hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 08:43:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix bad join in BarrierGuards.qll

Browse Source
This commit is contained in:
Asger F
2025-11-11 14:47:20 +01:00
parent 578355ac27
commit c7341f295d
1 changed files with 9 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll
View File

@@ -358,25 +358,18 @@ module MakeStateBarrierGuard<
} }
/** /**
* Gets a logical `and` expression, or parenthesized expression, that contains `guard`. * Gets any of the ancestors of `guard` that preserves the value of `possibleOutcome`. Includes the guard itself.
*/ */
private Expr getALogicalAndParent(BarrierGuard guard) { private Expr getALogicalOperatorParent(BarrierGuard guard, boolean possibleOutcome) {
barrierGuardIsRelevant(guard) and result = guard.asExpr() barrierGuardIsRelevant(guard) and result = guard.asExpr() and possibleOutcome = [true, false]
or or
result.(LogAndExpr).getAnOperand() = getALogicalAndParent(guard) result.(LogOrExpr).getAnOperand() = getALogicalOperatorParent(guard, possibleOutcome) and
possibleOutcome = false
or or
result.getUnderlyingValue() = getALogicalAndParent(guard) result.(LogAndExpr).getAnOperand() = getALogicalOperatorParent(guard, possibleOutcome) and
} possibleOutcome = true
/**
* Gets a logical `or` expression, or parenthesized expression, that contains `guard`.
*/
private Expr getALogicalOrParent(BarrierGuard guard) {
barrierGuardIsRelevant(guard) and result = guard.asExpr()
or or
result.(LogOrExpr).getAnOperand() = getALogicalOrParent(guard) result.getUnderlyingValue() = getALogicalOperatorParent(guard, possibleOutcome)
or
result.getUnderlyingValue() = getALogicalOrParent(guard)
} }
final private class FinalFunction = Function; final private class FinalFunction = Function;
@@ -394,15 +387,7 @@ module MakeStateBarrierGuard<
exists(BarrierGuard guard | exists(BarrierGuard guard |
barrierGuardIsRelevant(guard) and barrierGuardIsRelevant(guard) and
exists(Expr e | exists(Expr e |
exists(Expr returnExpr | exists(Expr returnExpr | returnExpr = getALogicalOperatorParent(guard, guardOutcome) |
returnExpr = guard.asExpr()
or
// ad hoc support for conjunctions:
getALogicalAndParent(guard) = returnExpr and guardOutcome = true
or
// ad hoc support for disjunctions:
getALogicalOrParent(guard) = returnExpr and guardOutcome = false
|
exists(SsaExplicitDefinition ssa | exists(SsaExplicitDefinition ssa |
ssa.getDef().getSource() = returnExpr and ssa.getDef().getSource() = returnExpr and
ssa.getVariable().getAUse() = this.getAReturnedExpr() ssa.getVariable().getAUse() = this.getAReturnedExpr()