JavaScript: Prevent joining on configuration in onPath.

Max Schaefer · Max Schaefer · commit de02bb4a0d12 · 2020-01-02T09:49:09.000Z
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
@@ -938,8 +938,8 @@ private predicate onPath(DataFlow::Node nd, DataFlow::Configuration cfg, PathSum
   or
   exists(DataFlow::Node mid, PathSummary stepSummary |
     reachableFromSource(nd, cfg, summary) and
-    flowStep(nd, cfg, mid, stepSummary) and
-    onPath(mid, cfg, summary.append(stepSummary))
+    flowStep(nd, id(cfg), mid, stepSummary) and
+    onPath(mid, id(cfg), summary.append(stepSummary))
   )
 }
 

Original file line number	Diff line number	Diff line change
`@@ -938,8 +938,8 @@ private predicate onPath(DataFlow::Node nd, DataFlow::Configuration cfg, PathSum`
`938`	`938`	`or`
`939`	`939`	`exists(DataFlow::Node mid, PathSummary stepSummary \|`
`940`	`940`	`reachableFromSource(nd, cfg, summary) and`
`941`		`- flowStep(nd, cfg, mid, stepSummary) and`
`942`		`- onPath(mid, cfg, summary.append(stepSummary))`
	`941`	`+ flowStep(nd, id(cfg), mid, stepSummary) and`
	`942`	`+ onPath(mid, id(cfg), summary.append(stepSummary))`
`943`	`943`	`)`
`944`	`944`	`}`
`945`	`945`