C++: Modernize flow sources.

Author: geoffw0

cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql

@@ -14,40 +14,31 @@
 import cpp
 import semmle.code.cpp.security.BufferWrite as BufferWrite
 import semmle.code.cpp.security.SensitiveExprs
-import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.FlowSources
 import semmle.code.cpp.ir.dataflow.TaintTracking
 import DataFlow::PathGraph
 
-Expr exprForNode(DataFlow::Node n) {
-  n = DataFlow::exprNode(result)
-  or
-  // (similar to DefaultTaintTracking's `getNodeForExpr`)
-  n = DataFlow::definitionByReferenceNodeFromArgument(result) and
-  not argv(result.(VariableAccess).getTarget())
-}
-
 /**
  * Taint flow from user input to a buffer write.
  */
 class ToBufferConfiguration extends TaintTracking::Configuration {
   ToBufferConfiguration() { this = "ToBufferConfiguration" }
 
-  override predicate isSource(DataFlow::Node source) { isUserInput(exprForNode(source), _) }
+  override predicate isSource(DataFlow::Node source) { source instanceof FlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
     exists(BufferWrite::BufferWrite w | w.getASource() = sink.asExpr())
   }
 }
 
 from
-  ToBufferConfiguration config, BufferWrite::BufferWrite w, Expr taintSource,
-  DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode, string taintCause, SensitiveExpr dest
+  ToBufferConfiguration config, BufferWrite::BufferWrite w, DataFlow::PathNode sourceNode,
+  DataFlow::PathNode sinkNode, FlowSource source, SensitiveExpr dest
 where
   config.hasFlowPath(sourceNode, sinkNode) and
-  taintSource = exprForNode(sourceNode.getNode()) and
+  sourceNode.getNode() = source and
   w.getASource() = sinkNode.getNode().asExpr() and
-  isUserInput(taintSource, taintCause) and
   dest = w.getDest()
 select w, sourceNode, sinkNode,
-  "This write into buffer '" + dest.toString() + "' may contain unencrypted data from $@",
-  taintSource, "user input (" + taintCause + ")"
+  "This write into buffer '" + dest.toString() + "' may contain unencrypted data from $@", source,
+  "user input (" + source.getSourceType() + ")"

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected

@@ -5,4 +5,4 @@ nodes
 | test.cpp:58:25:58:29 | input | semmle.label | input |
 subpaths
 #select
-| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (argv) |
+| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (a command-line argument) |