PS: Also use the 'query' predicate for implicit reads.

MathiasVP · MathiasVP · commit a512b5a2d0a5 · 2025-09-11T17:14:48.000+01:00
diff --git a/powershell/ql/lib/semmle/code/powershell/security/SqlInjectionCustomizations.qll b/powershell/ql/lib/semmle/code/powershell/security/SqlInjectionCustomizations.qll
@@ -73,7 +73,7 @@ module SqlInjection {
 
     override predicate allowImplicitRead(DataFlow::ContentSet cs) {
       cs.getAStoreContent().(DataFlow::Content::KnownKeyContent).getIndex().asString().toLowerCase() =
-        ["query", "inputfile"]
+        query()
     }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -73,7 +73,7 @@ module SqlInjection {`
`73`	`73`
`74`	`74`	`override predicate allowImplicitRead(DataFlow::ContentSet cs) {`
`75`	`75`	`cs.getAStoreContent().(DataFlow::Content::KnownKeyContent).getIndex().asString().toLowerCase() =`
`76`		`- ["query", "inputfile"]`
	`76`	`+ query()`
`77`	`77`	`}`
`78`	`78`	`}`
`79`	`79`