Merge pull request #6262 from erik-krogh/slash

Approved by asgerf

javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

@@ -798,6 +798,12 @@ module TaintedPath {
       srclabel instanceof Label::SplitPath and
       dstlabel.(Label::PosixPath).canContainDotDotSlash()
     )
+    or
+    exists(API::CallNode call | call = API::moduleImport("slash").getACall() |
+      src = call.getArgument(0) and
+      dst = call and
+      srclabel = dstlabel
+    )
   }
 
   /**