hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 16:25:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: introduce CallToObjectDefineProperty::getAPropertyAttribute

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2019-03-11 09:35:35 +01:00
parent ff5b85067a
commit bd7eef08e8
6 changed files with 30 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
javascript/ql/src/Expressions/ExprHasNoEffect.ql
View File

@@ -35,13 +35,20 @@ predicate isDeclaration(Expr e) {
* Holds if there exists a getter for a property called `name` anywhere in the program.
*/
predicate isGetterProperty(string name) {
// there is a call of the form `Object.defineProperty(..., name, { get: ..., ... })`
// or `Object.defineProperty(..., name, <something that's not an object literal>)`
// there is a call of the form `Object.defineProperty(..., name, descriptor)` ...
exists(CallToObjectDefineProperty defProp |
name = defProp.getPropertyName() and
exists(Expr descriptor | descriptor = defProp.getPropertyDescriptor().asExpr() |
exists(descriptor.(ObjectExpr).getPropertyByName("get")) or
not descriptor instanceof ObjectExpr
name = defProp.getPropertyName() |
// ... where `descriptor` defines a getter
defProp.getAPropertyAttribute().getPropertyName() = "get" or
// ... where `descriptor` may define a getter
exists (DataFlow::SourceNode descriptor |
descriptor.flowsTo(defProp.getPropertyDescriptor()) |
descriptor.isIncomplete(_) or
// minimal escape analysis for the descriptor
exists (DataFlow::InvokeNode invk |
not invk = defProp and
descriptor.flowsTo(invk.getAnArgument())
)
)
)
or