We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 67cef92 commit ecf7ed3Copy full SHA for ecf7ed3
javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
@@ -714,10 +714,13 @@ module TaintTracking {
714
/**
715
* Gets a local source of any part of the input to the given stringification `call`.
716
*/
717
+ pragma[nomagic]
718
private DataFlow::Node getAJsonLocalInput(JsonStringifyCall call) {
719
result = call.getInput()
720
or
- exists(DataFlow::SourceNode source | source = getAJsonLocalInput(call).getALocalSource() |
721
+ exists(DataFlow::SourceNode source |
722
+ source = pragma[only_bind_out](getAJsonLocalInput(call)).getALocalSource()
723
+ |
724
result = source.getAPropertyWrite().getRhs()
725
726
result = source.(DataFlow::ObjectLiteralNode).getASpreadProperty()
0 commit comments