hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

recognize more module exports from the factory pattern

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-02-23 21:29:45 +01:00
parent 7d55771092
commit ad3399733b
5 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/lib/semmle/javascript/PackageExports.qll
View File

@@ -120,14 +120,21 @@ private DataFlow::Node getAValueExportedByPackage() {
exists(ImmediatelyInvokedFunctionExpr func, DataFlow::ParameterNode prev, int i |
prev.getName() = "factory" and
func.getParameter(i) = prev.getParameter() and
result = func.getInvocation().getArgument(i).flow().getAFunctionValue().getAReturn() and
DataFlow::globalVarRef("define").getACall().getArgument(1) = prev.getALocalUse() and
DataFlow::globalVarRef("define").getACall().getArgument(any(int a | a >= 1)) =
prev.getALocalUse() and
func.getFile() =
min(int j, File f |
f = NodeModule::resolveMainModule(any(PackageJSON pack | exists(pack.getPackageName())), j)
|
f order by j
)
|
result = func.getInvocation().getArgument(i).flow().getAFunctionValue().getAReturn()
or
exists(DataFlow::ParameterNode exports | exports.getName() = "exports" |
exports = func.getInvocation().getAnArgument().flow().getAFunctionValue().getParameter(0) and
result = exports.getAPropertyWrite().getRhs()
)
)
or
// the exported value is a call to a unique callee