CAP: update tostring use to better technique

knewbury01 · knewbury01 · commit bec5f8eba81d · 2024-04-12T16:25:52.000-04:00
diff --git a/javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/RemoteFlowSources.qll b/javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/RemoteFlowSources.qll
@@ -41,7 +41,7 @@ class ServiceinCDSHandlerParameter extends ParameterNode, RemoteFlowSource {
   ServiceinCDSHandlerParameter() {
     exists(MethodCallNode m, CdlEntity entity, string entityName |
       entity.getName().regexpReplaceAll(".*\\.", "") = entityName and
-      m.getArgument(1).toString().regexpReplaceAll("'", "") = entityName and
+      m.getArgument(1).asExpr().getStringValue().regexpReplaceAll("'", "") = entityName and
       this = m.getArgument(m.getNumArgument() - 1).(FunctionNode).getParameter(0) and
       m.getMethodName() in ["on", "before", "after"]
     )

Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ class ServiceinCDSHandlerParameter extends ParameterNode, RemoteFlowSource {`
`41`	`41`	`ServiceinCDSHandlerParameter() {`
`42`	`42`	`exists(MethodCallNode m, CdlEntity entity, string entityName \|`
`43`	`43`	`entity.getName().regexpReplaceAll(".*\\.", "") = entityName and`
`44`		`- m.getArgument(1).toString().regexpReplaceAll("'", "") = entityName and`
	`44`	`+ m.getArgument(1).asExpr().getStringValue().regexpReplaceAll("'", "") = entityName and`
`45`	`45`	`this = m.getArgument(m.getNumArgument() - 1).(FunctionNode).getParameter(0) and`
`46`	`46`	`m.getMethodName() in ["on", "before", "after"]`
`47`	`47`	`)`