diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll index 74bcc428393..8b5aa371ee5 100644 --- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll +++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll @@ -1573,4 +1573,6 @@ module DataFlow { import Configuration import TrackedNodes import TypeTracking + + predicate localTaintStep = TaintTracking::localTaintStep/2; } diff --git a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll index c4106ffa17f..f7fed0263f9 100644 --- a/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll +++ b/javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll @@ -885,4 +885,12 @@ module TaintTracking { override predicate appliesTo(Configuration cfg) { any() } } + + /** + * Holds if taint propagates from `pred` to `succ` in one local (intra-procedural) step. + */ + predicate localTaintStep(DataFlow::Node pred, DataFlow::Node succ) { + DataFlow::localFlowStep(pred, succ) or + any(AdditionalTaintStep s).step(pred, succ) + } }