hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 16:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix one case of missing handling of unknown array index

Browse Source
This commit is contained in:
Asger F
2024-09-05 12:01:25 +02:00
parent 379c7ef20a
commit a9a8351cce
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll
View File

@@ -1173,7 +1173,11 @@ predicate readStep(Node node1, ContentSet c, Node node2) {
then
c = ContentSet::arrayElement() and // unknown start index when not the first spread operator
storeContent.isUnknownArrayElement()
else storeContent.asArrayIndex() = n + c.asArrayIndex()
else (
storeContent.asArrayIndex() = n + c.asArrayIndex()
or
storeContent.isUnknownArrayElement() and c.asSingleton() = storeContent
)
)
or
exists(FlowSummaryNode parameter, ParameterPosition pos |

8
javascript/ql/test/library-tests/TripleDot/tst.js
View File

@@ -153,10 +153,10 @@ function t14() {
function t15() {
function target(safe, x, y, ...rest) {
sink(safe); // $ SPURIOUS: hasTaintFlow=t15.1
sink(x); // $ MISSING: hasValueFlow=t15.1 SPURIOUS: hasTaintFlow=t15.1
sink(y); // $ MISSING: hasValueFlow=t15.1 SPURIOUS: hasTaintFlow=t15.1
sink(rest.pop()); // $ MISSING: hasValueFlow=t15.1 SPURIOUS: hasTaintFlow=t15.1
sink(safe); // $ SPURIOUS: hasValueFlow=t15.1
sink(x); // $ hasValueFlow=t15.1
sink(y); // $ hasValueFlow=t15.1
sink(rest.pop()); // $ hasValueFlow=t15.1
sink(rest); // $ hasTaintFlow=t15.1
}
const args = new Array(Math.floor(Math.random() * 10));