Delay envvar event-name correlation

Author: JarLob

actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql

@@ -19,10 +19,16 @@ import codeql.actions.dataflow.FlowSources
 import EnvVarInjectionFlow::PathGraph
 import codeql.actions.security.ControlChecks
 
+bindingset[source, event]
+pragma[inline_late]
+private predicate hasSameEventName(RemoteFlowSource source, Event event) {
+  source.getEventName() = event.getName()
+}
+
 from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink, Event event
 where
   EnvVarInjectionFlow::flowPath(source, sink) and
-  source.getNode().(RemoteFlowSource).getEventName() = event.getName() and
+  hasSameEventName(source.getNode(), event) and
   // exclude paths to file read sinks from non-artifact sources
   (
     // source is text