diff --git a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll index cc300c749ad..77c4c7c4521 100644 --- a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll +++ b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll @@ -453,6 +453,8 @@ private module SyntacticUtilities { * * Supports: * - variable reads (including `this` and `super`) + * - imports + * - await * - property reads * - invocations * @@ -488,6 +490,13 @@ private module SyntacticUtilities { ) } + /** + * Gets the imported path. + * + * XXX To avoid teaching the ML model about npm packages, only relative paths are supported + * + * Unknown paths result in `?`. + */ string getSimpleImportPath(Import i) { if exists(i.getImportedPath().getValue()) then