DilbertConfig.qll

/**
 * @kind path-problem
 * 
 * An example configuration.
 * See ExampleConfiguration.expected for the results of running this query.
 */

import python
import semmle.python.dataflow.Configuration

/* First of all we set up some TaintKinds */

class Engineer extends TaintKind {

    Engineer() { this = "Wally" or this = "Dilbert" }

}

class Wally extends Engineer {

    Wally() { this = "Wally" }

}

/** Then the configuration */

class DilbertConfig extends TaintTracking::Configuration {

    DilbertConfig() { this = "Dilbert config" }

    override predicate isSource(DataFlow::Node node, TaintKind kind) {
        node.asAstNode().(Name).getId() = "ENGINEER" and kind instanceof Engineer
    }

    override predicate isSink(DataFlow::Node node, TaintKind kind) {
        /* Engineers hate meetings */
        function_param("meeting", node) and kind instanceof Engineer
    }

    override predicate isBarrier(DataFlow::Node node, TaintKind kind) {
        /* There is no way that Wally is working through lunch */
        function_param("lunch", node) and kind instanceof Wally
    }

    override predicate isBarrier(DataFlow::Node node) {
        /* Even the conscientious stop work if the building is on fire */
        function_param("fire", node)
    }

}



/** Helper predicate looking for `funcname(..., arg, ...)` */
private predicate function_param(string funcname, DataFlow::Node arg) {
    exists(Call call |
        call.getFunc().(Name).getId() = funcname and
        arg.asAstNode() = call.getAnArg()
    )
}