Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll

Sim4n6 · yoff · web-flow · commit 16ef50401ba2 · 2023-02-09T14:59:28.000+01:00
Co-authored-by: yoff &lt;lerchedahl@gmail.com&gt;
diff --git a/python/ql/src/experimental/Security/UnsafeUnpackQuery.qll b/python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
@@ -103,7 +103,7 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
       // For a call to `file.extractall` without `members` argument, `file` is considered a sink.
       exists(MethodCallNode call, AllTarfileOpens atfo |
         call = atfo.getReturn().getMember("extractall").getACall() and
-        not exists(Node arg | arg = call.getArgByName("members")) and
+        not exists(call.getArgByName("members")) and
         sink = call.getObject()
       )
       or

Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,7 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {`
`103`	`103`	// For a call to `file.extractall` without `members` argument, `file` is considered a sink.
`104`	`104`	`exists(MethodCallNode call, AllTarfileOpens atfo \|`
`105`	`105`	`call = atfo.getReturn().getMember("extractall").getACall() and`
`106`		`- not exists(Node arg \| arg = call.getArgByName("members")) and`
	`106`	`+ not exists(call.getArgByName("members")) and`
`107`	`107`	`sink = call.getObject()`
`108`	`108`	`)`
`109`	`109`	`or`