hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-11 20:51:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add back CallReceiverStep() restriction

Browse Source 
This was initially lost after rebasing with indentation changes
This commit is contained in:
Asger F
2025-10-06 11:39:54 +02:00
parent 825c08356f
commit a6dfb8351c
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/lib/semmle/javascript/ApiGraphs.qll
View File

@@ -1371,7 +1371,9 @@ module API {
exists(DataFlow::TypeTracker t, StepSummary summary, DataFlow::SourceNode prev |
prev = trackUseNode(nd, promisified, boundArgs, prop, t) and
StepSummary::step(prev, res, summary) and
result = t.append(summary)
result = t.append(summary) and
// Block argument-passing into 'this' when it determines the call target
not summary = CallReceiverStep()
)
}
@@ -1434,7 +1436,9 @@ module API {
exists(DataFlow::TypeBackTracker t, StepSummary summary, DataFlow::Node next |
next = trackDefNode(nd, t) and
StepSummary::step(prev, next, summary) and
result = t.prepend(summary)
result = t.prepend(summary) and
// Block argument-passing into 'this' when it determines the call target
not summary = CallReceiverStep()
)
}