Refactor HttpStringLiteral

Materialize HTTP string candidates before computing recursive parent relations, allowing the RA plan to restrict getParent*() and the subsequent private-host antijoin to the filtered candidate set.

Author: mbaluda

cpp/ql/src/Security/CWE/CWE-319/UseOfHttp.ql

@@ -38,19 +38,22 @@ predicate privateHostNameFlowsToExpr(Expr e) {
 /**
  * A string containing an HTTP URL not in a private domain.
  */
-class HttpStringLiteral extends StringLiteral {
-  HttpStringLiteral() {
+private class HttpStringLiteralCandidate extends StringLiteral {
+  HttpStringLiteralCandidate() {
     exists(string s | this.getValue() = s |
       s = "http"
       or
       exists(string tail |
         tail = s.regexpCapture("http://(.*)", 1) and not tail instanceof PrivateHostName
       )
-    ) and
-    not privateHostNameFlowsToExpr(this.getParent*())
+    )
   }
 }
 
+class HttpStringLiteral extends HttpStringLiteralCandidate {
+  HttpStringLiteral() { not privateHostNameFlowsToExpr(this.getParent*()) }
+}
+
 /**
  * Taint tracking configuration for HTTP connections.
  */