use RegExpCreationNode

erik-krogh · erik-krogh · commit 3855268201e0 · 2020-02-17T13:02:47.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll b/javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll
@@ -103,7 +103,7 @@ module TaintedPath {
           if
             exists(DataFlow::Node splitBy | splitBy = mcn.getArgument(0) |
               splitBy.mayHaveStringValue("/") or
-              any(DataFlow::RegExpLiteralNode reg | reg.getRoot().getAMatchedString() = "/")
+              any(DataFlow::RegExpCreationNode reg | reg.getRoot().getAMatchedString() = "/")
                   .flowsTo(splitBy)
             )
           then

Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,7 @@ module TaintedPath {`
`103`	`103`	`if`
`104`	`104`	`exists(DataFlow::Node splitBy \| splitBy = mcn.getArgument(0) \|`
`105`	`105`	`splitBy.mayHaveStringValue("/") or`
`106`		`- any(DataFlow::RegExpLiteralNode reg \| reg.getRoot().getAMatchedString() = "/")`
	`106`	`+ any(DataFlow::RegExpCreationNode reg \| reg.getRoot().getAMatchedString() = "/")`
`107`	`107`	`.flowsTo(splitBy)`
`108`	`108`	`)`
`109`	`109`	`then`