hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #741 from asger-semmle/this-access-path

Browse Source 
JS: support 'this' as the root of an access path
This commit is contained in:
Esben Sparre Andreasen
2019-01-21 16:48:34 +01:00
committed by GitHub
parent 50ce961c06 107ec3b687
commit 00ef80dfc5
4 changed files with 68 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
javascript/ql/src/semmle/javascript/dataflow/internal/AccessPaths.qll
View File

@@ -44,7 +44,8 @@ private PropertyName getPropertyName(PropAccess pacc) {
* where each property name is either constant or itself an SSA variable.
*/
private newtype TAccessPath =
MkRoot(SsaVariable var) or
MkSsaRoot(SsaVariable var) or
MkThisRoot(Function function) { function.getThisBinder() = function } or
MkAccessStep(AccessPath base, PropertyName name) {
exists(PropAccess pacc |
pacc.getBase() = base.getAnInstance() and
@@ -62,10 +63,16 @@ class AccessPath extends TAccessPath {
*/
Expr getAnInstanceIn(BasicBlock bb) {
exists(SsaVariable var |
this = MkRoot(var) and
this = MkSsaRoot(var) and
result = var.getAUseIn(bb)
)
or
exists(ThisExpr this_ |
this = MkThisRoot(this_.getBinder()) and
result = this_ and
this_.getBasicBlock() = bb
)
or
exists(PropertyName name |
result = getABaseInstanceIn(bb, name) and
getPropertyName(result) = name
@@ -96,7 +103,9 @@ class AccessPath extends TAccessPath {
* Gets a textual representation of this access path.
*/
string toString() {
exists(SsaVariable var | this = MkRoot(var) | result = var.getSourceVariable().getName())
exists(SsaVariable var | this = MkSsaRoot(var) | result = var.getSourceVariable().getName())
or
this = MkThisRoot(_) and result = "this"
or
exists(AccessPath base, PropertyName name, string rest |
rest = "." + any(string s | name = StaticPropertyName(s))