diff --git a/javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDL.qll b/javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDL.qll index e1cb6407..5582c6c6 100644 --- a/javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDL.qll +++ b/javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDL.qll @@ -16,10 +16,14 @@ abstract class CdlObject extends JsonObject { locValue = this.getPropValue("$location") and // The path in the cds.json file is relative to the working directory used when running // the cds compile command. In our extractor, that's always the root of the repository, - // so we can identify the entry in the `File` table by its relative path. - path = - any(File f | f.getRelativePath() = locValue.getPropValue("file").getStringValue()) - .getAbsolutePath() and + // so we can identify the sourceLocationPrefix to find the path of the root of the repo + // then append the relative path + exists(string sourceLocationPrefix | + sourceLocationPrefix(sourceLocationPrefix) and + path = + sourceLocationPrefix.regexpReplaceAll("/$", "") + "/" + + locValue.getPropValue("file").getStringValue() + ) and if not exists(locValue.getPropValue("line")) and not exists(locValue.getPropValue("col"))