use PartialInvokeNode

erik-krogh · erik-krogh · commit 5fd4c7a42279 · 2020-09-20T22:06:48.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -111,11 +111,8 @@ module Express {
     exists(HTTP::RouteHandlerCandidateContainer container | pred = container.getRouteHandler(succ))
     or
     // (function (req, res) {}).bind(this);
-    exists(DataFlow::MethodCallNode call |
-      call.getMethodName() = "bind" and call.getNumArgument() = 1
-    |
-      succ = call and
-      pred = call.getReceiver().getALocalSource()
+    exists(DataFlow::PartialInvokeNode call |
+      succ = call.getBoundFunction(pred, 0)
     )
   }
 

Original file line number	Diff line number	Diff line change
`@@ -111,11 +111,8 @@ module Express {`
`111`	`111`	`exists(HTTP::RouteHandlerCandidateContainer container \| pred = container.getRouteHandler(succ))`
`112`	`112`	`or`
`113`	`113`	`// (function (req, res) {}).bind(this);`
`114`		`- exists(DataFlow::MethodCallNode call \|`
`115`		`- call.getMethodName() = "bind" and call.getNumArgument() = 1`
`116`		`- \|`
`117`		`- succ = call and`
`118`		`- pred = call.getReceiver().getALocalSource()`
	`114`	`+ exists(DataFlow::PartialInvokeNode call \|`
	`115`	`+ succ = call.getBoundFunction(pred, 0)`
`119`	`116`	`)`
`120`	`117`	`}`
`121`	`118`