CPP: Speed up SensitiveExprs.qll 'suspicious' and 'nonSuspicious' mechanism.

geoffw0 · geoffw0 · commit 6e6c1693f4f8 · 2019-12-03T10:43:36.000Z
diff --git a/cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll b/cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll
@@ -1,17 +1,18 @@
 import cpp
 
-private string suspicious() {
-  result = "%password%" or
-  result = "%passwd%" or
-  result = "%account%" or
-  result = "%accnt%" or
-  result = "%trusted%"
-}
-
-private string nonSuspicious() {
-  result = "%hashed%" or
-  result = "%encrypted%" or
-  result = "%crypt%"
+bindingset[s]
+private predicate suspicious(string s) {
+  (
+    s.matches("%password%") or
+    s.matches("%passwd%") or
+    s.matches("%account%") or
+    s.matches("%accnt%") or
+    s.matches("%trusted%")
+  ) and not (
+    s.matches("%hashed%") or
+    s.matches("%encrypted%") or
+    s.matches("%crypt%")
+  )
 }
 
 abstract class SensitiveExpr extends Expr { }
@@ -20,8 +21,7 @@ class SensitiveVarAccess extends SensitiveExpr {
   SensitiveVarAccess() {
     this instanceof VariableAccess and
     exists(string s | this.toString().toLowerCase() = s |
-      s.matches(suspicious()) and
-      not s.matches(nonSuspicious())
+      suspicious(s)
     )
   }
 }
@@ -30,8 +30,7 @@ class SensitiveCall extends SensitiveExpr {
   SensitiveCall() {
     this instanceof FunctionCall and
     exists(string s | this.toString().toLowerCase() = s |
-      s.matches(suspicious()) and
-      not s.matches(nonSuspicious())
+      suspicious(s)
     )
   }
 }
