[DIFF-INFORMED] JS: ShellCommandInjectionFromEnvironment

d10c · d10c · commit 2a5eae2b362d · 2025-07-17T10:56:10.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql#L26
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll
@@ -31,9 +31,10 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(DataFlow::Node node |
-      isSinkWithHighlight(sink, node) and
-      result = node.getLocation()
+    exists(DataFlow::Node highlight | result = highlight.getLocation() |
+      if isSinkWithHighlight(sink, _)
+      then isSinkWithHighlight(sink, highlight)
+      else highlight = sink
     )
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -31,9 +31,10 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig`
`31`	`31`	`predicate observeDiffInformedIncrementalMode() { any() }`
`32`	`32`
`33`	`33`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
`34`		`- exists(DataFlow::Node node \|`
`35`		`- isSinkWithHighlight(sink, node) and`
`36`		`- result = node.getLocation()`
	`34`	`+ exists(DataFlow::Node highlight \| result = highlight.getLocation() \|`
	`35`	`+ if isSinkWithHighlight(sink, _)`
	`36`	`+ then isSinkWithHighlight(sink, highlight)`
	`37`	`+ else highlight = sink`
`37`	`38`	`)`
`38`	`39`	`}`
`39`	`40`	`}`