Swift: Rewrite SqlInjectionQuery to use DataFlow::ConfigSig

Author: jketema

swift/ql/lib/codeql/swift/security/SqlInjectionQuery.qll

@@ -13,7 +13,7 @@ import codeql.swift.security.SqlInjectionExtensions
 /**
  * A taint configuration for tainted data that reaches a SQL sink.
  */
-class SqlInjectionConfig extends TaintTracking::Configuration {
+deprecated class SqlInjectionConfig extends TaintTracking::Configuration {
   SqlInjectionConfig() { this = "SqlInjectionConfig" }
 
   override predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
@@ -28,3 +28,25 @@ class SqlInjectionConfig extends TaintTracking::Configuration {
     any(SqlInjectionAdditionalTaintStep s).step(nodeFrom, nodeTo)
   }
 }
+
+/**
+ * A taint configuration for tainted data that reaches a SQL sink.
+ */
+module SqlInjectionConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) { node instanceof FlowSource }
+
+  predicate isSink(DataFlow::Node node) { node instanceof SqlInjectionSink }
+
+  predicate isBarrier(DataFlow::Node sanitizer) {
+    sanitizer instanceof SqlInjectionSanitizer
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+    any(SqlInjectionAdditionalTaintStep s).step(nodeFrom, nodeTo)
+  }
+}
+
+/**
+ * Detect taint flow of tainted data that reaches a SQL sink.
+ */
+module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;

swift/ql/src/queries/Security/CWE-089/SqlInjection.ql

@@ -13,9 +13,9 @@
 import swift
 import codeql.swift.dataflow.DataFlow
 import codeql.swift.security.SqlInjectionQuery
-import DataFlow::PathGraph
+import SqlInjectionFlow::PathGraph
 
-from SqlInjectionConfig config, DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode
-where config.hasFlowPath(sourceNode, sinkNode)
+from SqlInjectionFlow::PathNode sourceNode, SqlInjectionFlow::PathNode sinkNode
+where SqlInjectionFlow::flowPath(sourceNode, sinkNode)
 select sinkNode.getNode(), sourceNode, sinkNode, "This query depends on a $@.",
   sourceNode.getNode(), "user-provided value"