JS: Explain false positive in test case

This commit is contained in:
Asger F
2024-10-08 09:04:06 +02:00
parent e05e077b33
commit bd94fe1574

View File

@@ -163,6 +163,8 @@ function t9() { // same as t8 but with a SanitizerGuard that isn't just a variab
}
if (typeof obj === "undefined" || typeof obj === "undefined") {
// The shared SSA library expects short-circuiting operators be pre-order in the CFG,
// but in JS they are post-order (as per evaluation order).
sink(obj.field); // $ SPURIOUS: hasTaintFlow=t9.1
} else {
sink(obj.field); // $ hasTaintFlow=t9.1