C++: Fix FP on cpp/cleartext-transmission

[MathiasVP]

The query did not recognize that fscanf is potentially not a remote flow source because we didn't override the optional hasSocketInput predicate on RemoteFlowSourceFunction.

DCA shows lots of removed results in SAMATE. They're all instances of exactly the pattern I added in the query test: a fscanf call that writes to stdin.

[Copilot]

Pull request overview

This PR fixes a false positive in the C++ cpp/cleartext-transmission query by refining the fscanf remote-source model so the analysis can distinguish socket-backed streams from obviously local streams (for example, stdin). It also adds a regression test and corresponding change notes for both the query and library packs.

Changes:

• Refine the fscanf model by implementing RemoteFlowSourceFunction.hasSocketInput.
• Add a regression test case ensuring fscanf(stdin, ...) is not treated as a remote source.
• Add change notes documenting the query-result change and the underlying library model change.

Show a summary per file

File	Description
cpp/ql/lib/semmle/code/cpp/models/implementations/Scanf.qll	Updates the fscanf model to implement hasSocketInput.
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp	Adds a regression test for fscanf(stdin, ...) being treated as local.
cpp/ql/src/change-notes/2026-05-15-cleartext-transmission-fp.md	Documents the cpp/cleartext-transmission false-positive reduction.
cpp/ql/lib/change-notes/2026-05-15-hasSocketInput-for-fscanf.md	Documents the library model refinement for fscanf.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 2

[geoffw0]

The FscanfModel / hasSocketInput model extension LGTM. 👍

It took me a few minutes to realize that cpp/cleartext-transmission actually looks for both transmission and receipt of cleartext sensitive data (fscanf would be receiving), which could be clearer.

[MathiasVP]

It took me a few minutes to realize that cpp/cleartext-transmission actually looks for both transmission and receipt of cleartext sensitive data (fscanf would be receiving), which could be clearer.

Yeah, I agree. Thanks for the quick review!