Update to use the sourceLocationPrefix

In our testing framework we don't always have the .cds file indexed
so we can't guarantee the presence of the File entry. Instead,
compose the path using the sourceLocationPrefix, which will be
robust to whether the .cds file was indexed or not.

Author: lcartey

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDL.qll

@@ -16,10 +16,14 @@ abstract class CdlObject extends JsonObject {
         locValue = this.getPropValue("$location") and
         // The path in the cds.json file is relative to the working directory used when running
         // the cds compile command. In our extractor, that's always the root of the repository,
-        // so we can identify the entry in the `File` table by its relative path.
-        path =
-          any(File f | f.getRelativePath() = locValue.getPropValue("file").getStringValue())
-              .getAbsolutePath() and
+        // so we can identify the sourceLocationPrefix to find the path of the root of the repo
+        // then append the relative path
+        exists(string sourceLocationPrefix |
+          sourceLocationPrefix(sourceLocationPrefix) and
+          path =
+            sourceLocationPrefix.regexpReplaceAll("/$", "") + "/" +
+              locValue.getPropValue("file").getStringValue()
+        ) and
         if
           not exists(locValue.getPropValue("line")) and
           not exists(locValue.getPropValue("col"))