module CommandLineFileNameConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) {
    DataFlow::globalVarRef("process").getAPropertyRead("env").getAPropertyRead() = source
  }

  predicate isSink(DataFlow::Node sink) {
  exists(CallExpr call, int argIndex |
    sink.asExpr() = call.getArgument(argIndex) and
    (
      call.getCalleeName() = "query" or
      exists(MethodCallExpr member |
        call.getCallee() = member and
        member.getMethodName() = "query"
      )
    ) and not call.getFirstControlFlowNode().isUnreachable()
  ) 
}
}

module Flow = TaintTracking::Global<CommandLineFileNameConfig>;

import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, "x"