Only flag up the deepest properties

github · May 30, 2023 · 86ead5e · 86ead5e
1 parent eb1c7a3
commit 86ead5e
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/queries/default-setup-event-context.ql b/queries/default-setup-event-context.ql
@@ -25,7 +25,9 @@ class EventContextAccessConfiguration extends DataFlow::Configuration {
   }
 
   override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel lbl) {
-    sink instanceof DataFlow::PropRead and lbl instanceof ParsedLabel
+    sink instanceof DataFlow::PropRead and
+    lbl instanceof ParsedLabel and
+    not exists(DataFlow::PropRead n | sink = n.getBase())
   }
 
   override predicate isAdditionalFlowStep(