hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 00:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Remove deprecated queries.

Browse Source 
These queries have all been deprecated since 1.17 (released in July 2018). I think it's time to say goodbye.
This commit is contained in:
Max Schaefer
2019-10-21 14:32:58 +01:00
parent 016c95a69c
commit 55fb86d618
67 changed files with 18 additions and 1615 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
javascript/ql/src/StandardLibrary/ParseIntRadix.qhelp
View File

@@ -1,51 +0,0 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>
On some platforms, the builtin function <code>parseInt</code> parses strings starting with the digit
<code>0</code> as octal values (unless an explicit radix is provided). This can lead to unexpected
results when parsing decimal numbers that may be zero-padded, such as dates.
</p>
</overview>
<recommendation>
<p>
Provide an explicit radix as the second parameter to <code>parseInt</code>.
</p>
</recommendation>
<example>
<p>
In the following example, <code>parseInt</code> is used to convert the contents of a field in an HTML
form to a number:
</p>
<sample src="examples/ParseIntRadix.js" />
<p>
Now assume that a user has entered a zero-padded decimal number, say <code>09</code>, into the form.
Since the first digit is a zero, older versions of <code>parseInt</code> interpret this value as an
octal number. When they then encounter <code>9</code> (which is not an octal digit), they will stop
parsing and discard the rest of the string, returning the value <code>0</code>, which is probably not
what was expected.
</p>
<p>
To avoid this problem, an explicit radix parameter should be parsed as follows:
</p>
<sample src="examples/ParseIntRadixGood.js" />
</example>
<references>
<li>D. Crockford, <i>JavaScript: The Good Parts</i>, Appendix A.7. O'Reilly, 2008.</li>
</references>
</qhelp>

21
javascript/ql/src/StandardLibrary/ParseIntRadix.ql
View File

@@ -1,21 +0,0 @@
/**
* @name Call to parseInt without radix
* @description Calls to the 'parseInt' function should always specify a radix to avoid accidentally
* parsing a number as octal.
* @kind problem
* @problem.severity recommendation
* @id js/parseint-without-radix
* @tags reliability
* maintainability
* external/cwe/cwe-676
* @precision very-high
* @deprecated This is no longer a problem with modern browsers. Deprecated since 1.17.
*/
import javascript
from DataFlow::CallNode parseInt
where
parseInt = DataFlow::globalVarRef("parseInt").getACall() and
parseInt.getNumArgument() = 1
select parseInt, "Missing radix parameter."