Use config.getCorsConfiguration().getOrigin())

Co-authored-by: Erik Krogh Kristensen <[email protected]>

Author: maikypedia

javascript/ql/src/experimental/Security/CWE-942/CorsPermissiveConfigurationCustomizations.qll

@@ -68,6 +68,8 @@ module CorsPermissiveConfiguration {
    * The value of cors origin when initializing the application.
    */
   class ExpressCors extends Sink, DataFlow::ValueNode {
-    ExpressCors() { exists(Express::CorsConfiguration config | this = config.getOrigin()) }
+    ExpressCors() {
+      exists(Express::CorsConfiguration config | this = config.getCorsConfiguration().getOrigin())
+    }
   }
 }