hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Use ArrayElementKnown when reading a constant array index

Browse Source
This commit is contained in:
Asger F
2024-09-06 13:43:18 +02:00
parent 094112c905
commit 55d4e7e742
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll
View File

@@ -1103,7 +1103,12 @@ predicate readStep(Node node1, ContentSet c, Node node2) {
node1 = read.getBase() and
node2 = read
|
c.asPropertyName() = read.getPropertyName()
exists(PropertyName name | read.getPropertyName() = name |
not exists(name.asArrayIndex()) and
c = ContentSet::property(name)
or
c = ContentSet::arrayElementKnown(name.asArrayIndex())
)
or
not exists(read.getPropertyName()) and
c = ContentSet::arrayElement()

8
javascript/ql/test/library-tests/TripleDot/tst.js
View File

@@ -134,7 +134,7 @@ function t13() {
sink(x); // $ SPURIOUS: hasTaintFlow=t13.1
sink(y); // $ hasTaintFlow=t13.1
sink(rest); // $ hasTaintFlow=t13.1
sink(rest[0]); // $ MISSING: hasTaintFlow=t13.1
sink(rest[0]); // $ hasTaintFlow=t13.1
}
target("safe", ...source('t13.1'));
}
@@ -167,8 +167,8 @@ function t15() {
function t16() {
let array = new Array(Math.floor(Math.random() * 10))
array.push(source("t16.1"));
sink(array[0]); // $ MISSING: hasValueFlow=t16.1 SPURIOUS: hasTaintFlow=t16.1
sink(array[1]); // $ MISSING: hasValueFlow=t16.1 SPURIOUS: hasTaintFlow=t16.1
sink(array[2]); // $ MISSING: hasValueFlow=t16.1 SPURIOUS: hasTaintFlow=t16.1
sink(array[0]); // $ hasValueFlow=t16.1
sink(array[1]); // $ hasValueFlow=t16.1
sink(array[2]); // $ hasValueFlow=t16.1
sink(array); // $ hasTaintFlow=t16.1
}