hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Use TCapturedVariableNode as starting point of callInputStep

Browse Source
This commit is contained in:
Asger Feldthaus
2020-05-01 21:10:53 +01:00
parent 4d6da19173
commit 0f870a4992
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
View File

@@ -926,10 +926,10 @@ private predicate callInputStep(
argumentPassing(invk, pred, f, succ)
or
isRelevant(pred, cfg) and
exists(SsaDefinition prevDef, SsaDefinition def |
pred = DataFlow::ssaDefinitionNode(prevDef) and
exists(LocalVariable variable, SsaDefinition def |
pred = DataFlow::capturedVariableNode(variable) and
calls(invk, f) and
captures(f, prevDef, def) and
captures(f, variable, def) and
succ = DataFlow::ssaDefinitionNode(def)
)
) and

6
javascript/ql/src/semmle/javascript/dataflow/TrackedNodes.qll
View File

@@ -122,10 +122,10 @@ private module NodeTracking {
(
argumentPassing(invk, pred, f, succ)
or
exists(SsaDefinition prevDef, SsaDefinition def |
pred = DataFlow::ssaDefinitionNode(prevDef) and
exists(LocalVariable variable, SsaDefinition def |
pred = DataFlow::capturedVariableNode(variable) and
calls(invk, f) and
captures(f, prevDef, def) and
captures(f, variable, def) and
succ = DataFlow::ssaDefinitionNode(def)
)
)

6
javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
View File

@@ -78,11 +78,11 @@ predicate localExceptionStep(DataFlow::Node pred, DataFlow::Node succ) {
cached
private module CachedSteps {
/**
* Holds if `f` captures the variable defined by `def` in `cap`.
* Holds if `f` captures the given `variable` in `cap`.
*/
cached
predicate captures(Function f, SsaExplicitDefinition def, SsaVariableCapture cap) {
def.getSourceVariable() = cap.getSourceVariable() and
predicate captures(Function f, LocalVariable variable, SsaVariableCapture cap) {
variable = cap.getSourceVariable() and
f = cap.getContainer()
}