const mysql = require('mysql2')
const connection = mysql.createConnection({
 host: "localhost",
 user: "dbuser",
 database: "testdb",
 password: "password",
})
function func() {
 let arg = ''
 arg = process.env.USERNAME
 let v = 0;
 switch (v) {
 case 1:
 let q = "SELECT * FROM records WHERE owner = " + arg
 connection.query(q, (err, rows) => {
 if (err)
 console.error(err)
 else
 console.log("Done!")
 })
 break;
 case 0:
 process.exit(0)
 break;
 }
}

module CommandLineFileNameConfig implements DataFlow::ConfigSig {
 predicate isSource(DataFlow::Node source) {
 DataFlow::globalVarRef("process").getAPropertyRead("env").getAPropertyRead() = source
 }
 predicate isSink(DataFlow::Node sink) {
 exists(CallExpr call, int argIndex |
 sink.asExpr() = call.getArgument(argIndex) and
 (
 call.getCalleeName() = "query" or
 exists(MethodCallExpr member |
 call.getCallee() = member and
 member.getMethodName() = "query"
 )
 ) and not call.getFirstControlFlowNode().isUnreachable()
 ) 
}
}
module Flow = TaintTracking::Global<CommandLineFileNameConfig>;
import Flow::PathGraph
from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, "x"