C++: Adding a model implementation for ODBC.

[bdrodes]

Adds a model implementation for ODBC database APIs.

[MathiasVP]

A couple of comments.

Additionally, would it be possible to add some tests to the end of the https://github.com/github/codeql/blob/main/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c file? Or if you prefer to the C++ file: https://github.com/github/codeql/blob/main/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.cpp

Basically, we just want a test that confirms that we can track tainted flow coming into the sink.

[MathiasVP]

Maybe we should move it down to the other SQL-like imports?

[bdrodes]

Done

[MathiasVP]

DCA looks good: performance is unaffected, and we're finding 4 new results that seem genuine. So I think this PR is good to go once the above comments have been addressed 🎉

[bdrodes]

Thanks. I'll look over the change suggestions shortly.

[bdrodes]

@MathiasVP, I've made the suggested changes and added a quick ODBC sql injection test. Let me know if there is anything else need to close this out. Thanks

[MathiasVP]

Looks good. Thanks!

The only thing we need now is to make the autoformatter happy. CI tells me that the ODBC.qll file needs to be formatted correctly.

You can do this using codeql query format -i path-to-the-file to format it in-place. Alternatively, you can do it via the Format Document command in VSCode.

[bdrodes]

Looks good. Thanks!

The only thing we need now is to make the autoformatter happy. CI tells me that the ODBC.qll file needs to be formatted correctly.

You can do this using codeql query format -i path-to-the-file to format it in-place. Alternatively, you can do it via the Format Document command in VSCode.

Whoops. I did this on my initial push but forgot to do it for the recent changes. It should be all good now.

[MathiasVP]

LGTM!