Merge pull request #4860 from erik-krogh/functionExports

codeql-ci · web-flow · commit e2bba97794b0 · 2020-12-22T01:05:37.000-08:00
Approved by esbena
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
@@ -53,7 +53,7 @@ module UnsafeShellCommandConstruction {
     ExternalInputSource() {
       this =
         Exports::getAValueExportedBy(Exports::getTopmostPackageJSON())
-            .(DataFlow::FunctionNode)
+            .getAFunctionValue()
             .getAParameter() and
       not this.getName() = ["cmd", "command"] // looks to be on purpose.
     }

Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@ module UnsafeShellCommandConstruction {`
`53`	`53`	`ExternalInputSource() {`
`54`	`54`	`this =`
`55`	`55`	`Exports::getAValueExportedBy(Exports::getTopmostPackageJSON())`
`56`		`- .(DataFlow::FunctionNode)`
	`56`	`+ .getAFunctionValue()`
`57`	`57`	`.getAParameter() and`
`58`	`58`	`not this.getName() = ["cmd", "command"] // looks to be on purpose.`
`59`	`59`	`}`