mirror of
https://github.com/github/codeql.git
synced 2025-12-22 03:36:30 +01:00
JS: Only extract local vars in TemplateTopLevel
Angular template expressions cannot refer to global variables, any unqualified identifier is a reference to a property provided by the component. We extract them as implicitly declared local variables which the QL model can then connect with data flow steps.
This commit is contained in:
@@ -124,7 +124,8 @@ case @toplevel.kind of
|
||||
0 = @script
|
||||
| 1 = @inline_script
|
||||
| 2 = @event_handler
|
||||
| 3 = @javascript_url;
|
||||
| 3 = @javascript_url
|
||||
| 4 = @angular_template_toplevel;
|
||||
|
||||
is_module (int tl: @toplevel ref);
|
||||
is_nodejs (int tl: @toplevel ref);
|
||||
|
||||
Reference in New Issue
Block a user