JS: Support return value of x++

2026-04-27 17:55:19 +02:00 · 2018-09-19 18:45:55 +01:00
parent 73cbdee691
commit 09ca6652fb
2 changed files with 11 additions and 0 deletions
--- a/javascript/ql/src/semmle/javascript/RangeAnalysis.qll
+++ b/javascript/ql/src/semmle/javascript/RangeAnalysis.qll
@@ -163,6 +163,12 @@ module RangeAnalysis {
        else
          bias = -1)
      or
+      exists (UpdateExpr update | r.asExpr() = update | // Return value of x++ is just x (coerced to an int)
+        root = update.getOperand().flow() and
+        not update.isPrefix() and
+        sign = 1 and
+        bias = 0)
+      or
      exists (CompoundAssignExpr assign | r = compoundAssignResult(assign) |
        root = assign.getLhs().flow() and
        sign = 1 and