mirror of
https://github.com/github/codeql.git
synced 2026-04-28 10:15:14 +02:00
JavaScript: Refactor argumentPassing.
This commit is contained in:
@@ -502,10 +502,7 @@ private predicate callInputStep(
|
||||
) {
|
||||
(
|
||||
isRelevant(pred, cfg) and
|
||||
exists(Parameter parm |
|
||||
argumentPassing(invk, pred, f, parm) and
|
||||
succ = DataFlow::parameterNode(parm)
|
||||
)
|
||||
argumentPassing(invk, pred, f, succ)
|
||||
or
|
||||
isRelevant(pred, cfg) and
|
||||
exists(SsaDefinition prevDef, SsaDefinition def |
|
||||
|
||||
@@ -17,6 +17,9 @@ class ParameterNode extends DataFlow::SourceNode {
|
||||
|
||||
/** Gets the name of this parameter. */
|
||||
string getName() { result = p.getName() }
|
||||
|
||||
/** Holds if this parameter is a rest parameter. */
|
||||
predicate isRestParameter() { p.isRestParameter() }
|
||||
}
|
||||
|
||||
/** A data flow node corresponding to a function invocation (with or without `new`). */
|
||||
|
||||
@@ -782,7 +782,7 @@ module TaintTracking {
|
||||
* A function that returns the result of a sanitizer check.
|
||||
*/
|
||||
private class SanitizingFunction extends Function {
|
||||
Parameter sanitizedParameter;
|
||||
DataFlow::ParameterNode sanitizedParameter;
|
||||
|
||||
SanitizerGuardNode sanitizer;
|
||||
|
||||
@@ -806,11 +806,11 @@ module TaintTracking {
|
||||
or
|
||||
returnExpr = getAReturnedExpr()
|
||||
) and
|
||||
DataFlow::parameterNode(sanitizedParameter).flowsToExpr(e) and
|
||||
sanitizedParameter.flowsToExpr(e) and
|
||||
sanitizer.sanitizes(sanitizerOutcome, e)
|
||||
) and
|
||||
getNumParameter() = 1 and
|
||||
sanitizedParameter = getParameter(0)
|
||||
sanitizedParameter.getParameter() = getParameter(0)
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -113,10 +113,7 @@ private module NodeTracking {
|
||||
) {
|
||||
isRelevant(pred) and
|
||||
(
|
||||
exists(Parameter parm |
|
||||
argumentPassing(invk, pred, f, parm) and
|
||||
succ = DataFlow::parameterNode(parm)
|
||||
)
|
||||
argumentPassing(invk, pred, f, succ)
|
||||
or
|
||||
exists(SsaDefinition prevDef, SsaDefinition def |
|
||||
pred = DataFlow::ssaDefinitionNode(prevDef) and
|
||||
|
||||
@@ -87,11 +87,11 @@ predicate localFlowStep(
|
||||
* through invocation `invk` of function `f`.
|
||||
*/
|
||||
predicate argumentPassing(
|
||||
DataFlow::InvokeNode invk, DataFlow::ValueNode arg, Function f, Parameter parm
|
||||
DataFlow::InvokeNode invk, DataFlow::ValueNode arg, Function f, DataFlow::ParameterNode parm
|
||||
) {
|
||||
calls(invk, f) and
|
||||
exists(int i |
|
||||
f.getParameter(i) = parm and
|
||||
f.getParameter(i) = parm.getParameter() and
|
||||
not parm.isRestParameter() and
|
||||
arg = invk.getArgument(i)
|
||||
)
|
||||
@@ -99,7 +99,7 @@ predicate argumentPassing(
|
||||
exists(DataFlow::Node callback, int i |
|
||||
invk.(DataFlow::AdditionalPartialInvokeNode).isPartialArgument(callback, arg, i) and
|
||||
partiallyCalls(invk, callback, f) and
|
||||
parm = f.getParameter(i) and
|
||||
parm.getParameter() = f.getParameter(i) and
|
||||
not parm.isRestParameter()
|
||||
)
|
||||
}
|
||||
@@ -109,10 +109,7 @@ predicate argumentPassing(
|
||||
* to a function call.
|
||||
*/
|
||||
predicate callStep(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
exists(Parameter parm |
|
||||
argumentPassing(_, pred, _, parm) and
|
||||
succ = DataFlow::parameterNode(parm)
|
||||
)
|
||||
argumentPassing(_, pred, _, succ)
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user