hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Use type resolution for CG augmentation

Browse Source
This commit is contained in:
Asger F
2025-04-22 08:47:00 +02:00
parent ca75ee161a
commit 21e3dc7aa5
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/lib/semmle/javascript/Expr.qll
View File

@@ -4,6 +4,7 @@
import javascript import javascript
private import semmle.javascript.internal.CachedStages private import semmle.javascript.internal.CachedStages
private import semmle.javascript.internal.TypeResolution
/** /**
* A program element that is either an expression or a type annotation. * A program element that is either an expression or a type annotation.
@@ -1017,7 +1018,11 @@ class InvokeExpr extends @invokeexpr, Expr {
* Note that the resolved function may be overridden in a subclass and thus is not * Note that the resolved function may be overridden in a subclass and thus is not
* necessarily the actual target of this invocation at runtime. * necessarily the actual target of this invocation at runtime.
*/ */
Function getResolvedCallee() { result = this.getResolvedCalleeName().getImplementation() } Function getResolvedCallee() {
TypeResolution::callTarget(this, result)
or
result = this.getResolvedCalleeName().getImplementation()
}
} }
/** /**

2
javascript/ql/lib/semmle/javascript/internal/TypeResolution.qll
View File

@@ -111,7 +111,7 @@ module TypeResolution {
member.(AST::ValueNode).flow(), contents) member.(AST::ValueNode).flow(), contents)
} }
private predicate callTarget(InvokeExpr call, Function target) { predicate callTarget(InvokeExpr call, Function target) {
exists(ClassDefinition cls | exists(ClassDefinition cls |
valueHasType(call.(NewExpr).getCallee(), trackClassValue(cls)) and valueHasType(call.(NewExpr).getCallee(), trackClassValue(cls)) and
target = cls.getConstructor().getBody() target = cls.getConstructor().getBody()