hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: ComposedFunctions

Browse Source
This commit is contained in:
Asger Feldthaus
2020-03-28 19:39:59 +00:00
parent a2f7ecec66
commit 25d4ab78fe
1 changed files with 6 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
javascript/ql/src/semmle/javascript/frameworks/ComposedFunctions.qll
View File

@@ -110,20 +110,12 @@ module FunctionCompositionCall {
}
}
/**
* A taint step for a composed function.
*/
private class ComposedFunctionTaintStep extends TaintTracking::AdditionalTaintStep {
FunctionCompositionCall composed;
DataFlow::CallNode call;
ComposedFunctionTaintStep() {
call = composed.getACall() and
this = call
}
private class ComposedFunctionTaintStep extends TaintTracking::SharedTaintStep {
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
exists(int fnIndex, DataFlow::FunctionNode fn | fn = composed.getOperandFunction(fnIndex) |
exists(int fnIndex, DataFlow::FunctionNode fn, FunctionCompositionCall composed, DataFlow::CallNode call |
fn = composed.getOperandFunction(fnIndex) and
call = composed.getACall()
|
// flow into the first function
fnIndex = composed.getNumOperand() - 1 and
exists(int callArgIndex |
@@ -140,7 +132,7 @@ private class ComposedFunctionTaintStep extends TaintTracking::AdditionalTaintSt
// flow out of the composed call
fnIndex = 0 and
pred = fn.getReturnNode() and
succ = this
succ = call
)
}
}