C++: Rewrite cpp/cgi-xss to not use default taint tracking

[jketema]

I'm hard pressed for projects that have actually have relevant sources. MRVA only shows 5, one of which have relevant flow: apache/trafficserver, apple/cups, OpenPrinting/cups, git/git, and git-for-windows/git. DCA doesn't show anything special.

[MathiasVP]

LGTM!

[jketema]

Does this need a change note?

[MathiasVP]

Hmm... Yeah, maybe we should write a change note saying that we've refactored the query to a straightforward TaintTracking query?

I'd like to claim that the query is now easier to customize with additional sources, sinks and taint steps, but since it's still not as easy to customize as the standard dataflow query is in other languages I'm hesitant to make that claim.

[jketema]

Hmm... Yeah, maybe we should write a change note saying that we've refactored the query to a straightforward TaintTracking query?

I'd like to claim that the query is now easier to customize with additional sources, sinks and taint steps, but since it's still not as easy to customize as the standard dataflow query is in other languages I'm hesitant to make that claim.

So neither #11435 nor #13985 added a change note.

[jketema]

Discussed internally: since the previous rewrites also didn't come with a change note, we'll not add one here either. We'll add a change note once all rewrites are done.