Skip to content

Update diff-informed testing to always treat sources and sinks as alert locations#20607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
d10c merged 77 commits into from
Oct 28, 2025
Merged

Update diff-informed testing to always treat sources and sinks as alert locations #20607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
77 commits
Select commit Hold shift + click to select a range
3fa8259
Actions/OutputClobberingQuery
d10c Oct 8, 2025
890ca8e
Actions/RequestForgeryQuery
d10c Oct 8, 2025
bb10307
Actions/SecretExfiltrationQuery
d10c Oct 8, 2025
d36b721
Actions/CompositeActionsSinks
d10c Oct 8, 2025
78f2cee
Actions/CompositeActionsSources
d10c Oct 8, 2025
9c24ce0
Actions/CompositeActionsSummaries
d10c Oct 8, 2025
a972ef7
Actions/ReusableWorkflowsSinks
d10c Oct 8, 2025
1243c63
Actions/ReusableWorkflowsSources
d10c Oct 8, 2025
5a1a887
Actions/ReusableWorkflowsSummaries
d10c Oct 8, 2025
ad31f1a
C++/WordexpTainted
d10c Oct 8, 2025
ba22f0d
C#/DontInstallRootCert
d10c Oct 8, 2025
7722f31
Go/DivideByZero
d10c Oct 8, 2025
59a8e9b
Go/InsufficientKeySize
d10c Oct 8, 2025
913550f
Java/ArbitraryApkInstallationQuery
d10c Oct 8, 2025
a228936
Java/ArithmeticTainted
d10c Oct 8, 2025
1129230
Java/ArithmeticUncontrolledQuery
d10c Oct 8, 2025
b023880
Java/BrokenCryptoAlgorithmQuery
d10c Oct 8, 2025
4482e83
Java/CommandLineQuery
d10c Oct 9, 2025
dc1dff9
Java/ConditionalBypass
d10c Oct 9, 2025
9eeeec3
Java/ImproperValidationOfArrayConstructionCodeSpecifiedQuery
d10c Oct 9, 2025
eebff9c
Java/ImproperValidationOfArrayConstructionFlow
d10c Oct 9, 2025
247ae1d
Java/MaybeBrokenCryptoAlgorithmQuery
d10c Oct 9, 2025
72a9777
Java/NumericCastTaintedQuery
d10c Oct 9, 2025
697f428
Java/TaintedEnvironmentVariableQuery
d10c Oct 9, 2025
2a889f4
Java/TaintedPermissionsCheckQuery
d10c Oct 9, 2025
4439322
Java/TempDirLocalInformationDisclosureQuery
d10c Oct 9, 2025
518c081
Java/UnsafeDeserializationQuery
d10c Oct 9, 2025
f24a6f6
Java/WebviewDebugEnabledQuery
d10c Oct 9, 2025
2a30ea9
JS/CommandInjectionQuery
d10c Oct 10, 2025
71cf042
JS/IndirectCommandInjectionQuery
d10c Oct 14, 2025
9434325
JS/ShellCommandInjectionFromEnvironmentQuery
d10c Oct 14, 2025
bcdbe0b
JS/PolynomialReDoSQuery
d10c Oct 14, 2025
bb80d83
JS/SSRF
d10c Oct 14, 2025
baccdcc
Python/PolynomialReDoSQuery
d10c Oct 14, 2025
37fff48
Python/ServerSideRequestForgeryQuery
d10c Oct 14, 2025
6d57316
Python/UnsafeUnpackQuery
d10c Oct 14, 2025
4bc9ede
Python/UnsafeUsageOfClientSideEncryptionVersion
d10c Oct 14, 2025
998de14
Python/CorsBypass
d10c Oct 14, 2025
1ff24cb
Python/LdapInsecureAuth
d10c Oct 14, 2025
6519bd9
Ruby/PolynomialReDoSQuery
d10c Oct 14, 2025
50f2540
Ruby/ManuallyCheckHttpVerb
d10c Oct 14, 2025
495be51
Ruby/WeakParams
d10c Oct 14, 2025
6ede0a7
Ruby/WeakFilePermissions
d10c Oct 14, 2025
462d8c5
Shared: update qldoc
d10c Oct 14, 2025
2332cea
Swift/CleartextStorageDatabaseQuery
d10c Oct 14, 2025
c190fae
Swift/CleartextStoragePreferencesQuery
d10c Oct 14, 2025
6c52d4b
Swift/ConstantPasswordQuery
d10c Oct 14, 2025
7ba7c43
Swift/InsufficientHashIterationsQuery
d10c Oct 14, 2025
5a6f731
Swift/StaticInitializationVectorQuery
d10c Oct 14, 2025
cd86e7d
Swift/StringLengthConflationQuery
d10c Oct 14, 2025
895bd93
Swift/UnsafeJsEvalQuery
d10c Oct 14, 2025
8a750b3
Swift/UnsafeUnpackQuery
d10c Oct 14, 2025
1f53ffb
Actions/ArtifactPoisoningQuery
d10c Oct 15, 2025
edc72d2
Actions/EnvPathInjectionQuery
d10c Oct 15, 2025
c402233
Actions/EnvVarInjectionQuery
d10c Oct 15, 2025
62fde8f
Actions/ArgumentInjectionQuery
d10c Oct 15, 2025
974d174
Actions/CodeInjectionQuery
d10c Oct 15, 2025
464f6cb
C++/ConstantSizeArrayOffByOne
d10c Oct 15, 2025
65d79ff
C++/ExecTainted
d10c Oct 15, 2025
a4ac039
C++/OverflowDestination
d10c Oct 15, 2025
2756e82
C++/UnboundedWrite
d10c Oct 15, 2025
f7a1a4c
C++/NonConstantFormat
d10c Oct 15, 2025
0ed27f4
C++/CleartextSqliteDatabase
d10c Oct 15, 2025
17b261a
C++/AuthenticationBypass
d10c Oct 15, 2025
d89aa0f
C++/CleartextBufferWrite
d10c Oct 15, 2025
b018040
C++/CleartextFileWrite
d10c Oct 15, 2025
bbe2bf2
C++/CleartextTransmission
d10c Oct 15, 2025
1321cbb
C++/DecompressionBombs
d10c Oct 15, 2025
f3d51e0
C++/ArithmeticUncontrolled
d10c Oct 15, 2025
a65d4d5
C++/TaintedAllocationSize
d10c Oct 15, 2025
ec63547
C++/UseOfHttp
d10c Oct 15, 2025
d41268f
Go/UnhandledCloseWritableHandle
d10c Oct 15, 2025
0f0bd0f
Go/SSRF
d10c Oct 15, 2025
4952cb2
Rust/AccessAfterLifetime
d10c Oct 15, 2025
8e0c453
Rust/InsecureCookie
d10c Oct 15, 2025
96e1536
C++/SqlTainted
d10c Oct 15, 2025
a0975e7
Constrain location overrides to actual sources/sinks
d10c Oct 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -100,8 +100,6 @@ private module ArgumentInjectionConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -333,8 +333,6 @@ private module ArtifactPoisoningConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -80,8 +80,6 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -130,8 +130,6 @@ private module EnvPathInjectionConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -184,8 +184,6 @@ private module EnvVarInjectionConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -212,8 +212,6 @@ private module OutputClobberingConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

/** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,6 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

/** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -17,8 +17,6 @@ private module SecretExfiltrationConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof SecretExfiltrationSink }

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

/** Tracks flow of unsafe user input that is used in a context where it may lead to a secret exfiltration. */
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/src/Models/CompositeActionsSinks.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,8 +26,6 @@ private module MyConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module MyFlow = TaintTracking::Global<MyConfig>;
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/src/Models/CompositeActionsSources.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,8 +36,6 @@ private module MyConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module MyFlow = TaintTracking::Global<MyConfig>;
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/src/Models/CompositeActionsSummaries.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -27,8 +27,6 @@ private module MyConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module MyFlow = TaintTracking::Global<MyConfig>;
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/src/Models/ReusableWorkflowsSinks.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,8 +26,6 @@ private module MyConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module MyFlow = TaintTracking::Global<MyConfig>;
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/src/Models/ReusableWorkflowsSources.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -36,8 +36,6 @@ private module MyConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module MyFlow = TaintTracking::Global<MyConfig>;
Expand Down
2 changes: 0 additions & 2 deletions actions/ql/src/Models/ReusableWorkflowsSummaries.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -27,8 +27,6 @@ private module MyConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module MyFlow = TaintTracking::Global<MyConfig>;
Expand Down
4 changes: 1 addition & 3 deletions cpp/ql/src/Critical/OverflowDestination.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -85,10 +85,8 @@ module OverflowDestinationConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(FunctionCall fc | result = fc.getLocation() |
exists(FunctionCall fc | result = [fc.getLocation(), sink.getLocation()] |
sourceSized(fc, sink.asIndirectConvertedExpr())
)
}
Expand Down
8 changes: 3 additions & 5 deletions cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -171,12 +171,10 @@ module NonConstFlowConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
exists(FormattingFunctionCall call, Expr formatString | result = call.getLocation() |
exists(FormattingFunctionCall call, Expr formatString |
result = [call.getLocation(), sink.getLocation()]

@michaelnebelmichaelnebelOct 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, great. A sink location is only relevant if the below holds.

|
isSinkImpl(sink, formatString) and
call.getArgument(call.getFormatParameterIndex()) = formatString
)
Expand Down
2 changes: 1 addition & 1 deletion cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -155,7 +155,7 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(DataFlow::Node concatResult, Expr command, ExecState state |
result = [concatResult.getLocation(), command.getLocation()] and
result = [concatResult.getLocation(), command.getLocation(), sink.getLocation()] and
isSink(sink, state) and
isSinkImpl(sink, command, _) and
concatResult = state.getOutgoingNode()
Expand Down
4 changes: 3 additions & 1 deletion cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -58,7 +58,9 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(Expr taintedArg | result = taintedArg.getLocation() | taintedArg = asSinkExpr(sink))
exists(Expr taintedArg | result = [taintedArg.getLocation(), sink.getLocation()] |
taintedArg = asSinkExpr(sink)
)
}
}

Expand Down
2 changes: 1 addition & 1 deletion cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -128,7 +128,7 @@ module Config implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(BufferWrite bw | result = bw.getLocation() | isSink(sink, bw, _))
exists(BufferWrite bw | result = [bw.getLocation(), sink.getLocation()] | isSink(sink, bw, _))
}
}

Expand Down
3 changes: 2 additions & 1 deletion cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,8 @@ module UncontrolledArithConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
result = getExpr(source).getLocation()
isSource(source) and

@michaelnebelmichaelnebelOct 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this needed?

@d10cd10cOct 28, 2025

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not necessary for correctness, but it reduces the size of getASelectedSourceLocation from all nodes down to the sources.

result = [getExpr(source).getLocation(), source.getLocation()]
}
}

Expand Down
2 changes: 1 addition & 1 deletion cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -95,7 +95,7 @@ module TaintedAllocationSizeConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(Expr alloc | result = alloc.getLocation() | allocSink(alloc, sink))
exists(Expr alloc | result = [alloc.getLocation(), sink.getLocation()] | allocSink(alloc, sink))
}
}

Expand Down
4 changes: 3 additions & 1 deletion cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,9 @@ module Config implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(Expr condition | result = condition.getLocation() | isSink(sink, condition))
exists(Expr condition | result = [condition.getLocation(), sink.getLocation()] |
isSink(sink, condition)
)
}
}

Expand Down
4 changes: 3 additions & 1 deletion cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -51,7 +51,9 @@ module ToBufferConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(SensitiveBufferWrite w | result = w.getLocation() | isSinkImpl(sink, w))
exists(SensitiveBufferWrite w | result = [w.getLocation(), sink.getLocation()] |
isSinkImpl(sink, w)
)
}
}

Expand Down
6 changes: 4 additions & 2 deletions cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -35,11 +35,13 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sourceNode) {
exists(SensitiveExpr source | result = source.getLocation() | isSourceImpl(sourceNode, source))
exists(SensitiveExpr source | result = [source.getLocation(), sourceNode.getLocation()] |
isSourceImpl(sourceNode, source)
)
}

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(FileWrite w | result = w.getLocation() | isSinkImpl(sink, w, _))
exists(FileWrite w | result = [w.getLocation(), sink.getLocation()] | isSinkImpl(sink, w, _))
}
}

Expand Down
4 changes: 3 additions & 1 deletion cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -249,7 +249,9 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(NetworkSendRecv networkSendRecv | result = networkSendRecv.getLocation() |
exists(NetworkSendRecv networkSendRecv |
result = [networkSendRecv.getLocation(), sink.getLocation()]
|
isSinkSendRecv(sink, networkSendRecv)
)
}
Expand Down
4 changes: 2 additions & 2 deletions cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -127,13 +127,13 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
exists(SensitiveExpr sensitive | result = sensitive.getLocation() |
exists(SensitiveExpr sensitive | result = [sensitive.getLocation(), source.getLocation()] |
isSourceImpl(source, sensitive)
)
}

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(SqliteFunctionCall sqliteCall | result = sqliteCall.getLocation() |
exists(SqliteFunctionCall sqliteCall | result = [sqliteCall.getLocation(), sink.getLocation()] |
isSinkImpl(sink, sqliteCall, _)
)
}
Expand Down
5 changes: 2 additions & 3 deletions cpp/ql/src/Security/CWE/CWE-319/UseOfHttp.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -91,10 +91,9 @@ module HttpStringToUrlOpenConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
result = source.asIndirectExpr().getLocation()
isSource(source) and
result = [source.asIndirectExpr().getLocation(), source.getLocation()]
}

Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
}

module HttpStringToUrlOpen = TaintTracking::Global<HttpStringToUrlOpenConfig>;
Expand Down
2 changes: 0 additions & 2 deletions cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -50,8 +50,6 @@ module WordexpTaintConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }
}

module WordexpTaint = TaintTracking::Global<WordexpTaintConfig>;
Expand Down
6 changes: 4 additions & 2 deletions cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -187,12 +187,14 @@ module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
exists(Variable v | result = v.getLocation() | isSourceImpl(source, v))
exists(Variable v | result = v.getLocation() or result = source.getLocation() |
isSourceImpl(source, v)
)
}

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(PointerArithmeticInstruction pai, Instruction deref |
result = [pai, deref].getLocation() and
result = [[pai, deref].getLocation(), sink.getLocation()] and
isInvalidPointerDerefSink2(sink, deref, _) and
isSink(sink, ArrayAddressToDerefConfig::TOverflowArithmetic(pai))
)
Expand Down
2 changes: 0 additions & 2 deletions cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -31,8 +31,6 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(FunctionCall fc | result = [sink.getLocation(), fc.getLocation()] | isSink(fc, sink))
}
Expand Down
2 changes: 0 additions & 2 deletions csharp/ql/src/Security Features/CWE-327/DontInstallRootCert.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,8 +39,6 @@ module AddCertToRootStoreConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module AddCertToRootStore = DataFlow::Global<AddCertToRootStoreConfig>;
Expand Down
2 changes: 1 addition & 1 deletion go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -132,7 +132,7 @@ module UnhandledFileCloseConfig implements DataFlow::ConfigSig {
predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) {
exists(DataFlow::CallNode openCall | result = openCall.getLocation() |
exists(DataFlow::CallNode openCall | result = [openCall.getLocation(), source.getLocation()] |
isWritableFileHandle(source, openCall)
Comment on lines +135 to 136

CopilotAIOct 15, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Using a list expression [openCall.getLocation(), source.getLocation()] for result assignment is unconventional. Consider using separate or branches for better readability and consistency with other files in this PR.

Suggested change
exists(DataFlow::CallNodeopenCall|result=[openCall.getLocation(), source.getLocation()]|
isWritableFileHandle(source, openCall)
exists(DataFlow::CallNodeopenCall|
isWritableFileHandle(source, openCall)and
(result=openCall.getLocation()orresult=source.getLocation())

Copilot uses AI. Check for mistakes.
)
}
Expand Down
2 changes: 0 additions & 2 deletions go/ql/src/Security/CWE-326/InsufficientKeySize.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -27,8 +27,6 @@ module Config implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

/**
Expand Down
2 changes: 0 additions & 2 deletions go/ql/src/experimental/CWE-369/DivideByZero.ql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -47,8 +47,6 @@ module Config implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

/**
Expand Down
4 changes: 2 additions & 2 deletions go/ql/src/experimental/CWE-918/SSRF.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33,9 +33,9 @@ module ServerSideRequestForgery {

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node source) { none() }

Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.(Sink).getLocation()
or
result = sink.(Sink).getARequest().getLocation()
}
}
Expand Down
2 changes: 0 additions & 2 deletions java/ql/lib/semmle/code/java/security/ArbitraryApkInstallationQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -25,8 +25,6 @@ module ApkInstallationConfig implements DataFlow::ConfigSig {
}

predicate observeDiffInformedIncrementalMode() { any() }

Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
}

module ApkInstallationFlow = DataFlow::Global<ApkInstallationConfig>;
Expand Down
8 changes: 6 additions & 2 deletions java/ql/lib/semmle/code/java/security/ArithmeticTaintedQuery.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -19,7 +19,9 @@ module ArithmeticOverflowConfig implements DataFlow::ConfigSig {
}

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(ArithExpr exp | result = exp.getLocation() | overflowSink(exp, sink.asExpr()))
exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
overflowSink(exp, sink.asExpr())
)
}
}

Expand All@@ -43,7 +45,9 @@ module ArithmeticUnderflowConfig implements DataFlow::ConfigSig {
}

Location getASelectedSinkLocation(DataFlow::Node sink) {
exists(ArithExpr exp | result = exp.getLocation() | underflowSink(exp, sink.asExpr()))
exists(ArithExpr exp | result = [exp.getLocation(), sink.getLocation()] |
underflowSink(exp, sink.asExpr())
)
}
}

Expand Down
Loading
Loading