = node.asExpr().getExpr() and
237
+ call.getArg(index) = node.asExpr().getExpr() and
238
238
call.getStaticTarget() = f and
239
- f.getParamList(). getParam(index).getPat().(IdentPat).getName().getText() = "password"
239
+ f.getParam(index).getPat().(IdentPat).getName().getText() = "password"
240
240
)
241
241
}
242
242
}
0 commit comments