hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: use type inference to back up function-style classes

Browse Source
This commit is contained in:
Asger F
2019-02-08 16:36:47 +00:00
parent 0558b58193
commit 74a9c4b500
4 changed files with 25 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
View File

@@ -719,8 +719,15 @@ module ClassNode {
*/
class FunctionStyleClass extends Range, DataFlow::ValueNode {
override Function astNode;
AbstractFunction function;
FunctionStyleClass() { exists(getAPropertyReference("prototype")) }
FunctionStyleClass() {
function.getFunction() = astNode and
exists (DataFlow::PropRef read |
read.getPropertyName() = "prototype" and
read.getBase().analyze().getAValue() = function
)
}
override string getName() { result = astNode.getName() }
@@ -771,14 +778,16 @@ module ClassNode {
/**
* Gets a reference to the prototype of this class.
*/
private DataFlow::SourceNode getAPrototypeReference() {
result = getAPropertyRead("prototype")
or
result = getAPropertySource("prototype")
or
exists(ExtendCall call |
call.getDestinationOperand() = getAPropertyRead("prototype") and
result = call.getASourceOperand()
DataFlow::SourceNode getAPrototypeReference() {
exists (DataFlow::SourceNode base | base.analyze().getAValue() = function |
result = base.getAPropertyRead("prototype")
or
result = base.getAPropertySource("prototype")
or
exists(ExtendCall call |
call.getDestinationOperand() = base.getAPropertyRead("prototype") and
result = call.getASourceOperand()
)
)
}