diff --git a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll index 67adcdf5e4b..e7a2add3fae 100644 --- a/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll +++ b/javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointFeatures.qll @@ -247,11 +247,12 @@ private module AccessPaths { else accessPath = previousAccessPath + " " + paramName ) or - exists(string callbackName, string index | + exists(string callbackName, int index | node = - getNamedParameter(previousNode.getASuccessor("param " + index).getMember(callbackName), - paramName) and - index != "-1" and // ignore receiver + getNamedParameter(previousNode + .getASuccessor(API::Label::parameter(index)) + .getMember(callbackName), paramName) and + index != -1 and // ignore receiver if includeStructuralInfo = true then accessPath =