C/C++: Don't force-include XxeFlowStateTransformer steps in XXE.ql.

aschackmull · aschackmull · commit c01a494ea515 · 2023-07-19T11:41:15.000+02:00
diff --git a/cpp/ql/src/Security/CWE/CWE-611/XXE.ql b/cpp/ql/src/Security/CWE/CWE-611/XXE.ql
@@ -43,6 +43,8 @@ module XxeConfig implements DataFlow::StateConfigSig {
     // flowstate value.
     node.asIndirectExpr().(XxeFlowStateTransformer).transform(flowstate) != flowstate
   }
+
+  predicate neverSkip(DataFlow::Node node) { none() }
 }
 
 module XxeFlow = DataFlow::GlobalWithState<XxeConfig>;

Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,8 @@ module XxeConfig implements DataFlow::StateConfigSig {`
`43`	`43`	`// flowstate value.`
`44`	`44`	`node.asIndirectExpr().(XxeFlowStateTransformer).transform(flowstate) != flowstate`
`45`	`45`	`}`
	`46`	`+`
	`47`	`+ predicate neverSkip(DataFlow::Node node) { none() }`
`46`	`48`	`}`
`47`	`49`
`48`	`50`	`module XxeFlow = DataFlow::GlobalWithState<XxeConfig>;`