mirror of
https://github.com/github/codeql.git
synced 2026-04-28 02:05:14 +02:00
JavaScript: Simplify a few helper predicates.
This commit is contained in:
@@ -422,19 +422,19 @@ private predicate basicFlowStep(DataFlow::Node pred, DataFlow::Node succ, PathSu
|
||||
or
|
||||
// Flow through properties of objects
|
||||
propertyFlowStep(pred, succ) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
// Flow through global variables
|
||||
globalFlowStep(pred, succ) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
// Flow into function
|
||||
callStep(pred, succ) and
|
||||
summary = PathSummary::call(true)
|
||||
summary = PathSummary::call()
|
||||
or
|
||||
// Flow out of function
|
||||
returnStep(pred, succ) and
|
||||
summary = PathSummary::return(true)
|
||||
summary = PathSummary::return()
|
||||
)
|
||||
}
|
||||
|
||||
@@ -540,7 +540,7 @@ private predicate reachableFromInput(Function f, DataFlow::Node invk,
|
||||
DataFlow::Node input, DataFlow::Node nd,
|
||||
DataFlow::Configuration cfg, PathSummary summary) {
|
||||
callInputStep(f, invk, input, nd, cfg) and
|
||||
summary = PathSummary::empty()
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
exists (DataFlow::Node mid, PathSummary oldSummary, PathSummary newSummary |
|
||||
reachableFromInput(f, invk, input, mid, cfg, oldSummary) and
|
||||
@@ -571,7 +571,7 @@ private predicate flowThroughCall(DataFlow::Node input, DataFlow::Node invk,
|
||||
private predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop,
|
||||
DataFlow::Configuration cfg, PathSummary summary) {
|
||||
basicStoreStep(pred, succ, prop) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
exists (Function f, DataFlow::Node mid, DataFlow::SourceNode base |
|
||||
// `f` stores its parameter `pred` in property `prop` of a value that it returns,
|
||||
@@ -677,7 +677,7 @@ private predicate onPath(DataFlow::Node nd, DataFlow::Configuration cfg,
|
||||
reachableFromSource(nd, cfg, summary1) and
|
||||
isSink(nd, cfg, summary1.getEndLabel()) and
|
||||
not cfg.isBarrier(nd) and
|
||||
summary2 = PathSummary::empty()
|
||||
summary2 = PathSummary::level()
|
||||
or
|
||||
exists (DataFlow::Node mid, PathSummary newSummary, PathSummary oldSummary |
|
||||
onPath(mid, cfg, _, oldSummary) and
|
||||
|
||||
@@ -70,23 +70,23 @@ private module NodeTracking {
|
||||
(
|
||||
// Local flow
|
||||
localFlowStep(pred, succ) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
// Flow through properties of objects
|
||||
propertyFlowStep(pred, succ) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
// Flow through global variables
|
||||
globalFlowStep(pred, succ) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
// Flow into function
|
||||
callStep(pred, succ) and
|
||||
summary = PathSummary::call(true)
|
||||
summary = PathSummary::call()
|
||||
or
|
||||
// Flow out of function
|
||||
returnStep(pred, succ) and
|
||||
summary = PathSummary::return(true)
|
||||
summary = PathSummary::return()
|
||||
)
|
||||
}
|
||||
|
||||
@@ -138,7 +138,7 @@ private module NodeTracking {
|
||||
DataFlow::Node input, DataFlow::Node nd,
|
||||
PathSummary summary) {
|
||||
callInputStep(f, invk, input, nd) and
|
||||
summary = PathSummary::empty()
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
exists (DataFlow::Node mid, PathSummary oldSummary, PathSummary newSummary |
|
||||
reachableFromInput(f, invk, input, mid, oldSummary) and
|
||||
@@ -165,7 +165,7 @@ private module NodeTracking {
|
||||
private predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop,
|
||||
PathSummary summary) {
|
||||
basicStoreStep(pred, succ, prop) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
exists (Function f, DataFlow::Node mid, DataFlow::SourceNode base |
|
||||
// `f` stores its parameter `pred` in property `prop` of a value that it returns,
|
||||
@@ -214,7 +214,7 @@ private module NodeTracking {
|
||||
// Flow through a function that returns a value that depends on one of its arguments
|
||||
// or a captured variable
|
||||
flowThroughCall(pred, succ) and
|
||||
summary = PathSummary::level(true)
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
// Flow through a property write/read pair
|
||||
flowThroughProperty(pred, succ, summary)
|
||||
@@ -226,7 +226,7 @@ private module NodeTracking {
|
||||
*/
|
||||
predicate flowsTo(TrackedNode source, DataFlow::Node nd, PathSummary summary) {
|
||||
source = nd and
|
||||
summary = PathSummary::empty()
|
||||
summary = PathSummary::level()
|
||||
or
|
||||
exists (DataFlow::Node pred, PathSummary oldSummary, PathSummary newSummary |
|
||||
flowsTo(source, pred, oldSummary) and
|
||||
|
||||
@@ -323,47 +323,29 @@ class PathSummary extends TPathSummary {
|
||||
|
||||
module PathSummary {
|
||||
/**
|
||||
* Gets a summary describing an empty path.
|
||||
* Gets a summary describing a path without any calls or returns.
|
||||
*/
|
||||
PathSummary empty() {
|
||||
result = level(true)
|
||||
}
|
||||
|
||||
private PathSummary mkPathSummary(boolean hasCall, boolean hasReturn, Boolean valuePreserving) {
|
||||
exists (FlowLabel start, FlowLabel end |
|
||||
if valuePreserving = false then
|
||||
end = FlowLabel::taint()
|
||||
else
|
||||
start = end
|
||||
|
|
||||
result = MkPathSummary(hasCall, hasReturn, start, end)
|
||||
PathSummary level() {
|
||||
exists (FlowLabel lbl |
|
||||
result = MkPathSummary(false, false, lbl, lbl)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a summary describing a path without any calls or returns.
|
||||
* `valuePreserving` indicates whether the path preserves the value of its
|
||||
* start node or only its taintedness.
|
||||
*/
|
||||
PathSummary level(Boolean valuePreserving) {
|
||||
result = mkPathSummary(false, false, valuePreserving)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a summary describing a path with one or more calls, but no returns.
|
||||
* `valuePreserving` indicates whether the path preserves the value of its
|
||||
* start node or only its taintedness.
|
||||
*/
|
||||
PathSummary call(Boolean valuePreserving) {
|
||||
result = mkPathSummary(false, true, valuePreserving)
|
||||
PathSummary call() {
|
||||
exists (FlowLabel lbl |
|
||||
result = MkPathSummary(false, true, lbl, lbl)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a summary describing a path with one or more returns, but no calls.
|
||||
* `valuePreserving` indicates whether the path preserves the value of its
|
||||
* start node or only its taintedness.
|
||||
*/
|
||||
PathSummary return(Boolean valuePreserving) {
|
||||
result = mkPathSummary(true, false, valuePreserving)
|
||||
PathSummary return() {
|
||||
exists (FlowLabel lbl |
|
||||
result = MkPathSummary(true, false, lbl, lbl)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user