hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11565 from asgerf/js/rephined-variable-in-access-path

Browse Source 
JS: handle rephined variable in access path
This commit is contained in:
Asger F
2022-12-07 09:26:38 +01:00
committed by GitHub
parent c1c0432c00 80777b8c50
commit afe7872838
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/lib/semmle/javascript/dataflow/internal/AccessPaths.qll
View File

@@ -45,6 +45,8 @@ private PropAccess namedPropAccess(AccessPath base, PropertyName name, BasicBloc
private SsaVariable getRefinedVariable(SsaVariable variable) {
result = variable.getDefinition().(SsaRefinementNode).getAnInput()
or
result = variable.getDefinition().(SsaPhiNode).getRephinedVariable()
}
private SsaVariable getARefinementOf(SsaVariable variable) { variable = getRefinedVariable(result) }

34
javascript/ql/test/library-tests/TaintTracking/refinement-sanitizer.js Normal file
View File

@@ -0,0 +1,34 @@
import * as dummy from 'dummy';
function oneUse() {
let taint = source();
if (!isSafe(taint)) {
return;
}
let array = [];
if (taint) {
array.push(taint);
}
sink(array.join()); // OK
}
function secondUse() {
let taint = source();
if (!isSafe(taint)) {
return;
}
let array = [];
if (taint) {
array.push(taint);
}
if (taint) {
array.push(taint);
}
sink(array.join()); // OK
}