import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.XSS
import DataFlow::PathGraph
import DataFlow
import semmle.code.java.dataflow.internal.DataFlowImplCommon
import semmle.code.java.dataflow.TaintTracking
class SSSConfig extends TaintTracking::Configuration {
 
 SSSConfig() { this = "SqlInjectionLib::QueryInjectionFlowConfig" }
 
 override predicate isSource(DataFlow::Node src) { 
	
	exists(Callable m |
		m.hasName("replace") and m.getNumberOfParameters() = 1 and
		src.asParameter().getCallable() = m
	)	
	
 }
 override predicate isSink(DataFlow::Node sink) { 
	exists(MethodAccess ma | ma.getAnArgument() = sink.asExpr() and 
		ma.getMethod().hasName("eval")
	)
 }
 
 override int explorationLimit() { result = 500 }
}
from SSSConfig conf, DataFlow::PathNode source, DataFlow::PathNode sink
where conf.hasFlowPath(source, sink) and conf.isSource(source.getNode())
select source.getNode().asParameter().getName(), sink`

protected String resolveVariable(final String variableName, final TextStringBuilder buf, final int startPos,
 final int endPos) {
 final StringLookup resolver = getStringLookup();
 if (resolver == null) {
 return null;
 }
 return resolver.lookup(variableName);
 }