diff --git a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll index b466d34b227..e60afa470ec 100644 --- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll +++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryQuery.qll @@ -68,7 +68,8 @@ private module PartialServerSideRequestForgeryConfig implements DataFlow::Config predicate observeDiffInformedIncrementalMode() { any() } Location getASelectedSinkLocation(DataFlow::Node sink) { - // Note: this query does not select the sink itself + result = sink.(Sink).getLocation() + or result = sink.(Sink).getRequest().getLocation() } }