C++: exclude printf implementation internals from uncontrolled format string sinks

[MarkLee131]

Fix #21492

• The fix only narrows the sink definition; no new false negatives for direct calls like printf(tainted_str)
• Only sinks inside printf-like function bodies are excluded; outermost call sites (e.g., smsg(tainted_fmt, ...)) remain
  flagged

[Copilot]

Pull request overview

This PR updates the C++ cpp/tainted-format-string query to reduce false positives that occur inside implementations of printf-like functions (and their wrappers), by excluding certain internal format-string sinks while preserving reporting at the outermost call sites.

Changes:

• Introduces a helper predicate to identify printf-like functions and wrapper functions forwarding format strings.
• Narrows the sink definition to exclude sinks occurring inside those identified functions.

---

You can also share your feedback on Copilot code review. Take the survey.

[geoffw0]

@MarkLee131 thank you for your contribution! I'm going to start some CI and probably try this out locally.

[MarkLee131]

Hi @geoffw0, I have resolved the issues mentioned above. Could you pelase review this PR again? thanks~

[geoffw0]

Thanks for resolving the issues. We do need a change note for this - I've proposed one in MarkLee131#1 .

[MarkLee131]

I have merged it :)