hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

improve performance by using RouteHandlerCandidate

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-09-17 15:41:50 +02:00
parent b4e75bf567
commit 0b16f81f8b
2 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/semmle/javascript/frameworks/Express.qll
View File

@@ -89,7 +89,7 @@ module Express {
/** /**
* Holds if a call to `callee` inside `f` forwards all of the parameters from `f` to that call. * Holds if a call to `callee` inside `f` forwards all of the parameters from `f` to that call.
*/ */
private predicate forwardingCall(DataFlow::SourceNode callee, DataFlow::FunctionNode f) { private predicate forwardingCall(DataFlow::SourceNode callee, HTTP::RouteHandlerCandidate f) {
exists(DataFlow::CallNode call | call = callee.getACall() | exists(DataFlow::CallNode call | call = callee.getACall() |
f.getNumParameter() >= 2 and f.getNumParameter() >= 2 and
forall(int arg | arg = [0 .. f.getNumParameter() - 1] | forall(int arg | arg = [0 .. f.getNumParameter() - 1] |

11
javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
View File

@@ -574,8 +574,7 @@ module HTTP {
read = DataFlow::lvalueNode(any(ForOfStmt stmt).getLValue()) read = DataFlow::lvalueNode(any(ForOfStmt stmt).getLValue())
or or
// for forwarding calls to an element where the key is determined by the request. // for forwarding calls to an element where the key is determined by the request.
getRequestParameterRead(read.getContainer().(Function).flow()) getRequestParameterRead().flowsToExpr(read.getPropertyNameExpr())
.flowsToExpr(read.getPropertyNameExpr())
) )
} }
} }
@@ -583,12 +582,12 @@ module HTTP {
/** /**
* Gets a (chained) property-read/method-call on the request parameter of the route-handler `f`. * Gets a (chained) property-read/method-call on the request parameter of the route-handler `f`.
*/ */
private DataFlow::SourceNode getRequestParameterRead(RouteHandlerCandidate f) { private DataFlow::SourceNode getRequestParameterRead() {
result = f.getParameter(0) result = any(RouteHandlerCandidate f).getParameter(0)
or or
result = getRequestParameterRead(f).getAPropertyRead() result = getRequestParameterRead().getAPropertyRead()
or or
result = getRequestParameterRead(f).getAMethodCall() result = getRequestParameterRead().getAMethodCall()
} }
/** /**