hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 12:45:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

revert Array.from change

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-03-09 17:09:31 +01:00
parent 68ffd52d4c
commit a476fc5c3b
3 changed files with 7 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
View File

@@ -598,23 +598,18 @@ class ArrayConstructorInvokeNode extends DataFlow::InvokeNode {
* new Array('apple', 'orange')
* Array(16)
* new Array(16)
* Array.from(1,2,3);
* ```
*/
class ArrayCreationNode extends DataFlow::ValueNode, DataFlow::SourceNode {
ArrayCreationNode() {
this instanceof ArrayLiteralNode or
this instanceof ArrayConstructorInvokeNode or
this = DataFlow::globalVarRef("Array").getAPropertyRead("from").getACall()
this instanceof ArrayConstructorInvokeNode
}
/** Gets the `i`th initial element of this array, if one is provided. */
DataFlow::ValueNode getElement(int i) {
result = this.(ArrayLiteralNode).getElement(i) or
result = this.(ArrayConstructorInvokeNode).getElement(i) or
exists(DataFlow::CallNode call | call.getCalleeName() = "from" and call = this |
result = call.getArgument(i)
)
result = this.(ArrayConstructorInvokeNode).getElement(i)
}
/** Gets an initial element of this array, if one if provided. */
@@ -623,10 +618,7 @@ class ArrayCreationNode extends DataFlow::ValueNode, DataFlow::SourceNode {
/** Gets the initial size of the created array, if it can be determined. */
int getSize() {
result = this.(ArrayLiteralNode).getSize() or
result = this.(ArrayConstructorInvokeNode).getSize() or
exists(DataFlow::CallNode call | call.getCalleeName() = "from" and call = this |
result = call.getNumArgument()
)
result = this.(ArrayConstructorInvokeNode).getSize()
}
}

4
javascript/ql/test/library-tests/Arrays/DataFlow.expected
View File

@@ -4,10 +4,10 @@
| arrays.js:2:16:2:23 | "source" | arrays.js:16:23:16:23 | e |
| arrays.js:2:16:2:23 | "source" | arrays.js:20:8:20:16 | arr.pop() |
| arrays.js:18:22:18:29 | "source" | arrays.js:18:50:18:50 | e |
| arrays.js:22:25:22:32 | "source" | arrays.js:23:8:23:17 | arr2.pop() |
| arrays.js:22:15:22:22 | "source" | arrays.js:23:8:23:17 | arr2.pop() |
| arrays.js:25:15:25:22 | "source" | arrays.js:26:8:26:17 | arr3.pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:30:8:30:17 | arr4.pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:33:8:33:17 | arr5.pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:35:8:35:26 | arr5.slice(2).pop() |
| arrays.js:29:21:29:28 | "source" | arrays.js:41:8:41:17 | arr6.pop() |
| arrays.js:44:14:44:21 | "source" | arrays.js:45:10:45:18 | ary.pop() |
| arrays.js:44:4:44:11 | "source" | arrays.js:45:10:45:18 | ary.pop() |

4
javascript/ql/test/library-tests/Arrays/arrays.js
View File

@@ -19,7 +19,7 @@
sink(arr.pop()); // NOT OK
var arr2 = Array.from("source");
var arr2 = ["source"];
sink(arr2.pop()); // NOT OK
var arr3 = ["source"];
@@ -41,7 +41,7 @@
sink(arr6.pop()); // NOT OK
Array.from("source").forEach((e, i, ary) => {
["source"].forEach((e, i, ary) => {
sink(ary.pop()); // NOT OK
sink(ary); // OK - its the array itself, not an element.
})