From e95b3590f0ee51ca04803d75b6c51380381b7004 Mon Sep 17 00:00:00 2001
From: Asger F <asgerf@github.com>
Date: Tue, 25 Nov 2025 15:54:45 +0100
Subject: [PATCH] JS: Fix project layout detection for Next.js apps

Some parts of the code did not handle case where 'pages' was located at 'app/pages'.
---
 .../lib/semmle/javascript/frameworks/Next.qll | 24 ++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Next.qll b/javascript/ql/lib/semmle/javascript/frameworks/Next.qll
index 551d325f26a..a65fcdce44d 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/Next.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/Next.qll
@@ -13,12 +13,31 @@ module NextJS {
    */
   PackageJson getANextPackage() { result.getDependencies().getADependency("next", _) }
 
+  bindingset[base, name]
+  pragma[inline_late]
+  private Folder getOptionalFolder(Folder base, string name) {
+    result = base.getFolder(name)
+    or
+    not exists(base.getFolder(name)) and
+    result = base
+  }
+
+  private Folder packageRoot() { result = getANextPackage().getFile().getParentContainer() }
+
+  private Folder srcRoot() { result = getOptionalFolder(packageRoot(), "src") }
+
+  private Folder appRoot() { result = srcRoot().getFolder("app") }
+
+  private Folder pagesRoot() { result = [srcRoot(), appRoot()].getFolder("pages") }
+
+  private Folder apiRoot() { result = [pagesRoot(), appRoot()].getFolder("api") }
+
   /**
    * Gets a "pages" folder in a `Next.js` application.
    * JavaScript files inside these folders are mapped to routes.
    */
   Folder getAPagesFolder() {
-    result = getANextPackage().getFile().getParentContainer().getFolder("pages")
+    result = pagesRoot()
     or
     result = getAPagesFolder().getAFolder()
   }
@@ -217,8 +236,7 @@ module NextJS {
    * the App Router (`app/api/`) Next.js 13+ structures.
    */
   Folder apiFolder() {
-    result =
-      getANextPackage().getFile().getParentContainer().getFolder(["pages", "app"]).getFolder("api") or
+    result = apiRoot() or
     result = apiFolder().getAFolder()
   }