hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix: Ensure toSpliced with spread operator is flagged

Browse Source
This commit is contained in:
Napalys
2024-11-13 17:21:34 +01:00
parent 8512cb44ff
commit 84234d59b9
3 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
javascript/ql/lib/semmle/javascript/Arrays.qll
View File

@@ -90,6 +90,11 @@ module ArrayTaintTracking {
pred = call.getASpreadArgument() and
succ.(DataFlow::SourceNode).getAMethodCall("splice") = call
or
// `array.toSpliced(i, del, ...e)`: if `e` is tainted, then so is the result of `toSpliced`, but not the original array.
pred = call.getASpreadArgument() and
call.(DataFlow::MethodCallNode).getMethodName() = "toSpliced" and
succ = call
or
// `e = array.pop()`, `e = array.shift()`, or similar: if `array` is tainted, then so is `e`.
call.(DataFlow::MethodCallNode)
.calls(pred, ["pop", "shift", "slice", "splice", "at", "toSpliced"]) and