hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 20:25:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #466 from xiemaisi/js/more-data-flow-predicates

Browse Source 
Approved by asger-semmle
This commit is contained in:
semmle-qlci
2018-11-14 16:07:59 +00:00
committed by GitHub
parent 50a905d54a 6f6b3b0d5e
commit 4a14bef507
9 changed files with 35 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/src/Expressions/UnboundEventHandlerReceiver.ql
View File

@@ -22,10 +22,9 @@ private predicate isBoundInMethod(MethodDeclaration method) {
or
exists (string name |
name = method.getName() |
exists (DataFlow::Node rhs, DataFlow::MethodCallNode bind |
exists (DataFlow::MethodCallNode bind |
// this.<methodName> = <expr>.bind(...)
thiz.hasPropertyWrite(name, rhs) and
bind.flowsTo(rhs) and
bind = thiz.getAPropertySource(name) and
bind.getMethodName() = "bind"
)
or

5
javascript/ql/src/semmle/javascript/AMD.qll
View File

@@ -83,6 +83,11 @@ class AMDModuleDefinition extends CallExpr {
)
}
/** Gets a source node whose value becomes the definition of this module. */
DataFlow::SourceNode getAModuleSource() {
result.flowsToExpr(getModuleExpr())
}
/**
* Holds if `p` is the parameter corresponding to dependency `dep`.
*/

7
javascript/ql/src/semmle/javascript/dataflow/Sources.qll
View File

@@ -178,6 +178,13 @@ abstract class SourceNode extends DataFlow::Node {
DataFlow::NewNode getAnInstantiation() {
result = getAnInvocation()
}
/**
* Gets a source node whose value is stored in property `prop` of this node.
*/
DataFlow::SourceNode getAPropertySource(string prop) {
result.flowsTo(getAPropertyWrite(prop).getRhs())
}
}
/**

12
javascript/ql/src/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll
View File

@@ -439,9 +439,9 @@ class GeneralDirective extends CustomDirective, MkCustomDirective {
result = getMember("link")
or
// { link: { pre: function preLink() { ... }, post: function postLink() { ... } } }
exists (DataFlow::PropWrite pwn | kind = "pre" or kind = "post" |
pwn = getMember("link").getAPropertyWrite(kind) and
result.flowsTo(pwn.getRhs())
(
(kind = "pre" or kind = "post") and
result = getMember("link").getAPropertySource(kind)
)
or
// { compile: function() { ... return link; } }
@@ -453,9 +453,9 @@ class GeneralDirective extends CustomDirective, MkCustomDirective {
result = compileReturnSrc
or
// link = { pre: function preLink() { ... }, post: function postLink() { ... } }
exists (DataFlow::PropWrite pwn | kind = "pre" or kind = "post" |
pwn = compileReturnSrc.getAPropertyWrite(kind) and
result.flowsTo(pwn.getRhs())
(
(kind = "pre" or kind = "post") and
result = compileReturnSrc.getAPropertySource(kind)
)
)
}

5
javascript/ql/src/semmle/javascript/frameworks/AngularJS/ServiceDefinitions.qll
View File

@@ -718,11 +718,10 @@ class ProviderRecipeDefinition extends RecipeDefinition {
method set to your factory function is automatically created
under the hood. */
exists(DataFlow::ThisNode thiz, DataFlow::Node rhs, InjectableFunction f |
exists(DataFlow::ThisNode thiz, InjectableFunction f |
f = getAFactoryFunction() and
thiz.getBinder().getFunction() = f.asFunction() and
thiz.hasPropertyWrite("$get", rhs) and
result.flowsTo(rhs)
result = thiz.getAPropertySource("$get")
)
}

8
javascript/ql/test/library-tests/AMD/AMDModuleExpr.expected
View File

@@ -1,4 +1,4 @@
| a.js:1:1:3:2 | define( ... 2 };\\n}) | a.js:2:12:2:22 | { foo: 42 } |
| dir/b.js:1:1:3:2 | define( ... : 42\\n}) | dir/b.js:1:8:3:1 | {\\n bar: 42\\n} |
| tst.js:1:1:6:2 | define( ... };\\n}) | tst.js:2:12:5:5 | {\\n ... r\\n } |
| umd.js:4:9:4:43 | define( ... actory) | umd.js:10:12:13:5 | {\\n ... r\\n } |
| a.js:1:1:3:2 | define( ... 2 };\\n}) | a.js:2:12:2:22 | { foo: 42 } | a.js:2:12:2:22 | { foo: 42 } |
| dir/b.js:1:1:3:2 | define( ... : 42\\n}) | dir/b.js:1:8:3:1 | {\\n bar: 42\\n} | dir/b.js:1:8:3:1 | {\\n bar: 42\\n} |
| tst.js:1:1:6:2 | define( ... };\\n}) | tst.js:2:12:5:5 | {\\n ... r\\n } | tst.js:2:12:5:5 | {\\n ... r\\n } |
| umd.js:4:9:4:43 | define( ... actory) | umd.js:10:12:13:5 | {\\n ... r\\n } | umd.js:10:12:13:5 | {\\n ... r\\n } |

2
javascript/ql/test/library-tests/AMD/AMDModuleExpr.ql
View File

@@ -1,4 +1,4 @@
import javascript
from AMDModuleDefinition d
select d, d.getModuleExpr()
select d, d.getModuleExpr(), d.getAModuleSource()

4
javascript/ql/test/library-tests/PropWrite/getAPropertySource.expected Normal file
View File

@@ -0,0 +1,4 @@
| tst.js:2:11:10:1 | {\\n x ... }\\n} | f | tst.js:7:6:9:5 | () {\\n ... ;\\n } |
| tst.js:2:11:10:1 | {\\n x ... }\\n} | func | tst.js:4:11:6:5 | functio ... ;\\n } |
| tst.js:12:1:19:1 | class C ... ;\\n }\\n} | func | tst.js:13:14:15:3 | (x) {\\n ... x);\\n } |
| tst.js:24:8:24:57 | <div on ... }</div> | onClick | tst.js:24:22:24:26 | click |

4
javascript/ql/test/library-tests/PropWrite/getAPropertySource.ql Normal file
View File

@@ -0,0 +1,4 @@
import javascript
from DataFlow::SourceNode nd, string prop
select nd, prop, nd.getAPropertySource(prop)