C++: Omit assign case from cpp/non-constant-format

[jketema]

Running the following on 1000 996 MRVA projects gave 1 result:

from FormattingFunctionCall call, Expr formatString
where
  call.getArgument(call.getFormatParameterIndex()) = formatString and
  not exists(DataFlow::Node sink |
    B::NonConstFlow::flowTo(sink) and
    B::isSinkImpl(sink, formatString)
  )
  and
  exists(DataFlow::Node sink |
    A::NonConstFlow::flowTo(sink) and
    A::isSinkImpl(sink, formatString)
  )
select formatString,
  "The format string argument to " + call.getTarget().getName() +
    " should be constant to prevent security issues and other potential errors."

Where both A and B are modules that both contain all the non-constant format code, except that B omits the lines also omitted in this PR. The one result comes from here with the source being the assignment in the if one line above it. However, this is an FP as the (virtual) function only ever returns constant strings without any formatting directives.

DCA shows one missing result on Nelson, but it seems that one is not being flagged up for the reason it should be:

tostring(register char *s, int n)
...
{
    ...
    sf = str_fmt;
    ... [ omitted code includes stores to elements of sf ]
    for(s = s0; s < se; s++)
    {
        t = *(unsigned char *)s;
        sprintf(s1, sf[t], t);
        s1 += strlen(s1);
    }
   ...
}

The query (after modification) highlights two sources:

• https://github.com/Nelson-numerical-software/nelson/blob/3479d3b1b3a8a7fa5e4dc246546b967bdbc8631a/modules/f2c/src/c/f2c/sysdep.c#L359
• https://github.com/Nelson-numerical-software/nelson/blob/3479d3b1b3a8a7fa5e4dc246546b967bdbc8631a/modules/f2c/src/c/f2c/sysdep.c#L414

I agree that this is a TF. However, the reason it's being flagged up is silly, i.e., because an assignment occurs on the right hand side of the the assignment to the element of str_fmt. It seems that the query should actually try to detect whether mutable arrays are used as format strings instead of relying on an accidental occurring assignment on the right-hand side.

[jketema]

I seemed to have swapped A and B in the MRVA query. Re-running and reverting this to draft for now. Fixed in top-level comment.