Adapt query not to depend on TaintTracking::FunctionModel

smowton · smowton · commit a673610e1803 · 2023-04-12T14:19:01.000+01:00
diff --git a/go/ql/src/Security/CWE-352/ConstantOauth2State.ql b/go/ql/src/Security/CWE-352/ConstantOauth2State.ql
@@ -106,7 +106,10 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
     TaintTracking::referenceStep(pred, succ)
     or
     // Propagate across Sprintf and similar calls
-    any(Fmt::AppenderOrSprinter s).taintStep(pred, succ)
+    exists(DataFlow::CallNode cn |
+      cn.getACalleeIncludingExternals().asFunction() instanceof Fmt::AppenderOrSprinter |
+      pred = cn.getAnArgument() and succ = cn.getResult()
+    )
   }
 
   predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
