[RESOLVED] Difference between semmle.code.cpp.ir.dataflow.TaintTracking and semmle.code.cpp.dataflow.TaintTracking

[CaledoniaProject]

What's the difference between them?

• semmle.code.cpp.ir.dataflow.TaintTracking
• semmle.code.cpp.dataflow.TaintTracking

[tausbn]

Someone from the C/C++ team will likely be along to correct me if I'm wrong, but here's my understanding:

The "ir" part of the module name is short for "Intermediate Representation". Basically, the source code is compiled into a simpler representation, so that multiple distinct ways of representing the same operation are treated equally. The benefit of this is that the analysis is more likely to be correct (since it has to cover fewer constructs in total), but on the other hand it's more expensive since it has to perform the compilation into IR. You can find more information here.