C++: handle namespace vars in DefautlTaintTracking

Robert Marsh · Robert Marsh · commit 420a0bb74c5d · 2019-12-04T13:16:12.000-08:00
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -206,7 +206,7 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global
     accessesVariable(load.asInstruction(), global) and
     fromCfg.hasFlow(load, sink) and
     tainted = adjustedSink(sink) and
-    globalVar = global.toString()
+    global = globalVarFromId(globalVar)
   )
 }
 

Original file line number	Diff line number	Diff line change
`@@ -206,7 +206,7 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global`
`206`	`206`	`accessesVariable(load.asInstruction(), global) and`
`207`	`207`	`fromCfg.hasFlow(load, sink) and`
`208`	`208`	`tainted = adjustedSink(sink) and`
`209`		`- globalVar = global.toString()`
	`209`	`+ global = globalVarFromId(globalVar)`
`210`	`210`	`)`
`211`	`211`	`}`
`212`	`212`