Rewrite a taint step to make more idiomatic use of the data-flow library.

Max Schaefer · Max Schaefer · commit cc24a8879fd7 · 2020-05-20T10:05:43.000+01:00
diff --git a/ql/src/semmle/go/frameworks/NoSQL.qll b/ql/src/semmle/go/frameworks/NoSQL.qll
@@ -112,7 +112,7 @@ module NoSQL {
   predicate isAdditionalMongoTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
     // Taint an entry if the `Value` is tainted
     exists(Write w, DataFlow::Node base, Field f | w.writesField(base, f, pred) |
-      base = succ.getASuccessor*() and
+      base = succ.(DataFlow::PostUpdateNode).getPreUpdateNode() and
       base.getType().hasQualifiedName("go.mongodb.org/mongo-driver/bson/primitive", "E") and
       f.getName() = "Value"
     )

Original file line number	Diff line number	Diff line change
`@@ -112,7 +112,7 @@ module NoSQL {`
`112`	`112`	`predicate isAdditionalMongoTaintStep(DataFlow::Node pred, DataFlow::Node succ) {`
`113`	`113`	// Taint an entry if the `Value` is tainted
`114`	`114`	`exists(Write w, DataFlow::Node base, Field f \| w.writesField(base, f, pred) \|`
`115`		`- base = succ.getASuccessor*() and`
	`115`	`+ base = succ.(DataFlow::PostUpdateNode).getPreUpdateNode() and`
`116`	`116`	`base.getType().hasQualifiedName("go.mongodb.org/mongo-driver/bson/primitive", "E") and`
`117`	`117`	`f.getName() = "Value"`
`118`	`118`	`)`