[DIFF-INFORMED] C#: ExternalAPIs

d10c · d10c · commit ac27b420dd7e · 2025-07-17T11:43:52.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/csharp/ql/src/Security%20Features/CWE-020/UntrustedDataToExternalAPI.ql#L23
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExternalAPIsQuery.qll
@@ -78,6 +78,8 @@ private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /** A module for tracking flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s. */

Original file line number	Diff line number	Diff line change
`@@ -78,6 +78,8 @@ private module RemoteSourceToExternalApiConfig implements DataFlow::ConfigSig {`
`78`	`78`	`predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }`
`79`	`79`
`80`	`80`	`predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }`
	`81`	`+`
	`82`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`81`	`83`	`}`
`82`	`84`
`83`	`85`	/** A module for tracking flow from `ActiveThreatModelSource`s to `ExternalApiDataNode`s. */