JS: Fix bug in MkClassInstance use-nodes

This only worked when the RHS was a SourceNode, which is not generally the case
2026-04-29 10:45:15 +02:00 · 2024-04-18 10:06:11 +02:00
parent 5e7026c6c6
commit 3c885f3969
2 changed files with 3 additions and 1 deletions
--- a/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
@@ -1319,7 +1319,7 @@ module API {
        succ = MkDef(rhs)
        or
        exists(DataFlow::ClassNode cls |
-          cls.getAnInstanceReference() = rhs and
+          cls.getAnInstanceReference().flowsTo(rhs) and
          succ = MkClassInstance(cls)
        )
      )