[DIFF-INFORMED] C++: SqlTainted

d10c · d10c · commit 7df09f369fd8 · 2025-08-15T12:01:01.000+02:00
diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
@@ -54,6 +54,12 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
       sql.barrierSqlArgument(input, _)
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    exists(Expr taintedArg | result = taintedArg.getLocation() | taintedArg = asSinkExpr(sink))
+  }
 }
 
 module SqlTainted = TaintTracking::Global<SqlTaintedConfig>;

Original file line number	Diff line number	Diff line change
`@@ -54,6 +54,12 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {`
`54`	`54`	`sql.barrierSqlArgument(input, _)`
`55`	`55`	`)`
`56`	`56`	`}`
	`57`	`+`
	`58`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`59`	`+`
	`60`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`61`	`+ exists(Expr taintedArg \| result = taintedArg.getLocation() \| taintedArg = asSinkExpr(sink))`
	`62`	`+ }`
`57`	`63`	`}`
`58`	`64`
`59`	`65`	`module SqlTainted = TaintTracking::Global<SqlTaintedConfig>;`