import javascript

import semmle.javascript.security.dataflow.CommandInjectionQuery

import CommandInjectionFlow::PathGraph

CommandInjectionFlow::PathNode source, CommandInjectionFlow::PathNode sink,

DataFlow::Node highlight, Source sourceNode

CommandInjectionFlow::flowPath(source, sink) and

(

if isSinkWithHighlight(sink.getNode(), _)

then isSinkWithHighlight(sink.getNode(), highlight)

else highlight = sink.getNode()

) and

sourceNode = source.getNode()

select highlight, source, sink, "This command line depends on a $@.", source.getNode(),

"user-provided value"