hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: support flow out of "this" in constructor call

Browse Source
This commit is contained in:
Asger F
2019-01-11 12:50:59 +00:00
parent 370a9e491c
commit 6d1eab8a4b
5 changed files with 63 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
View File

@@ -1,4 +1,10 @@
| advanced-callgraph.js:2:13:2:20 | source() | advanced-callgraph.js:6:22:6:22 | v |
| constructor-calls.js:4:18:4:25 | source() | constructor-calls.js:18:8:18:14 | c.taint |
| constructor-calls.js:4:18:4:25 | source() | constructor-calls.js:22:8:22:19 | c_safe.taint |
| constructor-calls.js:10:16:10:23 | source() | constructor-calls.js:26:8:26:14 | d.taint |
| constructor-calls.js:10:16:10:23 | source() | constructor-calls.js:30:8:30:19 | d_safe.taint |
| constructor-calls.js:14:15:14:22 | source() | constructor-calls.js:17:8:17:14 | c.param |
| constructor-calls.js:14:15:14:22 | source() | constructor-calls.js:25:8:25:14 | d.param |
| partialCalls.js:4:17:4:24 | source() | partialCalls.js:17:14:17:14 | x |
| partialCalls.js:4:17:4:24 | source() | partialCalls.js:20:14:20:14 | y |
| partialCalls.js:4:17:4:24 | source() | partialCalls.js:30:14:30:20 | x.value |

31
javascript/ql/test/library-tests/TaintTracking/constructor-calls.js Normal file
View File

@@ -0,0 +1,31 @@
class EcmaClass {
constructor(param) {
this.param = param;
this.taint = source();
}
}
function JsClass(param) {
this.param = param;
this.taint = source();
}
function test() {
let taint = source();
let c = new EcmaClass(taint);
sink(c.param); // NOT OK
sink(c.taint); // NOT OK
let c_safe = new EcmaClass("safe");
sink(c_safe.param); // OK
sink(c_safe.taint); // NOT OK
let d = new JsClass(taint);
sink(d.param); // NOT OK
sink(d.taint); // NOT OK
let d_safe = new JsClass("safe");
sink(d_safe.param); // OK
sink(d_safe.taint); // NOT OK
}