hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Use type inference to refine regexp string tracking

Browse Source
This commit is contained in:
Asger F
2019-10-24 13:42:13 +01:00
parent e45c361d64
commit 20fb7717d8
1 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
javascript/ql/src/semmle/javascript/Regexp.qll
View File

@@ -750,22 +750,25 @@ class RegExpParseError extends Error, @regexp_parse_error {
* Holds if `source` may be interpreted as a regular expression.
*/
predicate isInterpretedAsRegExp(DataFlow::Node source) {
// The first argument to an invocation of `RegExp` (with or without `new`).
source = DataFlow::globalVarRef("RegExp").getAnInvocation().getArgument(0)
or
// The argument of a call that coerces the argument to a regular expression.
exists(MethodCallExpr mce, string methodName |
mce.getReceiver().analyze().getAType() = TTString() and
mce.getMethodName() = methodName
|
methodName = "match" and source.asExpr() = mce.getArgument(0) and mce.getNumArgument() = 1
source.analyze().getAType() = TTString() and
(
// The first argument to an invocation of `RegExp` (with or without `new`).
source = DataFlow::globalVarRef("RegExp").getAnInvocation().getArgument(0)
or
methodName = "search" and
source.asExpr() = mce.getArgument(0) and
mce.getNumArgument() = 1 and
// "search" is a common method name, and so we exclude chained accesses
// because `String.prototype.search` returns a number
not exists(PropAccess p | p.getBase() = mce)
// The argument of a call that coerces the argument to a regular expression.
exists(MethodCallExpr mce, string methodName |
mce.getReceiver().analyze().getAType() = TTString() and
mce.getMethodName() = methodName
|
methodName = "match" and source.asExpr() = mce.getArgument(0) and mce.getNumArgument() = 1
or
methodName = "search" and
source.asExpr() = mce.getArgument(0) and
mce.getNumArgument() = 1 and
// "search" is a common method name, and so we exclude chained accesses
// because `String.prototype.search` returns a number
not exists(PropAccess p | p.getBase() = mce)
)
)
}