[DIFF-INFORMED] Go: CommandInjection

d10c · d10c · commit 89f760460b30 · 2025-07-17T11:46:30.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-078/CommandInjection.ql#L28
diff --git a/go/ql/lib/semmle/go/security/CommandInjection.qll b/go/ql/lib/semmle/go/security/CommandInjection.qll
@@ -24,6 +24,8 @@ module CommandInjection {
     }
 
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /**
@@ -80,6 +82,8 @@ module CommandInjection {
       node instanceof Sanitizer or
       node = any(ArgumentArrayWithDoubleDash array).getASanitizedElement()
     }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   /**

Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,8 @@ module CommandInjection {`
`24`	`24`	`}`
`25`	`25`
`26`	`26`	`predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }`
	`27`	`+`
	`28`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`27`	`29`	`}`
`28`	`30`
`29`	`31`	`/**`
`@@ -80,6 +82,8 @@ module CommandInjection {`
`80`	`82`	`node instanceof Sanitizer or`
`81`	`83`	`node = any(ArgumentArrayWithDoubleDash array).getASanitizedElement()`
`82`	`84`	`}`
	`85`	`+`
	`86`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`83`	`87`	`}`
`84`	`88`
`85`	`89`	`/**`