Restrict pipe detection to calls with 1-2 arguments

This commit is contained in:
Napalys Klicius
2025-05-20 14:45:51 +02:00
parent 30f2815503
commit 03d1f9a7d3
3 changed files with 3 additions and 5 deletions

View File

@@ -15,7 +15,7 @@ import javascript
* A call to the `pipe` method on a Node.js stream.
*/
class PipeCall extends DataFlow::MethodCallNode {
PipeCall() { this.getMethodName() = "pipe" }
PipeCall() { this.getMethodName() = "pipe" and this.getNumArgument() = [1, 2] }
/** Gets the source stream (receiver of the pipe call). */
DataFlow::Node getSourceStream() { result = this.getReceiver() }

View File

@@ -9,5 +9,3 @@
| test.js:116:5:116:21 | stream.pipe(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:125:5:125:26 | getStre ... e(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:143:5:143:62 | stream. ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:163:5:163:20 | notStream.pipe() | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:167:5:167:36 | notStre ... , arg3) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |

View File

@@ -160,10 +160,10 @@ function test() {
}
{ // Calling custom pipe method with no arguments
const notStream = getNotAStream();
notStream.pipe(); // $SPURIOUS:Alert
notStream.pipe();
}
{ // Calling custom pipe method with more then 2 arguments
const notStream = getNotAStream();
notStream.pipe(arg1, arg2, arg3); // $SPURIOUS:Alert
notStream.pipe(arg1, arg2, arg3);
}
}