JS/IndirectCommandInjectionQuery

d10c · d10c · commit 185f845eef78 · 2025-10-14T13:14:50.000+02:00
javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/IndirectCommandInjectionQuery.qll
@@ -30,8 +30,9 @@ module IndirectCommandInjectionConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(DataFlow::Node node |
-      isSinkWithHighlight(sink, node) and
+    exists(DataFlow::Node node | isSinkWithHighlight(sink, node) |
+      result = sink.getLocation()
+      or
       result = node.getLocation()
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -30,8 +30,9 @@ module IndirectCommandInjectionConfig implements DataFlow::ConfigSig {`
`30`	`30`	`predicate observeDiffInformedIncrementalMode() { any() }`
`31`	`31`
`32`	`32`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
`33`		`- exists(DataFlow::Node node \|`
`34`		`- isSinkWithHighlight(sink, node) and`
	`33`	`+ exists(DataFlow::Node node \| isSinkWithHighlight(sink, node) \|`
	`34`	`+ result = sink.getLocation()`
	`35`	`+ or`
`35`	`36`	`result = node.getLocation()`
`36`	`37`	`)`
`37`	`38`	`}`