diff --git a/javascript/ql/lib/semmle/javascript/dataflow/FlowSummary.qll b/javascript/ql/lib/semmle/javascript/dataflow/FlowSummary.qll index c4a6e12b210..eb7160683a7 100644 --- a/javascript/ql/lib/semmle/javascript/dataflow/FlowSummary.qll +++ b/javascript/ql/lib/semmle/javascript/dataflow/FlowSummary.qll @@ -17,10 +17,10 @@ private import semmle.javascript.dataflow.internal.DataFlowPrivate * * - The relevant call sites cannot be matched by the access path syntax, and require the full power of CodeQL. * For example, complex overloading patterns might require more local reasoning at the call site. - * - The input/output behaviour cannot be described statically in the access path syntax, but the relevant access paths + * - The input/output behavior cannot be described statically in the access path syntax, but the relevant access paths * can be generated dynamically in CodeQL, based on the usages found in the codebase. * - * Subclasses should bind `this` to a unique identifier for the function being modelled. There is no special + * Subclasses should bind `this` to a unique identifier for the function being modeled. There is no special * interpreation of the `this` value, it should just not clash with the `this`-value used by other classes. * * For example, this models flow through calls such as `require("my-library").myFunction()`: diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll index 0af57ec0186..6dd0ebf0bb1 100644 --- a/javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll +++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll @@ -386,34 +386,35 @@ module MakeStateBarrierGuard< */ private class BarrierGuardFunction extends FinalFunction { DataFlow::ParameterNode sanitizedParameter; - BarrierGuard guard; boolean guardOutcome; FlowState state; int paramIndex; BarrierGuardFunction() { - barrierGuardIsRelevant(guard) and - exists(Expr e | - exists(Expr returnExpr | - returnExpr = guard.asExpr() - or - // ad hoc support for conjunctions: - getALogicalAndParent(guard) = returnExpr and guardOutcome = true - or - // ad hoc support for disjunctions: - getALogicalOrParent(guard) = returnExpr and guardOutcome = false - | - exists(SsaExplicitDefinition ssa | - ssa.getDef().getSource() = returnExpr and - ssa.getVariable().getAUse() = this.getAReturnedExpr() - ) - or - returnExpr = this.getAReturnedExpr() + exists(BarrierGuard guard | + barrierGuardIsRelevant(guard) and + exists(Expr e | + exists(Expr returnExpr | + returnExpr = guard.asExpr() + or + // ad hoc support for conjunctions: + getALogicalAndParent(guard) = returnExpr and guardOutcome = true + or + // ad hoc support for disjunctions: + getALogicalOrParent(guard) = returnExpr and guardOutcome = false + | + exists(SsaExplicitDefinition ssa | + ssa.getDef().getSource() = returnExpr and + ssa.getVariable().getAUse() = this.getAReturnedExpr() + ) + or + returnExpr = this.getAReturnedExpr() + ) and + sanitizedParameter.flowsToExpr(e) and + barrierGuardBlocksExpr(guard, guardOutcome, e, state) ) and - sanitizedParameter.flowsToExpr(e) and - barrierGuardBlocksExpr(guard, guardOutcome, e, state) - ) and - sanitizedParameter.getParameter() = this.getParameter(paramIndex) + sanitizedParameter.getParameter() = this.getParameter(paramIndex) + ) } /** diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll index dd3bf4770cb..1a4051ccdf6 100644 --- a/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll +++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll @@ -674,7 +674,7 @@ predicate neverSkipInPathGraph(Node node) { // Include the return-value expression node.asExpr() = any(Function f).getAReturnedExpr() or - // Include calls (which may have been modelled as steps) + // Include calls (which may have been modeled as steps) node.asExpr() instanceof InvokeExpr or // Include references to a variable @@ -1103,7 +1103,7 @@ private predicate legacyBarrier(DataFlow::Node node) { pragma[nomagic] private predicate isBlockedLegacyNode(Node node) { // Ignore captured variable nodes for those variables that are handled by the captured-variable library. - // Note that some variables, such as top-level variables, are still modelled with these nodes (which will result in jump steps). + // Note that some variables, such as top-level variables, are still modeled with these nodes (which will result in jump steps). exists(LocalVariable variable | node = TCapturedVariableNode(variable) and variable = any(VariableCaptureConfig::CapturedVariable v).asLocalVariable() diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableCapture.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableCapture.qll index 9e49b41052e..8edacdc2f0f 100644 --- a/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableCapture.qll +++ b/javascript/ql/lib/semmle/javascript/dataflow/internal/VariableCapture.qll @@ -170,7 +170,7 @@ module VariableCaptureConfig implements InputSig x.split('#') [array element 1] [taint] // - // Technically we should also preverse tainted-url-suffix when entering the first array element of such + // Technically we should also preserve tainted-url-suffix when entering the first array element of such // a split, but this mostly leads to FPs since we currently don't track if the taint has been through URI-decoding. // (The query/fragment parts are often URI-decoded in practice, but not the other URL parts are not) state1.isTaintedUrlSuffix() and diff --git a/javascript/ql/src/Declarations/UnreachableMethodOverloads.ql b/javascript/ql/src/Declarations/UnreachableMethodOverloads.ql index 912d58ab54c..0088af1a2c0 100644 --- a/javascript/ql/src/Declarations/UnreachableMethodOverloads.ql +++ b/javascript/ql/src/Declarations/UnreachableMethodOverloads.ql @@ -46,9 +46,7 @@ string getKind(MemberDeclaration m) { * A call-signature that originates from a MethodSignature in the AST. */ private class MethodCallSig extends Function { - private MethodSignature signature; - - MethodCallSig() { this = signature.getBody() } + MethodCallSig() { this = any(MethodSignature signature).getBody() } int getNumOptionalParameter() { result = count(Parameter p | p = this.getParameter(_) and p.isDeclaredOptional()) diff --git a/javascript/ql/test/library-tests/FlowSummary/test.ql b/javascript/ql/test/library-tests/FlowSummary/test.ql index e8ca23a423c..0e40dcdadb0 100644 --- a/javascript/ql/test/library-tests/FlowSummary/test.ql +++ b/javascript/ql/test/library-tests/FlowSummary/test.ql @@ -8,7 +8,7 @@ DataFlow::CallNode getACall(string name) { result.getCalleeNode().getALocalSource() = DataFlow::globalVarRef(name) } -module ConfigArg implements DataFlow::ConfigSig { +module FlowConfig implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node node) { node = getACall("source") } predicate isSink(DataFlow::Node node) { node = getACall("sink").getAnArgument() } @@ -19,7 +19,7 @@ module ConfigArg implements DataFlow::ConfigSig { } } -module Configuration = DataFlow::Global; +module Flow = DataFlow::Global; class BasicBarrierGuard extends DataFlow::CallNode { BasicBarrierGuard() { this = getACall("isSafe") } @@ -32,5 +32,5 @@ class BasicBarrierGuard extends DataFlow::CallNode { deprecated class ConsistencyConfig extends ConsistencyConfiguration { ConsistencyConfig() { this = "ConsistencyConfig" } - override DataFlow::Node getAnAlert() { Configuration::flow(_, result) } + override DataFlow::Node getAnAlert() { Flow::flow(_, result) } }