use regexp term instead of char class

Author: erik-krogh

javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

@@ -227,9 +227,9 @@ module TaintedPath {
           seq.getNumChild() = 2
         )
         or
-        exists(RegExpCharacterClass choice | literal.getRoot() = choice |
-          choice.getAMatchedString() = "/" or
-          choice.getAMatchedString() = "."
+        exists(RegExpTerm term | literal.getRoot() = term |
+          term.getAMatchedString() = "/" or
+          term.getAMatchedString() = "."
         )
       )
     }

javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js

@@ -179,4 +179,6 @@ var server = http.createServer(function(req, res) {
   res.write(fs.readFileSync(path.replace(/[..]/g, ''))); // OK
   res.write(fs.readFileSync(path.replace(/[./]/g, ''))); // OK
   res.write(fs.readFileSync(path.replace(/[foobar/foobar]/g, ''))); // OK
+  res.write(fs.readFileSync(path.replace(/\//g, ''))); // OK
+  res.write(fs.readFileSync(path.replace(/\./g, ''))); // OK
 });