mirror of
https://github.com/github/codeql.git
synced 2026-04-26 09:15:12 +02:00
Restrict pipe detection to calls with 1-2 arguments
This commit is contained in:
@@ -15,7 +15,7 @@ import javascript
|
||||
* A call to the `pipe` method on a Node.js stream.
|
||||
*/
|
||||
class PipeCall extends DataFlow::MethodCallNode {
|
||||
PipeCall() { this.getMethodName() = "pipe" }
|
||||
PipeCall() { this.getMethodName() = "pipe" and this.getNumArgument() = [1, 2] }
|
||||
|
||||
/** Gets the source stream (receiver of the pipe call). */
|
||||
DataFlow::Node getSourceStream() { result = this.getReceiver() }
|
||||
|
||||
@@ -9,5 +9,3 @@
|
||||
| test.js:116:5:116:21 | stream.pipe(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
|
||||
| test.js:125:5:125:26 | getStre ... e(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
|
||||
| test.js:143:5:143:62 | stream. ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
|
||||
| test.js:163:5:163:20 | notStream.pipe() | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
|
||||
| test.js:167:5:167:36 | notStre ... , arg3) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
|
||||
|
||||
@@ -160,10 +160,10 @@ function test() {
|
||||
}
|
||||
{ // Calling custom pipe method with no arguments
|
||||
const notStream = getNotAStream();
|
||||
notStream.pipe(); // $SPURIOUS:Alert
|
||||
notStream.pipe();
|
||||
}
|
||||
{ // Calling custom pipe method with more then 2 arguments
|
||||
const notStream = getNotAStream();
|
||||
notStream.pipe(arg1, arg2, arg3); // $SPURIOUS:Alert
|
||||
notStream.pipe(arg1, arg2, arg3);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user