JS: Prevent join order regression

2026-04-28 02:05:14 +02:00 · 2023-05-09 17:01:41 +02:00
parent 3d5c8153ca
commit c7d72e0d34
1 changed files with 1 additions and 0 deletions
--- a/javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionCustomizations.qll
+++ b/javascript/ql/lib/semmle/javascript/security/dataflow/SecondOrderCommandInjectionCustomizations.qll
@@ -117,6 +117,7 @@ module SecondOrderCommandInjection {
    int cmdIndex;
    int argIndex;

+    pragma[assume_small_delta]
    IndirectCmdFunc() {
      exists(CommandExecutingCall call |
        this.getParameter(cmdIndex).flowsTo(call.getCommandArg()) and