move RemoteFlowSource into it's own cached layer, to minimize re-evaluation of cached layer

erik-krogh · erik-krogh · commit 938983d71698 · 2022-12-06T20:13:03.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/internal/CachedStages.qll b/javascript/ql/lib/semmle/javascript/internal/CachedStages.qll
@@ -312,8 +312,6 @@ module Stages {
       or
       TaintTracking::heapStep(_, _)
       or
-      exists(RemoteFlowSource r)
-      or
       exists(Exports::getALibraryInputParameter())
       or
       any(RegExpTerm t).isUsedAsRegExp()
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/RemoteFlowSources.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/RemoteFlowSources.qll
@@ -5,7 +5,6 @@
 import javascript
 import semmle.javascript.frameworks.HTTP
 import semmle.javascript.security.dataflow.DOM
-private import semmle.javascript.internal.CachedStages
 
 cached
 private module Cached {
@@ -173,7 +172,7 @@ private class ExternalRemoteFlowSourceSpecEntryPoint extends API::EntryPoint {
 private class ExternalRemoteFlowSource extends RemoteFlowSource {
   RemoteFlowSourceAccessPath ap;
 
-  ExternalRemoteFlowSource() { Stages::Taint::ref() and this = ap.resolve().asSource() }
+  ExternalRemoteFlowSource() { this = ap.resolve().asSource() }
 
   override string getSourceType() { result = ap.getSourceType() }
 }
