mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
JS: Remove special treatment of strings in AngularJS code
String literals are already SourceNodes. But we need to add template literals as well
This commit is contained in:
@@ -334,6 +334,7 @@ module SourceNode {
|
||||
astNode instanceof Templating::PipeRefExpr or
|
||||
astNode instanceof Templating::TemplateVarRefExpr or
|
||||
astNode instanceof StringLiteral or
|
||||
astNode instanceof TemplateLiteral or
|
||||
astNode instanceof TypeAssertion or
|
||||
astNode instanceof SatisfiesExpr
|
||||
)
|
||||
|
||||
@@ -23,46 +23,6 @@ DataFlow::SourceNode angular() {
|
||||
result = DataFlow::moduleImport("angular")
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `tl` appears to be a top-level using the AngularJS library.
|
||||
*
|
||||
* Should not depend on the `SourceNode` class.
|
||||
*/
|
||||
pragma[nomagic]
|
||||
private predicate isAngularTopLevel(TopLevel tl) {
|
||||
exists(Import imprt |
|
||||
imprt.getTopLevel() = tl and
|
||||
imprt.getImportedPathString() = "angular"
|
||||
)
|
||||
or
|
||||
exists(GlobalVarAccess global |
|
||||
global.getName() = "angular" and
|
||||
global.getTopLevel() = tl
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `s` is a string in a top-level using the AngularJS library.
|
||||
*
|
||||
* Should not depend on the `SourceNode` class.
|
||||
*/
|
||||
pragma[nomagic]
|
||||
private predicate isAngularString(Expr s) {
|
||||
isAngularTopLevel(s.getTopLevel()) and
|
||||
(
|
||||
s instanceof StringLiteral or
|
||||
s instanceof TemplateLiteral
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* String literals in Angular code are often used as identifiers or references, so we
|
||||
* want to track them.
|
||||
*/
|
||||
private class TrackStringsInAngularCode extends DataFlow::SourceNode::Range, DataFlow::ValueNode {
|
||||
TrackStringsInAngularCode() { isAngularString(astNode) }
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `m` is of the form `angular.module("name", ...)`.
|
||||
*/
|
||||
|
||||
Reference in New Issue
Block a user