Only flag up the deepest properties

henrymercer · henrymercer · commit 86ead5e0197d · 2023-05-30T19:50:56.000+01:00
diff --git a/queries/default-setup-event-context.ql b/queries/default-setup-event-context.ql
@@ -25,7 +25,9 @@ class EventContextAccessConfiguration extends DataFlow::Configuration {
   }
 
   override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel lbl) {
-    sink instanceof DataFlow::PropRead and lbl instanceof ParsedLabel
+    sink instanceof DataFlow::PropRead and
+    lbl instanceof ParsedLabel and
+    not exists(DataFlow::PropRead n | sink = n.getBase())
   }
 
   override predicate isAdditionalFlowStep(

Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,9 @@ class EventContextAccessConfiguration extends DataFlow::Configuration {`
`25`	`25`	`}`
`26`	`26`
`27`	`27`	`override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel lbl) {`
`28`		`- sink instanceof DataFlow::PropRead and lbl instanceof ParsedLabel`
	`28`	`+ sink instanceof DataFlow::PropRead and`
	`29`	`+ lbl instanceof ParsedLabel and`
	`30`	`+ not exists(DataFlow::PropRead n \| sink = n.getBase())`
`29`	`31`	`}`
`30`	`32`
`31`	`33`	`override predicate isAdditionalFlowStep(`