Merge pull request github#6533 from erik-krogh/cwdPath

Approved by asgerf

Author: codeql-ci

javascript/change-notes/2021-08-24-tainted-path-cwd.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `js/tainted-path` query now recognizes the `cwd` option to shell invocations as a sink.

javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

@@ -696,6 +696,18 @@ module TaintedPath {
     }
   }
 
+  /**
+   * The `cwd` option to a shell execution.
+   */
+  private class ShellCwdSink extends TaintedPath::Sink {
+    ShellCwdSink() {
+      exists(SystemCommandExecution sys, API::Node opts |
+        opts.getARhs() = sys.getOptionsArg() and // assuming that an API::Node exists here.
+        this = opts.getMember("cwd").getARhs()
+      )
+    }
+  }
+
   /**
    * Holds if there is a step `src -> dst` mapping `srclabel` to `dstlabel` relevant for path traversal vulnerabilities.
    */