hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

add local dataflow to js/template-syntax-in-string-literal

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-10-19 10:56:48 +02:00
parent 7942d7332a
commit 8c44392638
3 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
javascript/ql/src/LanguageFeatures/TemplateSyntaxInStringLiteral.ql
View File

@@ -62,8 +62,8 @@ class CandidateStringLiteral extends StringLiteral {
}
/**
* Holds if `obj` has a property for each template variable in `lit` and they occur as arguments
* to the same call.
* Holds if there exists an object that has a property for each template variable in `lit` and
* they occur as arguments to the same call.
*
* This recognises a typical pattern in which template arguments are passed along with a string,
* for example:
@@ -73,14 +73,14 @@ class CandidateStringLiteral extends StringLiteral {
* { url: url, name: name } );
* ```
*/
predicate providesTemplateVariablesFor(ObjectExpr obj, CandidateStringLiteral lit) {
exists(CallExpr call | call.getAnArgument() = obj and call.getAnArgument() = lit) and
forex(string name | lit.getAReferencedVariable() = name | hasProperty(obj, name))
predicate hasObjectProvidingTemplateVariables(CandidateStringLiteral lit) {
exists(DataFlow::CallNode call, DataFlow::ObjectLiteralNode obj |
call.getAnArgument().getALocalSource() = obj and
call.getAnArgument().asExpr() = lit and
forex(string name | name = lit.getAReferencedVariable() | exists(obj.getAPropertyWrite(name)))
)
}
/** Holds if `object` has a property with the given `name`. */
predicate hasProperty(ObjectExpr object, string name) { name = object.getAProperty().getName() }
/**
* Gets a declaration of variable `v` in `tl`, where `v` has the given `name` and
* belongs to `scope`.
@@ -97,7 +97,7 @@ where
decl = getDeclIn(v, s, name, lit.getTopLevel()) and
lit.getAReferencedVariable() = name and
lit.isInScope(s) and
not exists(ObjectExpr obj | providesTemplateVariablesFor(obj, lit)) and
not hasObjectProvidingTemplateVariables(lit) and
not lit.getStringValue() = "${" + name + "}"
select lit, "This string is not a template literal, but appears to reference the variable $@.",
decl, v.getName()