Skip to content

Commit 4d7aece

Browse files
committed
C++: Simplify dataflow taint test query
The complexity seems a left-over from before these tests were turned into inline expectation tests, where the aim seems to have been to have exactly one sink node for each `sink` call. Multiple sink nodes for the same `sink` call are not made visible in the inline expecation tests, and I am not conviced this was very useful before, so remove the complexity.
1 parent 2bef82b commit 4d7aece

File tree

1 file changed

+1
-10
lines changed
  • cpp/ql/test/library-tests/dataflow/taint-tests

1 file changed

+1
-10
lines changed

cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -95,16 +95,7 @@ module IRTest {
9595
override predicate isSink(DataFlow::Node sink) {
9696
exists(FunctionCall call |
9797
call.getTarget().getName() = "sink" and
98-
sink.asConvertedExpr() = call.getAnArgument()
99-
or
100-
call.getTarget().getName() = "sink" and
101-
sink.asExpr() = call.getAnArgument() and
102-
sink.asConvertedExpr() instanceof ReferenceDereferenceExpr
103-
)
104-
or
105-
exists(ReadSideEffectInstruction read |
106-
read.getSideEffectOperand() = sink.asOperand() and
107-
read.getPrimaryInstruction().(CallInstruction).getStaticCallTarget().hasName("sink")
98+
sink.asExpr() = call.getAnArgument()
10899
)
109100
}
110101

0 commit comments

Comments
 (0)