hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 05:54:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add legacy post-update step

Browse Source 
This is to ensure getALocalSource() can be replaced by getPostUpdateNode() as the base of a store
This commit is contained in:
Asger F
2023-10-10 10:41:39 +02:00
parent 6037ff553c
commit 3f20d71a9b
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSteps.qll
View File

@@ -30,6 +30,20 @@ predicate returnExpr(Function f, DataFlow::Node source, DataFlow::Node sink) {
not f = any(SetterMethodDeclaration decl).getBody()
}
/**
* A step from a post-update node to the local sources of the corresponding pre-update node.
*
* This ensures that `getPostUpdateNode()` can be used in place of `getALocalSource()` when generating
* store steps, and the resulting step will work in both data flow analyses.
*/
pragma[nomagic]
private predicate legacyPostUpdateStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(DataFlow::Node node |
pred = node.getPostUpdateNode() and
succ = node.getALocalSource()
)
}
/**
* Holds if data can flow in one step from `pred` to `succ`, taking
* additional steps from the configuration into account.
@@ -41,6 +55,8 @@ predicate localFlowStep(
) {
pred = succ.getAPredecessor() and predlbl = succlbl
or
legacyPostUpdateStep(pred, succ) and predlbl = succlbl
or
DataFlow::LegacyFlowStep::step(pred, succ) and predlbl = succlbl
or
DataFlow::LegacyFlowStep::step(pred, succ, predlbl, succlbl)