From 4c536dde204f02ab86d45c434a59f11e64d6bc6f Mon Sep 17 00:00:00 2001 From: Asger Feldthaus Date: Fri, 12 Jun 2020 10:07:37 +0100 Subject: [PATCH] JS: Propagate locally returned functions out of calls --- .../javascript/dataflow/internal/CallGraphs.qll | 11 +++++++++++ .../CallGraphs/AnnotatedTest/Test.expected | 1 - 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll index 44c9b364c2c..1149bbeb031 100644 --- a/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll +++ b/javascript/ql/src/semmle/javascript/dataflow/internal/CallGraphs.qll @@ -61,6 +61,17 @@ module CallGraph { function = cls.getConstructor() and cls.getAClassReference(t.continue()).flowsTo(result) ) + or + imprecision = 0 and + exists(DataFlow::FunctionNode outer | + result = getAFunctionReference(outer, 0, t.continue()).getAnInvocation() and + locallyReturnedFunction(outer, function) + ) + } + + cached + private predicate locallyReturnedFunction(DataFlow::FunctionNode outer, DataFlow::FunctionNode inner) { + inner.flowsTo(outer.getAReturn()) } /** diff --git a/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected b/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected index db0bb0cac13..b8e143dc5a6 100644 --- a/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected +++ b/javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected @@ -2,5 +2,4 @@ spuriousCallee missingCallee | constructor-field.ts:40:5:40:14 | f3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | | constructor-field.ts:71:1:71:11 | bf3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | -| returned-function.js:23:1:23:4 | r2() | returned-function.js:8:9:10:9 | functio ... } | -1 | badAnnotation