hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add test for captured flow into callback

Browse Source
This commit is contained in:
Asger Feldthaus
2020-12-07 10:32:13 +00:00
parent 355cfaaf42
commit 0496642b0b
4 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
View File

@@ -1291,7 +1291,9 @@ private predicate summarizedHigherOrderCall(
DataFlow::Node innerArg, DataFlow::SourceNode cbParm, PathSummary oldSummary
|
reachableFromInput(f, outer, arg, innerArg, cfg, oldSummary) and
not arg = DataFlow::capturedVariableNode(_) and // Only track actual parameter flow
// Only track actual parameter flow.
// Captured flow does not need to be summarized - it is handled by the local case in `higherOrderCall`.
not arg = DataFlow::capturedVariableNode(_) and
argumentPassing(outer, cb, f, cbParm) and
innerArg = inner.getArgument(j)
|

1
javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
View File

@@ -31,6 +31,7 @@ typeInferenceMismatch
| callbacks.js:44:17:44:24 | source() | callbacks.js:41:10:41:10 | x |
| callbacks.js:50:18:50:25 | source() | callbacks.js:30:29:30:29 | y |
| callbacks.js:51:18:51:25 | source() | callbacks.js:30:29:30:29 | y |
| callbacks.js:53:23:53:30 | source() | callbacks.js:58:10:58:10 | x |
| capture-flow.js:9:11:9:18 | source() | capture-flow.js:14:10:14:16 | outer() |
| captured-sanitizer.js:25:3:25:10 | source() | captured-sanitizer.js:15:10:15:10 | x |
| closure.js:6:15:6:22 | source() | closure.js:8:8:8:31 | string. ... (taint) |

1
javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
View File

@@ -22,6 +22,7 @@
| callbacks.js:44:17:44:24 | source() | callbacks.js:41:10:41:10 | x |
| callbacks.js:50:18:50:25 | source() | callbacks.js:30:29:30:29 | y |
| callbacks.js:51:18:51:25 | source() | callbacks.js:30:29:30:29 | y |
| callbacks.js:53:23:53:30 | source() | callbacks.js:58:10:58:10 | x |
| capture-flow.js:9:11:9:18 | source() | capture-flow.js:14:10:14:16 | outer() |
| captured-sanitizer.js:25:3:25:10 | source() | captured-sanitizer.js:15:10:15:10 | x |
| constructor-calls.js:4:18:4:25 | source() | constructor-calls.js:18:8:18:14 | c.taint |

8
javascript/ql/test/library-tests/TaintTracking/callbacks.js
View File

@@ -49,4 +49,12 @@ function test() {
middleCallback(source());
middleCallback(source());
let capturedTaint = source();
function helper2(cb) {
cb(capturedTaint);
}
helper2(x => {
sink(x); // NOT OK
});
}