JS: Fix handling of createRequire

asgerf · asgerf · commit c103939c2dac · 2021-03-29T12:47:23.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/NodeJS.qll b/javascript/ql/src/semmle/javascript/NodeJS.qll
@@ -228,6 +228,13 @@ private predicate isCreateRequire(DataFlow::Node nd) {
     nd = prop.getValuePattern().flow()
   )
   or
+  exists(ImportDeclaration decl, NamedImportSpecifier spec |
+    decl.getImportedPath().getValue() = "module" and
+    spec = decl.getASpecifier() and
+    spec.getImportedName() = "createRequire" and
+    nd = spec.flow()
+  )
+  or
   isCreateRequire(nd.getAPredecessor())
 }
 

Original file line number	Diff line number	Diff line change
`@@ -228,6 +228,13 @@ private predicate isCreateRequire(DataFlow::Node nd) {`
`228`	`228`	`nd = prop.getValuePattern().flow()`
`229`	`229`	`)`
`230`	`230`	`or`
	`231`	`+ exists(ImportDeclaration decl, NamedImportSpecifier spec \|`
	`232`	`+ decl.getImportedPath().getValue() = "module" and`
	`233`	`+ spec = decl.getASpecifier() and`
	`234`	`+ spec.getImportedName() = "createRequire" and`
	`235`	`+ nd = spec.flow()`
	`236`	`+ )`
	`237`	`+ or`
`231`	`238`	`isCreateRequire(nd.getAPredecessor())`
`232`	`239`	`}`
`233`	`240`