Update javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql

monkey-junkie · erik-krogh · web-flow · commit 758e85dd3e4d · 2020-05-05T15:34:57.000+03:00
Co-authored-by: Erik Krogh Kristensen &lt;erik-krogh@github.com&gt;
diff --git a/javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql b/javascript/ql/src/experimental/Security/CWE-94/ServerSideTemplateInjection.ql
@@ -29,7 +29,6 @@ class SSTIPugSink extends ServerSideTemplateInjectionSink {
       renderImport = moduleImport(["pug", "jade"]) and
       (
         compile = renderImport.getAMemberCall("compile") and
-        exists(compile.getACall())
         or
         compile = renderImport.getAMemberCall("render")
       ) and

Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,6 @@ class SSTIPugSink extends ServerSideTemplateInjectionSink {`
`29`	`29`	`renderImport = moduleImport(["pug", "jade"]) and`
`30`	`30`	`(`
`31`	`31`	`compile = renderImport.getAMemberCall("compile") and`
`32`		`- exists(compile.getACall())`
`33`	`32`	`or`
`34`	`33`	`compile = renderImport.getAMemberCall("render")`
`35`	`34`	`) and`