Java/CommandLineQuery

https://github.com/github/codeql/blob/85a4dd0325104ecd613c9e3e7c25190d41906605/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql

https://github.com/github/codeql/blob/857b51be5895bf437ea25b5ce2581527d5af69fb/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql

https://github.com/github/codeql/blob/b6e56f26c7509a041ce92bdda13db0a09da886e3/java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.ql

Author: d10c

java/ql/lib/semmle/code/java/security/CommandLineQuery.qll

@@ -63,9 +63,11 @@ module InputToArgumentToExecFlowConfig implements DataFlow::ConfigSig {
   // only to prevent overlapping results between two queries.
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  // All queries use the argument as the primary location and do not use the
-  // sink as an associated location.
+  // ExecTainted.ql queries use the argument as the primary location;
+  // ExecUnescaped.ql does not (used to prevent overlapping results).
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     exists(Expr argument | argumentToExec(argument, sink) | result = argument.getLocation())
   }
 }