JS: fix use of dataOrTaint()

asger-semmle · asger-semmle · commit 0823f6c935d6 · 2019-05-23T10:16:41.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll b/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
@@ -162,7 +162,7 @@ module TaintedPath {
         guard.sanitizes(_, e, any(Label::PosixPath label)) and
         src.(DataFlow::SourceNode).flowsToExpr(e) and
         dst = src and
-        srclabel = DataFlow::FlowLabel::dataOrTaint() and
+        srclabel instanceof DataFlow::StandardFlowLabel and
         dstlabel instanceof Label::PosixPath
       )
       or

Original file line number	Diff line number	Diff line change
`@@ -162,7 +162,7 @@ module TaintedPath {`
`162`	`162`	`guard.sanitizes(_, e, any(Label::PosixPath label)) and`
`163`	`163`	`src.(DataFlow::SourceNode).flowsToExpr(e) and`
`164`	`164`	`dst = src and`
`165`		`- srclabel = DataFlow::FlowLabel::dataOrTaint() and`
	`165`	`+ srclabel instanceof DataFlow::StandardFlowLabel and`
`166`	`166`	`dstlabel instanceof Label::PosixPath`
`167`	`167`	`)`
`168`	`168`	`or`