codeql: taint basename()

diff --git a/.github/codeql-queries/PotentiallyDangerousFunction.ql b/.github/codeql-queries/PotentiallyDangerousFunction.ql
index d5a5635c356788e5cc05e36daa7a47f8bdab5055..40e2bbb6f9eff03ef30c83d4f4609d284d7d2cf6 100644 (file)
--- a/.github/codeql-queries/PotentiallyDangerousFunction.ql
+++ b/.github/codeql-queries/PotentiallyDangerousFunction.ql
@@ -49,6 +49,9 @@ predicate potentiallyDangerousFunction(Function f, string message) {
   ) or (
     f.getQualifiedName() = "dirname" and
     message = "Call dirname() is icky. Use path_extract_directory() instead."
+  ) or (
+    f.getQualifiedName() = "basename" and
+    message = "Call basename() is icky. Use path_extract_filename() instead."
   )
 }