hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #18005 from Napalys/napalys/ES2022-find-functions

Browse Source 
JS: Added support for Array.prototype.[findLastIndex, findLast] ES2022 feature
This commit is contained in:
Napalys Klicius
2024-11-21 08:01:19 +01:00
committed by GitHub
parent 596cfcfb42 64c45debdb
commit 82ca369dce
11 changed files with 734 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/lib/change-notes/2024-11-18-ES2022-find-functions.md Normal file
View File

@@ -0,0 +1,5 @@
---
category: minorAnalysis
---
* Added taint-steps for `Array.prototype.findLast`
* Added taint-steps for `Array.prototype.findLastIndex`

31
javascript/ql/lib/semmle/javascript/Arrays.qll
View File

@@ -384,10 +384,10 @@ private module ArrayLibraries {
}
/**
* Gets a call to `Array.prototype.find` or a polyfill implementing the same functionality.
* Gets a call to `Array.prototype.find` or `Array.prototype.findLast` or a polyfill implementing the same functionality.
*/
DataFlow::CallNode arrayFindCall(DataFlow::Node array) {
result.(DataFlow::MethodCallNode).getMethodName() = "find" and
result.(DataFlow::MethodCallNode).getMethodName() in ["find", "findLast"] and
array = result.getReceiver()
or
result = DataFlow::moduleImport(["array.prototype.find", "array-find"]).getACall() and
@@ -483,4 +483,31 @@ private module ArrayLibraries {
)
}
}
/**
* Defines a data flow step that tracks the flow of data through callback functions in arrays.
*/
private class ArrayCallBackDataFlowStep extends PreCallGraphStep {
override predicate loadStep(DataFlow::Node obj, DataFlow::Node element, string prop) {
exists(DataFlow::MethodCallNode call |
call.getMethodName() = ["findLast", "find", "findLastIndex"] and
prop = arrayLikeElement() and
obj = call.getReceiver() and
element = call.getCallback(0).getParameter(0)
)
}
}
/**
* This step models the propagation of data from the array to the callback function's parameter.
*/
private class ArrayCallBackDataTaintStep extends TaintTracking::SharedTaintStep {
override predicate step(DataFlow::Node obj, DataFlow::Node element) {
exists(DataFlow::MethodCallNode call |
call.getMethodName() = ["findLast", "find", "findLastIndex"] and
obj = call.getReceiver() and
element = call.getCallback(0).getParameter(0)
)
}
}
}