JS: Drive-by fix to newly gained FPs

asgerf · asgerf · commit efb582b6612b · 2023-04-17T08:20:18.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/PrototypePollutingAssignmentQuery.qll
@@ -53,6 +53,8 @@ class Configuration extends TaintTracking::Configuration {
         not replace.getRawReplacement().getStringValue() = ""
       )
     )
+    or
+    node = NodeJSLib::Path::moduleMember(["join", "normalize", "relative", "resolve"]).getACall()
   }
 
   override predicate isAdditionalFlowStep(

Original file line number	Diff line number	Diff line change
`@@ -53,6 +53,8 @@ class Configuration extends TaintTracking::Configuration {`
`53`	`53`	`not replace.getRawReplacement().getStringValue() = ""`
`54`	`54`	`)`
`55`	`55`	`)`
	`56`	`+ or`
	`57`	`+ node = NodeJSLib::Path::moduleMember(["join", "normalize", "relative", "resolve"]).getACall()`
`56`	`58`	`}`
`57`	`59`
`58`	`60`	`override predicate isAdditionalFlowStep(`