diff --git a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll index 5975da946aa..92e2c2c18d7 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll @@ -493,10 +493,10 @@ module NodeJSLib { */ module FS { /** - * Gets a member `member` from module `fs` or its drop-in replacements `graceful-fs`, `fs-extra`, `original-fs`. + * A member `member` from module `fs`. */ DataFlow::SourceNode moduleMember(string member) { - exists(string moduleName | moduleName = ["fs-extra", "graceful-fs", "fs"] | + exists(string moduleName | moduleName = ["fs"] | result = DataFlow::moduleMember(moduleName, member) ) } diff --git a/javascript/ql/lib/semmle/javascript/frameworks/TorrentLibraries.qll b/javascript/ql/lib/semmle/javascript/frameworks/TorrentLibraries.qll index 29c100234bf..b70f1498454 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/TorrentLibraries.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/TorrentLibraries.qll @@ -36,25 +36,8 @@ module ParseTorrent { /** * An access to user-controlled torrent information. */ - class UserControlledTorrentInfo extends RemoteFlowSource instanceof DataFlow::PropRead { - UserControlledTorrentInfo() { - exists(API::Node read | - read = any(ParsedTorrent t).asApiNode().getAMember() and - this = read.asSource() - | - exists(string prop | - not ( - prop = "private" or - prop = "infoHash" or - prop = "length" - // "pieceLength" and "lastPieceLength" are not guaranteed to be numbers as of commit ae3ad15d - ) and - super.getPropertyName() = prop - ) - or - not exists(super.getPropertyName()) - ) - } + class UserControlledTorrentInfo extends RemoteFlowSource { + UserControlledTorrentInfo() { none() } override string getSourceType() { result = "torrent information" } } diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll index f39bf5b47da..2350bd3ddf0 100644 --- a/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll +++ b/javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll @@ -624,8 +624,6 @@ module TaintedPath { ( this = fileSystemAccess.getAPathArgument() and not exists(fileSystemAccess.getRootPathArgument()) - or - this = fileSystemAccess.getRootPathArgument() ) and not this = any(ResolvingPathCall call).getInput() }