JS: Put in same stage as RemoteFlowSource

asgerf · asgerf · commit 561b9d09b3a8 · 2021-03-17T13:29:16.000Z
diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
@@ -312,6 +312,10 @@ module TaintTracking {
    */
   cached
   private module Cached {
+    cached predicate forceStage() {
+      Stages::Taint::ref()
+    }
+
     /**
      * Holds if `pred` &rarr; `succ` should be considered a taint-propagating
      * data flow edge, which doesn't fit into a more specific category.
diff --git a/javascript/ql/src/semmle/javascript/internal/CachedStages.qll b/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
@@ -243,7 +243,7 @@ module Stages {
     predicate backref() {
       1 = 1
       or
-      any(TaintTracking::AdditionalTaintStep step).step(_, _)
+      TaintTracking::heapStep(_, _)
       or
       exists(RemoteFlowSource r)
     }

Original file line number	Diff line number	Diff line change
`@@ -243,7 +243,7 @@ module Stages {`
`243`	`243`	`predicate backref() {`
`244`	`244`	`1 = 1`
`245`	`245`	`or`
`246`		`- any(TaintTracking::AdditionalTaintStep step).step(_, _)`
	`246`	`+ TaintTracking::heapStep(_, _)`
`247`	`247`	`or`
`248`	`248`	`exists(RemoteFlowSource r)`
`249`	`249`	`}`