JS: Change Extend steps to PreCallGraphStep

asgerf · asgerf · commit 74dbc7153530 · 2023-04-17T08:20:18.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/Extend.qll b/javascript/ql/lib/semmle/javascript/Extend.qll
@@ -157,10 +157,12 @@ private class FunctionalExtendCallShallow extends ExtendCall {
 }
 
 /**
- * A taint propagating data flow edge from the objects flowing into an extend call to its return value
+ * A value-preserving data flow edge from the objects flowing into an extend call to its return value
  * and to the source of the destination object.
+ *
+ * Since all object properties are preserved, we model this as a value-preserving step.
  */
-private class ExtendCallTaintStep extends TaintTracking::SharedTaintStep {
+private class ExtendCallStep extends PreCallGraphStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(ExtendCall extend |
       pred = extend.getASourceOperand() and succ = extend.getDestinationOperand().getALocalSource()
