hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Fix performance regression in IncorrectSuffixCheck.

Browse Source
This commit is contained in:
Max Schaefer
2019-01-02 10:23:16 +00:00
parent 5ac5aa0c2a
commit a9844b2eda
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
javascript/ql/src/Security/CWE-020/IncorrectSuffixCheck.ql
View File

@@ -78,17 +78,21 @@ predicate isDerivedFromLength(DataFlow::Node length, DataFlow::Node operand) {
exists (IndexOfCall call | operand = call.getAnOperand() |
length = getStringSource(operand).getAPropertyRead("length")
or
// Find a literal length with the same string constant
exists (LiteralLengthExpr lengthExpr |
lengthExpr.getContainer() = call.getContainer() and
lengthExpr.getBaseValue() = operand.asExpr().getStringValue() and
length = lengthExpr.flow())
or
// Find an integer constants that equals the length of string constant
exists (Expr lengthExpr |
lengthExpr.getContainer() = call.getContainer() and
lengthExpr.getIntValue() = operand.asExpr().getStringValue().length() and
length = lengthExpr.flow())
exists (string val | val = operand.asExpr().getStringValue() |
// Find a literal length with the same string constant
exists (LiteralLengthExpr lengthExpr |
lengthExpr.getContainer() = call.getContainer() and
lengthExpr.getBaseValue() = val and
length = lengthExpr.flow()
)
or
// Find an integer constant that equals the length of string constant
exists (Expr lengthExpr |
lengthExpr.getContainer() = call.getContainer() and
lengthExpr.getIntValue() = val.length() and
length = lengthExpr.flow()
)
)
)
or
isDerivedFromLength(length.getAPredecessor(), operand)