CPP: Flow Into Barrier Guards

I'm looking for general assistance on how to properly use codeql with barrier guards when the guard condition may not be computed in the guard itself, but instead also data traces into a guard:

Consider these two cases, where `use(x)` is a sink, but if it is guarded by `MyGuard(x)` it is considered safe. The first case is the easy case where BarrierGuard (or SanitizerGuard) can be used fairly easily, and the latter case seems to require yet another dataflow:

```
//Easy case
if(MyGuard(x))
use(x);

//harder case
res = MyGuard(x)
if(res)
use(x);
```

For the latter/harder case, what is the CodeQL paradigm to associate the guard to `x` such that I know use(x) is safe? Seems to me, out of the box, there is no flow from `x` to res. I could add an additional step, in a dataflow/taint analysis, but that would still not let me define barrier guard check conditions to associate that value with the originating variable. Perhaps there is a way to pass around misc. metadata too that will feed into a BarrierGuard check in these cases?

Start with the CodeQL BarrierGuard and SanitizerGuard concepts named in the issue, then compare them with the two guard examples in the report. Determine whether a computed guard result can be associated with the original value through dataflow or metadata, and document the supported pattern or limitation as the outcome.

由索引模型根據 Issue 內容生成。