Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql

monkey-junkie · erik-krogh · web-flow · commit 560674b670c9 · 2020-05-05T15:36:11.000+03:00
Co-authored-by: Erik Krogh Kristensen &lt;erik-krogh@github.com&gt;
diff --git a/javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql b/javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql
@@ -41,7 +41,6 @@ class SSTIDotSink extends ServerSideTemplateInjectionSink {
   SSTIDotSink() {
     exists(CallNode compile |
       compile = moduleImport("dot").getAMemberCall("template") and
-      exists(compile.getACall()) and
       this = compile.getArgument(0)
     )
   }

Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,6 @@ class SSTIDotSink extends ServerSideTemplateInjectionSink {`
`41`	`41`	`SSTIDotSink() {`
`42`	`42`	`exists(CallNode compile \|`
`43`	`43`	`compile = moduleImport("dot").getAMemberCall("template") and`
`44`		`- exists(compile.getACall()) and`
`45`	`44`	`this = compile.getArgument(0)`
`46`	`45`	`)`
`47`	`46`	`}`