JS: Fix issue for .apply() calls

2026-05-01 11:45:14 +02:00 · 2024-08-14 14:51:22 +02:00
parent 34e6864fa3
commit 4389b5c999
5 changed files with 41 additions and 5 deletions
--- a/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowNode.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowNode.qll
@@ -55,6 +55,9 @@ private module Cached {
      invoke.isSpreadArgument(_) and
      storeContent = dynamicArgumentsContent()
    } or
+    TApplyCallTaintNode(MethodCallExpr node) {
+      node.getMethodName() = "apply" and exists(node.getArgument(1))
+    } or
    TDestructuredModuleImportNode(ImportDeclaration decl) {
      exists(decl.getASpecifier().getImportedName())
    } or