Fix a regression in taintedclause

Author: jeongsoolee09

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CAPCqlInjectionQuery.qll

@@ -41,12 +41,13 @@ class CqlShortcutMethodCallWithStringConcat instanceof CqlShortcutMethodCall {
 }
 
 /**
- * A CQL parser call (cds.ql, cds.parse.cql, ...) parameterized with a string
+ * A CQL parser call (`cds.ql`, `cds.parse.cql`, ...) parameterized with a string
  * conatenation expression.
  */
 class CqlClauseParserCallWithStringConcat instanceof CqlClauseParserCall {
   CqlClauseParserCallWithStringConcat() {
-    exists(StringConcatenation::getAnOperand(super.getCdlString()))
+    not this.getCdlString().(StringOps::Concatenation).asExpr() instanceof TemplateLiteral and
+    exists(StringConcatenation::getAnOperand(this.getCdlString()))
   }
 
   Location getLocation() { result = super.getLocation() }

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDS.qll

@@ -942,11 +942,17 @@ class CqlUpsertMethodCall extends CqlShortcutMethodCall {
 abstract class CqlClauseParserCall extends DataFlow::CallNode {
   DataFlow::ExprNode cdlString;
 
+  /**
+   * Gets the data flow node that represents the CDL string to be parsed.
+   */
   DataFlow::ExprNode getCdlString() { result = cdlString }
 }
 
 class GlobalCQLFunction extends CqlClauseParserCall {
-  GlobalCQLFunction() { this = DataFlow::globalVarRef("CQL").getACall() }
+  GlobalCQLFunction() {
+    this = DataFlow::globalVarRef("CQL").getACall() and
+    cdlString = this.getArgument(0)
+  }
 }
 
 class CdsParseCqlCall extends CqlClauseParserCall {

javascript/frameworks/cap/test/models/cql/taintedclause/taintedclause.ql

@@ -1,5 +1,5 @@
 import javascript
-import advanced_security.javascript.frameworks.cap.CQL
+import advanced_security.javascript.frameworks.cap.CAPCqlInjectionQuery
 
-from ParseCQLTaintedClause clause
+from CqlClauseParserCallWithStringConcat clause
 select clause

javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js

@@ -167,9 +167,9 @@ module.exports = class Service1 extends cds.ApplicationService {
     });
 
     /* ========== 7. Service1 running query on the database service using CQN parsed with global function `CQL` ========== */
-    this.on("send6", async (req) => {
+    this.on("send7", async (req) => {
       const { id } = req.data;
-      const query = cds.parse.cql(`SELECT * from Entity1 where ID =` + id);
+      const query = CQL(`SELECT * from Entity1 where ID =` + id);
       cds.run(query);
     });