diff --git a/javascript/ql/src/semmle/javascript/NodeJS.qll b/javascript/ql/src/semmle/javascript/NodeJS.qll index df21cc55822..f193959adb8 100644 --- a/javascript/ql/src/semmle/javascript/NodeJS.qll +++ b/javascript/ql/src/semmle/javascript/NodeJS.qll @@ -163,7 +163,16 @@ private predicate isRequire(DataFlow::Node nd) { or isRequire(nd.getAPredecessor()) or - nd = DataFlow::moduleMember("module", "createRequire").getACall() + // `import { createRequire } from 'module';` support. + // specialized to ES2015 modules to avoid recursion in the `DataFlow::moduleImport()` predicate. + exists(ImportDeclaration imp | imp.getImportedPath().getValue() = "module" | + nd = + imp + .getImportedModuleNode() + .(DataFlow::SourceNode) + .getAPropertyRead("createRequire") + .getACall() + ) } /**