C++: Model secure_getenv and _wgetenv as local flow sources

[jketema]

These are modelled as part of isUserInput, but not as LocalFlowSourceFunctions.

Does this need tests? If so, where to add them? I could not find an obvious location for them.

[MathiasVP]

Does this need tests? If so, where to add them? I could not find an obvious location for them.

Good question. I think the answer is that we should have a way to test these. AFAIK, the cloest test we have is https://github.com/github/codeql/blob/main/cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/remote-flow-sink.ql. I think we can take inspiration (and also slightly improve the current state) by:

• Moving this file out of DefaultTaintTracking. This test isn't actually related to DefaultTaintTracking, but just placed there because it allowed us to reuse the existing source files, I guess?
• Maybe split up the inline expectations test into local and remote versions
• Add a similar inline expectation test file that tests sources in addition to sinks. After all, the sources is really the one we care about the most.

[MathiasVP]

LGTM!