@@ -186,8 +186,7 @@ module Spife {
186186 string kind ;
187187
188188 ContextInputAccess ( ) {
189- request .ref ( ) .flowsTo ( super .getReceiver ( ) ) and
190- super .getMethodName ( ) = "get" and
189+ this = request .ref ( ) .getAMethodCall ( "get" )
191190 kind = "path"
192191 }
193192
@@ -261,7 +260,7 @@ module Spife {
261260
262261 override predicate definesHeaderValue ( string headerName , DataFlow:: Node headerValue ) {
263262 // reply.header(RESPONSE, 'Cache-Control', 'no-cache')
264- headerName = this .getNameNode ( ) .getStringValue ( ) and
263+ this .getNameNode ( ) .mayHaveStringValue ( headerName ) and
265264 headerValue = this .getArgument ( 2 )
266265 }
267266
@@ -279,10 +278,10 @@ module Spife {
279278 MultipleHeaderDefinitions ( ) {
280279 // reply.header(RESPONSE, {'Cache-Control': 'no-cache'})
281280 // reply(RESPONSE, {'Cache-Control': 'no-cache'})
282- reply . ref ( ) . ( DataFlow:: CallNode ) . getCalleeName ( ) = [ "header" , " reply" ] and
283- reply . ref ( ) . ( DataFlow :: CallNode ) . getAnArgument ( ) .getALocalSource ( ) instanceof
284- DataFlow :: ObjectLiteralNode and
285- this = reply
281+ exists ( DataFlow:: CallNode call | call = [ reply . ref ( ) , reply . ref ( ) . getAMethodCall ( "header" ) ] |
282+ call . getAnArgument ( ) .getALocalSource ( ) instanceof DataFlow :: ObjectLiteralNode and
283+ this = call
284+ )
286285 }
287286
288287 /**
@@ -321,10 +320,10 @@ module Spife {
321320 /**
322321 * An HTTP cookie defined in a Spife HTTP response.
323322 */
324- private class CookieDefinition extends Http:: CookieDefinition , DataFlow:: MethodCallNode instanceof ReplySource {
323+ private class CookieDefinition extends Http:: CookieDefinition , DataFlow:: MethodCallNode {
325324 CookieDefinition ( ) {
326325 // reply.cookie(RESPONSE, 'TEST', 'FOO', {"maxAge": 1000, "httpOnly": true, "secure": true})
327- this . ref ( ) . ( DataFlow :: MethodCallNode ) . getMethodName ( ) = "cookie"
326+ this = any ( ReplySource r ) . ref ( ) . getAMethodCall ( "cookie" )
328327 }
329328
330329 override DataFlow:: Node getNameArgument ( ) { result = this .getArgument ( 1 ) }
0 commit comments