hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Include content properties in type-tracker properties

Browse Source 
Reminder: we have two PropertyName classes because the one in Contents.qll can't depend on DataFlow::Node.
This commit is contained in:
Asger F
2024-12-03 09:58:54 +01:00
parent 8bca66493f
commit 054558d7b5
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/lib/semmle/javascript/dataflow/internal/StepSummary.qll
View File

@@ -1,6 +1,7 @@
import javascript
private import semmle.javascript.dataflow.TypeTracking
private import semmle.javascript.internal.CachedStages
private import semmle.javascript.dataflow.internal.Contents as Contents
private import sharedlib.SummaryTypeTracker as SummaryTypeTracker
private import FlowSteps
@@ -30,6 +31,8 @@ private module Cached {
SharedTypeTrackingStep::loadStoreStep(_, _, _, this)
or
this = DataFlow::PseudoProperties::arrayLikeElement()
or
this instanceof Contents::Private::PropertyName
}
}

2
javascript/ql/test/library-tests/TypeTracking2/summaries.js
View File

@@ -48,7 +48,7 @@ function m5() {
// Store and read to a property that isn't mentioned anywhere in the source code.
const store = mkSummary("Argument[0]", "ReturnValue.Member[propOnlyMentionedInSummary]");
const read = mkSummary("Argument[0].Member[propOnlyMentionedInSummary]", "ReturnValue");
sink(read(store(source("m5.1")))); // $ MISSING: track=m5.1
sink(read(store(source("m5.1")))); // $ track=m5.1
sink(read(source("m5.1")));
sink(store(source("m5.1")));
sink(store(read(source("m5.1"))));