JS: support "express-rate-limit" non-constructor calls

Esben Sparre Andreasen · Esben Sparre Andreasen · commit f7ab29aa2ba7 · 2018-08-06T15:15:44.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll b/javascript/ql/src/semmle/javascript/security/dataflow/MissingRateLimiting.qll
@@ -131,7 +131,7 @@ abstract class RateLimiter extends Express::RouteHandlerExpr {
  */
 class ExpressRateLimit extends RateLimiter {
   ExpressRateLimit() {
-    DataFlow::moduleImport("express-rate-limit").getAnInstantiation().flowsToExpr(this)
+    DataFlow::moduleImport("express-rate-limit").getAnInvocation().flowsToExpr(this)
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -131,7 +131,7 @@ abstract class RateLimiter extends Express::RouteHandlerExpr {`
`131`	`131`	`*/`
`132`	`132`	`class ExpressRateLimit extends RateLimiter {`
`133`	`133`	`ExpressRateLimit() {`
`134`		`- DataFlow::moduleImport("express-rate-limit").getAnInstantiation().flowsToExpr(this)`
	`134`	`+ DataFlow::moduleImport("express-rate-limit").getAnInvocation().flowsToExpr(this)`
`135`	`135`	`}`
`136`	`136`	`}`
`137`	`137`