Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql

monkey-junkie · erik-krogh · web-flow · commit 122354a81a35 · 2020-05-06T12:54:50.000+03:00
Co-authored-by: Erik Krogh Kristensen &lt;erik-krogh@github.com&gt;
diff --git a/javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql b/javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql
@@ -28,7 +28,7 @@ class SSTIPugSink extends ServerSideTemplateInjectionSink {
     exists(CallNode compile, ModuleImportNode renderImport |
       renderImport = moduleImport(["pug", "jade"]) and
       (
-        compile = renderImport.getAMemberCall("compile") and
+        compile = renderImport.getAMemberCall("compile")
         or
         compile = renderImport.getAMemberCall("render")
       ) and

Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ class SSTIPugSink extends ServerSideTemplateInjectionSink {`
`28`	`28`	`exists(CallNode compile, ModuleImportNode renderImport \|`
`29`	`29`	`renderImport = moduleImport(["pug", "jade"]) and`
`30`	`30`	`(`
`31`		`- compile = renderImport.getAMemberCall("compile") and`
	`31`	`+ compile = renderImport.getAMemberCall("compile")`
`32`	`32`	`or`
`33`	`33`	`compile = renderImport.getAMemberCall("render")`
`34`	`34`	`) and`