C++: Allow member variables to be picked as input nodes.

geoffw0 · geoffw0 · commit 8bdb67cc15d6 · 2024-02-09T14:24:37.000Z
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
@@ -166,7 +166,7 @@ module SourceSinkInterpretationInput implements
       c = "" and
       e.getQualifier() = n.asExpr()
       or
-      // Allow variables (without a qualifier) to be picked as input nodes.
+      // Allow variables to be picked as input nodes.
       // We could simply do this as `e = n.asExpr()`, but that would not allow
       // us to pick `x` as a sink in an example such as `x = source()` (but
       // only subsequent uses of `x`) since the variable access on `x` doesn't
@@ -175,7 +175,6 @@ module SourceSinkInterpretationInput implements
       // expression associated with the destination instruction. This means
       // that the `x` in `x = source()` can be marked as an input.
       c = "" and
-      not exists(e.getQualifier()) and
       exists(StoreInstruction store |
         store.getDestinationAddress().getUnconvertedResultExpression() = e and
         n.asInstruction() = store
diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp b/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp
@@ -239,11 +239,11 @@ void test_class_members() {
 
 	mc.memberMadSinkArg0(source()); // $ ir
 
-	mc.memberMadSinkVar = source(); // $ MISSING: ir
+	mc.memberMadSinkVar = source(); // $ ir
 
 	mnc.namespaceMemberMadSinkArg0(source()); // $ ir
 	MyNamespace::MyClass::namespaceStaticMemberMadSinkArg0(source()); // $ ir
-	mnc.namespaceMemberMadSinkVar = source(); // $ MISSING: ir
+	mnc.namespaceMemberMadSinkVar = source(); // $ ir
 	MyNamespace::MyClass::namespaceStaticMemberMadSinkVar = source(); // $ ir
 
 	// test class member summaries
