hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Exclude methods declared private/protected

Browse Source
This commit is contained in:
Asger Feldthaus
2021-10-01 11:46:32 +02:00
parent af1b04de9c
commit 600e5bad0d
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
javascript/ql/lib/semmle/javascript/PackageExports.qll
View File

@@ -45,7 +45,8 @@ private DataFlow::Node getAValueExportedByPackage() {
|
result = callee.getAPropertyRead("prototype").getAPropertyWrite(publicPropertyName()).getRhs()
or
result = callee.(DataFlow::ClassNode).getInstanceMethod(publicPropertyName())
result = callee.(DataFlow::ClassNode).getInstanceMethod(publicPropertyName()) and
not isPrivateMethodDeclaration(result)
)
or
result = getAValueExportedByPackage().getALocalSource()
@@ -65,7 +66,10 @@ private DataFlow::Node getAValueExportedByPackage() {
// static baz() {} // <- result
// constructor() {} // <- result
// };
exists(DataFlow::ClassNode cla | cla = getAValueExportedByPackage() |
exists(DataFlow::ClassNode cla |
cla = getAValueExportedByPackage() and
not isPrivateMethodDeclaration(result)
|
result = cla.getInstanceMethod(publicPropertyName()) or
result = cla.getStaticMethod(publicPropertyName()) or
result = cla.getConstructor()
@@ -185,3 +189,17 @@ bindingset[result]
private string publicPropertyName() {
result.regexpMatch("[a-zA-Z0-9].*")
}
/**
* Holds if the given function is part of a private (or protected) method declaration.
*/
private predicate isPrivateMethodDeclaration(DataFlow::FunctionNode func) {
exists(MethodDeclaration decl |
decl.getBody() = func.getFunction() and
(
decl.isPrivate()
or
decl.isProtected()
)
)
}