JS: Update to match changes to API

This commit is contained in:
Asger F
2024-05-06 10:12:15 +02:00
parent 19f14622f3
commit 5a2260b481
3 changed files with 17 additions and 1 deletions

View File

@@ -10,6 +10,8 @@ private import semmle.javascript.internal.flow_summaries.AllFlowSummaries
private import sharedlib.FlowSummaryImpl as FlowSummaryImpl
private import semmle.javascript.dataflow.internal.BarrierGuards
class DataFlowSecondLevelScope = Unit;
private class Node = DataFlow::Node;
class PostUpdateNode = DataFlow::PostUpdateNode;
@@ -701,7 +703,7 @@ DataFlowCallable viableCallable(DataFlowCall node) {
* Holds if the set of viable implementations that can be called by `call`
* might be improved by knowing the call context.
*/
predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c) { none() }
predicate mayBenefitFromCallContext(DataFlowCall call) { none() }
/**
* Gets a viable dispatch target of `call` in the context `ctx`. This is
@@ -780,6 +782,14 @@ private predicate valuePreservingStep(Node node1, Node node2) {
)
}
predicate knownSourceModel(Node sink, string model) { none() }
predicate knownSinkModel(Node sink, string model) { none() }
predicate simpleLocalFlowStep(Node node1, Node node2, string model) {
simpleLocalFlowStep(node1, node2) and model = ""
}
predicate simpleLocalFlowStep(Node node1, Node node2) {
valuePreservingStep(node1, node2) and
nodeGetEnclosingCallable(pragma[only_bind_out](node1)) =

View File

@@ -19,6 +19,10 @@ predicate defaultAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2)
ContentSet::arrayElement(), node2.(FlowSummaryNode).getSummaryNode())
}
predicate defaultAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2, string model) {
defaultAdditionalTaintStep(node1, node2) and model = "" // TODO: set model
}
private class SanitizerGuardAdapter extends DataFlow::Node instanceof TaintTracking::AdditionalSanitizerGuardNode
{
// Note: avoid depending on DataFlow::FlowLabel here as it will cause these barriers to be re-evaluated

View File

@@ -15,6 +15,8 @@ module JSDataFlow implements SharedDataFlow::InputSig<Location> {
predicate accessPathLimit = Private::accessPathLimit/0;
predicate viableImplInCallContext = Private::viableImplInCallContext/2;
predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
}
module JSTaintFlow implements SharedTaintTracking::InputSig<Location, JSDataFlow> {