C++: Severely restrict the set of sinks in 'cpp/cleartext-storage-database'. This reduces the number of sinks considered on the 'sysown/proxysql' from > 62000 sinks to ~1000 sinks.

Author: MathiasVP

cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql

@@ -16,10 +16,55 @@ import semmle.code.cpp.security.SensitiveExprs
 import semmle.code.cpp.ir.dataflow.TaintTracking
 import FromSensitiveFlow::PathGraph
 
-class SqliteFunctionCall extends FunctionCall {
-  SqliteFunctionCall() { this.getTarget().getName().matches("sqlite%") }
+abstract class SqliteFunctionCall extends FunctionCall {
+  abstract Expr getASource();
+}
+
+class SqliteFunctionPrepareCall extends SqliteFunctionCall {
+  SqliteFunctionPrepareCall() { this.getTarget().getName().matches("sqlite3\\_prepare%") }
+
+  override Expr getASource() { result = this.getArgument(1) }
+}
+
+class SqliteFunctionExecCall extends SqliteFunctionCall {
+  SqliteFunctionExecCall() { this.getTarget().hasName("sqlite3_exec") }
+
+  override Expr getASource() { result = this.getArgument(1) }
+}
+
+class SqliteFunctionAppendfCall extends SqliteFunctionCall {
+  SqliteFunctionAppendfCall() {
+    this.getTarget().getName().matches(["sqlite3_str_appendf", "sqlite3_str_vappendf"])
+  }
+
+  override Expr getASource() { result = this.getArgument(any(int n | n > 0)) }
+}
+
+class SqliteFunctionAppendNonCharCall extends SqliteFunctionCall {
+  SqliteFunctionAppendNonCharCall() {
+    this.getTarget().getName().matches(["sqlite3_str_append", "sqlite3_str_appendall"])
+  }
+
+  override Expr getASource() { result = this.getArgument(1) }
+}
+
+class SqliteFunctionAppendCharCall extends SqliteFunctionCall {
+  SqliteFunctionAppendCharCall() { this.getTarget().hasName("sqlite3_str_appendchar") }
+
+  override Expr getASource() { result = this.getArgument(2) }
+}
+
+class SqliteFunctionBindCall extends SqliteFunctionCall {
+  SqliteFunctionBindCall() {
+    this.getTarget()
+        .getName()
+        .matches([
+            "sqlite3_bind_blob", "sqlite3_bind_blob64", "sqlite3_bind_text", "sqlite3_bind_text16",
+            "sqlite3_bind_text64", "sqlite3_bind_value", "sqlite3_bind_pointer"
+          ])
+  }
 
-  Expr getASource() { result = this.getAnArgument() }
+  override Expr getASource() { result = this.getArgument(2) }
 }
 
 predicate sqlite_encryption_used() {