Express Argument has to be Cors

github · Dec 7, 2023 · 87cac2a · 87cac2a
1 parent 83cbbd7
commit 87cac2a
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/Express.qll b/javascript/ql/lib/semmle/javascript/frameworks/Express.qll
@@ -1077,7 +1077,13 @@ module Express {
    * An express route setup configured with the `cors` package.
    */
   class CorsConfiguration extends DataFlow::MethodCallNode {
-    CorsConfiguration() { exists(Express::RouteSetup setup | this = setup | setup.isUseCall()) }
+    CorsConfiguration() {
+      exists(Express::RouteSetup setup | this = setup |
+        setup.isUseCall() and setup.getArgument(0) instanceof Cors::Cors
+        or
+        not setup.isUseCall() and setup.getAnArgument() instanceof Cors::Cors
+      )
+    }
 
     /** Gets the cors argument */
     Cors::Cors getArgument() { result = this.getArgument(0) }