[cpp-codeql]How to set function's argument as source

[hac425xxx]

Demo c code

#include <stdio.h>


void wrap_printf(char* x)
{
    printf(x);
}


int wrap_read(char* x)
{
    int n = read(0, x, 0x20);
    return n;
}



int vuln1()
{
    char buf[0x20] = {0};
    int n = read(0, buf, 0x20);

    if(n>0)
    {
        wrap_printf(buf);
    }

}


int vuln2()
{
    char buf[0x20] = {0};
    int n = wrap_read(buf);

    if(n>0)
    {
        wrap_printf(buf);
    }
}


int our_clean(char* buf)
{
    memset(buf, 0, 0x20);
}


int vuln_clean()
{
    char buf[0x20] = {0};
    int n = wrap_read(buf);

    our_clean(buf);
    if(n>0)
    {
        wrap_printf(buf);
    }
}


char* get_taint_data()
{
    return "xxxx";
}


int vuln_get_taint(int n)
{
    char* t = get_taint_data();
    if(n>0)
    {
        wrap_printf(t);
    }
}


int main()
{
    puts("xxx");
}

And The query .

import cpp
import semmle.code.cpp.dataflow.TaintTracking
import semmle.code.cpp.dataflow.DataFlow
import semmle.code.cpp.security.Security
import DataFlow::PathGraph

class TestConfiguration extends TaintTracking::Configuration {
  TestConfiguration() { this = "TestConfiguration" }

  override predicate isSource(DataFlow::Node source) {
    exists(FunctionCall fc |
      fc.getTarget().hasName("get_taint_data") and
      source.asExpr() = fc
    )
    or
    exists(FunctionCall fc |
      fc.getTarget().hasName("read") and
      fc.getArgument(1) = source.asExpr()
    )
    or
    exists(FunctionCall fc |
      fc.getTarget().hasName("wrap_read") and
      fc.getArgument(0) = source.asExpr()
    )
  }

  override predicate isSink(DataFlow::Node sink) {
    exists(FunctionCall fc |
      fc.getTarget().hasName("printf") and
      fc.getArgument(0) = sink.asExpr()
    )
  }
}

from TestConfiguration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink, "<message>"
// from FunctionCall fc
// where fc.getTarget().hasName("get_taint_data")
// select fc

It only has the result of call to get_taint_data .

x | call to get_taint_data | x | <message>

It seem that codeql by default will only track the return value of the function, how can I make codeql to track the argument of a function.

Thanks!

[MathiasVP]

This has been answered here: github/codeql#3358