JS/ShellCommandInjectionFromEnvironmentQuery

javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql

Author: d10c

javascript/ql/lib/semmle/javascript/security/dataflow/ShellCommandInjectionFromEnvironmentQuery.qll

@@ -31,6 +31,8 @@ module ShellCommandInjectionFromEnvironmentConfig implements DataFlow::ConfigSig
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     exists(DataFlow::Node node |
       isSinkWithHighlight(sink, node) and
       result = node.getLocation()