Skip to content

Commit dfe932d

Browse files
committed
Add missing conjunct in PostgreSqlEscapeFunction's 'escapesSqlArgument' predicate.
1 parent 797966f commit dfe932d

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

cpp/ql/lib/semmle/code/cpp/models/implementations/PostgreSql.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,8 @@ private class PostgreSqlEscapeFunction extends SqlEscapeFunction {
8787
override predicate escapesSqlArgument(FunctionInput input, FunctionOutput output) {
8888
exists(int argIndex |
8989
input.isParameterDeref(argIndex) and
90-
output.isReturnValueDeref()
90+
output.isReturnValueDeref() and
91+
pqxxEscapeArgument(this.getName(), argIndex)
9192
)
9293
}
9394
}

0 commit comments

Comments
 (0)