[DIFF-INFORMED] JS: EnvValueAndKeyInjection

d10c · d10c · commit 81bbcda44df5 · 2025-07-17T10:56:11.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql#L68
diff --git a/javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql b/javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql
@@ -33,6 +33,10 @@ module EnvValueAndKeyInjectionConfig implements DataFlow::ConfigSig {
       )
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // can't override location accurately because of secondary use in select.
+  }
 }
 
 module EnvValueAndKeyInjectionFlow = TaintTracking::Global<EnvValueAndKeyInjectionConfig>;

Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,10 @@ module EnvValueAndKeyInjectionConfig implements DataFlow::ConfigSig {`
`33`	`33`	`)`
`34`	`34`	`)`
`35`	`35`	`}`
	`36`	`+`
	`37`	`+ predicate observeDiffInformedIncrementalMode() {`
	`38`	`+ none() // can't override location accurately because of secondary use in select.`
	`39`	`+ }`
`36`	`40`	`}`
`37`	`41`
`38`	`42`	`module EnvValueAndKeyInjectionFlow = TaintTracking::Global<EnvValueAndKeyInjectionConfig>;`