hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: fix false positives for splice with conditional index decrement

Browse Source
This commit is contained in:
Napalys Klicius
2025-06-12 14:51:10 +02:00
parent 7292a76ee4
commit 66d66fe87d
3 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/src/Statements/LoopIterationSkippedDueToShifting.ql
View File

@@ -146,7 +146,12 @@ class ArrayIterationLoop extends ForStmt {
or
this.hasPathThrough(splice, cfg.getAPredecessor()) and
this.getLoopEntry().dominates(cfg.getBasicBlock()) and
not this.hasIndexingManipulation(cfg)
not this.hasIndexingManipulation(cfg) and
// Don't continue through a branch that tests the splice call's return value
not exists(ConditionGuardNode guard | cfg = guard |
guard.getTest() = splice.asExpr() and
guard.getOutcome() = false
)
}
}

3
javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/LoopIterationSkippedDueToShifting.expected
View File

@@ -2,5 +2,4 @@
| tst.js:13:29:13:46 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
| tst.js:24:9:24:26 | parts.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
| tst.js:128:11:128:33 | pending ... e(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
| tst.js:136:32:136:47 | toc.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
| tst.js:143:10:143:25 | toc.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |
| tst.js:153:11:153:26 | toc.splice(i, 1) | Removing an array item without adjusting the loop index 'i' causes the subsequent array item to be skipped. |

14
javascript/ql/test/query-tests/Statements/LoopIterationSkippedDueToShifting/tst.js
View File

@@ -133,16 +133,26 @@ function withTryCatch(pendingCSS) {
function andOperand(toc) {
for (let i = 0; i < toc.length; i++) {
toc[i].ignoreSubHeading && toc.splice(i, 1) && i--; // $ SPURIOUS:Alert
toc[i].ignoreSubHeading && toc.splice(i, 1) && i--;
}
}
function ifStatement(toc) {
for (let i = 0; i < toc.length; i++) {
if(toc[i].ignoreSubHeading){
if(toc.splice(i, 1)){ // $ SPURIOUS:Alert
if(toc.splice(i, 1)){
i--;
}
}
}
}
function ifStatement2(toc) {
for (let i = 0; i < toc.length; i++) {
if(toc[i].ignoreSubHeading){
if(!toc.splice(i, 1)){ // $Alert
i--;
}
}
}
}