Go/PamAuthBypass: disable due to secondary flow

d10c · d10c · commit abe696dd8f87 · 2025-10-08T13:42:38.000+02:00
diff --git a/go/ql/src/experimental/CWE-285/PamAuthBypass.ql b/go/ql/src/experimental/CWE-285/PamAuthBypass.ql
@@ -43,9 +43,9 @@ module PamStartToAcctMgmtConfig implements DataFlow::ConfigSig {
     exists(PamAcctMgmt p | p.getACall().getReceiver() = sink)
   }
 
-  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
+  predicate observeDiffInformedIncrementalMode() {
+    none() // used as secondary flow
+  }
 }
 
 module PamStartToAcctMgmtFlow = TaintTracking::Global<PamStartToAcctMgmtConfig>;
@@ -60,9 +60,9 @@ module PamStartToAuthenticateConfig implements DataFlow::ConfigSig {
     exists(PamAuthenticate p | p.getACall().getReceiver() = sink)
   }
 
-  predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
+  predicate observeDiffInformedIncrementalMode() {
+    none() // uses secondary flow
+  }
 }
 
 module PamStartToAuthenticateFlow = TaintTracking::Global<PamStartToAuthenticateConfig>;

Original file line number	Diff line number	Diff line change
`@@ -43,9 +43,9 @@ module PamStartToAcctMgmtConfig implements DataFlow::ConfigSig {`
`43`	`43`	`exists(PamAcctMgmt p \| p.getACall().getReceiver() = sink)`
`44`	`44`	`}`
`45`	`45`
`46`		`- predicate observeDiffInformedIncrementalMode() { any() }`
`47`		`-`
`48`		`- Location getASelectedSinkLocation(DataFlow::Node sink) { none() }`
	`46`	`+ predicate observeDiffInformedIncrementalMode() {`
	`47`	`+ none() // used as secondary flow`
	`48`	`+ }`
`49`	`49`	`}`
`50`	`50`
`51`	`51`	`module PamStartToAcctMgmtFlow = TaintTracking::Global<PamStartToAcctMgmtConfig>;`
`@@ -60,9 +60,9 @@ module PamStartToAuthenticateConfig implements DataFlow::ConfigSig {`
`60`	`60`	`exists(PamAuthenticate p \| p.getACall().getReceiver() = sink)`
`61`	`61`	`}`
`62`	`62`
`63`		`- predicate observeDiffInformedIncrementalMode() { any() }`
`64`		`-`
`65`		`- Location getASelectedSinkLocation(DataFlow::Node sink) { none() }`
	`63`	`+ predicate observeDiffInformedIncrementalMode() {`
	`64`	`+ none() // uses secondary flow`
	`65`	`+ }`
`66`	`66`	`}`
`67`	`67`
`68`	`68`	`module PamStartToAuthenticateFlow = TaintTracking::Global<PamStartToAuthenticateConfig>;`