JS: PropertyProjectionTest

asgerf · asgerf · commit 92d555166a66 · 2021-03-17T13:26:00.000Z
diff --git a/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll b/javascript/ql/src/semmle/javascript/frameworks/PropertyProjection.qll
@@ -134,14 +134,12 @@ private class SimplePropertyProjection extends PropertyProjection::Range {
 /**
  * A taint step for a property projection.
  */
-private class PropertyProjectionTaintStep extends TaintTracking::AdditionalTaintStep {
-  PropertyProjection projection;
-
-  PropertyProjectionTaintStep() { projection = this }
-
+private class PropertyProjectionTaintStep extends TaintTracking::SharedTaintStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     // reading from a tainted object yields a tainted result
-    this = succ and
-    pred = projection.getObject()
+    exists(PropertyProjection projection |
+      pred = projection.getObject() and
+      succ = projection
+    )
   }
 }
