hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

improve performance by using RouteHandlerCandidate

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-09-17 15:41:50 +02:00
parent b4e75bf567
commit 0b16f81f8b
2 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/frameworks/Express.qll
View File

@@ -89,7 +89,7 @@ module Express {
/**
* Holds if a call to `callee` inside `f` forwards all of the parameters from `f` to that call.
*/
private predicate forwardingCall(DataFlow::SourceNode callee, DataFlow::FunctionNode f) {
private predicate forwardingCall(DataFlow::SourceNode callee, HTTP::RouteHandlerCandidate f) {
exists(DataFlow::CallNode call | call = callee.getACall() |
f.getNumParameter() >= 2 and
forall(int arg | arg = [0 .. f.getNumParameter() - 1] |

11
javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
View File

@@ -574,8 +574,7 @@ module HTTP {
read = DataFlow::lvalueNode(any(ForOfStmt stmt).getLValue())
or
// for forwarding calls to an element where the key is determined by the request.
getRequestParameterRead(read.getContainer().(Function).flow())
.flowsToExpr(read.getPropertyNameExpr())
getRequestParameterRead().flowsToExpr(read.getPropertyNameExpr())
)
}
}
@@ -583,12 +582,12 @@ module HTTP {
/**
* Gets a (chained) property-read/method-call on the request parameter of the route-handler `f`.
*/
private DataFlow::SourceNode getRequestParameterRead(RouteHandlerCandidate f) {
result = f.getParameter(0)
private DataFlow::SourceNode getRequestParameterRead() {
result = any(RouteHandlerCandidate f).getParameter(0)
or
result = getRequestParameterRead(f).getAPropertyRead()
result = getRequestParameterRead().getAPropertyRead()
or
result = getRequestParameterRead(f).getAMethodCall()
result = getRequestParameterRead().getAMethodCall()
}
/**