[DIFF-INFORMED] Go: ExternalAPIs

d10c · d10c · commit 109f6ddc2d0b · 2025-07-17T11:46:33.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-020/UntrustedDataToExternalAPI.ql#L18
diff --git a/go/ql/lib/semmle/go/security/ExternalAPIs.qll b/go/ql/lib/semmle/go/security/ExternalAPIs.qll
@@ -186,6 +186,8 @@ private module UntrustedDataConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -186,6 +186,8 @@ private module UntrustedDataConfig implements DataFlow::ConfigSig {`
`186`	`186`	`predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }`
`187`	`187`
`188`	`188`	`predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }`
	`189`	`+`
	`190`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`189`	`191`	`}`
`190`	`192`
`191`	`193`	`/**`