minor cleanup

session/session1.ql

@@ -10,12 +10,13 @@ import javascript
 import DataFlow::PathGraph
 
 // Flow to consider:
+//
 // var value = this.getParameter('value'); //: source 1
 // var ua = new GR('status');              //: source 2
 // ua.setValue('status',value);            //: taint step
 // ua.update();                            //: sink (if from source 2)
-// var value = this.getParameter('value'); //: source 1
 
+// var value = this.getParameter('value'); //: source 1
 class ParameterSource extends CallExpr {
   ParameterSource() {
     exists(Expr inst |
@@ -27,11 +28,12 @@ class ParameterSource extends CallExpr {
 
 // ua.setValue('status',value);            //: taint step
 predicate setValueTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-  exists(DotExpr temp, MethodCallExpr mce, VarAccess gr, VarAccess postgr|
+  exists(DotExpr temp, MethodCallExpr mce, VarAccess gr, VarAccess postgr |
     temp.getPropertyName() = "setValue" and
     mce.getReceiver() = temp.getBase() and
     gr = mce.getReceiver() and
     pred.asExpr() = mce.getArgument(1) and
+    //
     // Taint all accesses after setValue call.
     // Trying data flow, this would be:
     // succ = gr.flow().getASuccessor+() and
@@ -39,14 +41,6 @@ predicate setValueTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
     // Using control flow:
     gr.getASuccessor+() = postgr and
     succ.asExpr() = postgr
-    )
-
-}
-
-VarRef methodCalled(string name) {
-  exists(DotExpr temp |
-    temp.getPropertyName() = name and
-    result = temp.getBase()
   )
 }
 
@@ -82,4 +76,5 @@ class FromRequestToGrUpdate extends TaintTracking::Configuration {
 
 from FromRequestToGrUpdate dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
 where dataflow.hasFlowPath(source, sink)
-select sink, source, sink, "Data flow from $@ to $@.", source, source.toString(), sink, sink.toString()
+select sink, source, sink, "Data flow from $@ to $@.", source, source.toString(), sink,
+  sink.toString()