hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

remove imprecise return-flow from async functions

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-08-07 16:35:46 +02:00
parent 0004c28fe8
commit cc94c5ec60
5 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/semmle/javascript/dataflow/Configuration.qll
View File

@@ -1019,7 +1019,7 @@ private predicate storeStep(
isAdditionalStoreStep(pred, succ, prop, cfg) and
summary = PathSummary::level()
or
exists(Function f, DataFlow::Node mid |
exists(Function f, DataFlow::Node mid | not f.isAsync() |
// `f` stores its parameter `pred` in property `prop` of a value that flows back to the caller,
// and `succ` is an invocation of `f`
reachableFromInput(f, succ, pred, mid, cfg, summary) and
@@ -1128,7 +1128,7 @@ private predicate loadStep(
isAdditionalLoadStep(pred, succ, prop, cfg) and
summary = PathSummary::level()
or
exists(Function f, DataFlow::Node read |
exists(Function f, DataFlow::Node read | not f.isAsync() |
parameterPropRead(f, succ, pred, prop, read, cfg) and
reachesReturn(f, read, cfg, summary)
)

4
javascript/ql/src/semmle/javascript/dataflow/TrackedNodes.qll
View File

@@ -193,7 +193,7 @@ private module NodeTracking {
basicStoreStep(pred, succ, prop) and
summary = PathSummary::level()
or
exists(Function f, DataFlow::Node mid |
exists(Function f, DataFlow::Node mid | not f.isAsync() |
// `f` stores its parameter `pred` in property `prop` of a value that flows back to the caller,
// and `succ` is an invocation of `f`
reachableFromInput(f, succ, pred, mid, summary) and
@@ -216,7 +216,7 @@ private module NodeTracking {
basicLoadStep(pred, succ, prop) and
summary = PathSummary::level()
or
exists(Function f, DataFlow::SourceNode parm |
exists(Function f, DataFlow::SourceNode parm | not f.isAsync() |
argumentPassing(succ, pred, f, parm) and
reachesReturn(f, parm.getAPropertyRead(prop), summary)
)

3
javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
View File

@@ -67,7 +67,8 @@ predicate localExceptionStep(DataFlow::Node pred, DataFlow::Node succ) {
or
DataFlow::exceptionalInvocationReturnNode(pred, expr)
|
succ = expr.getExceptionTarget()
succ = expr.getExceptionTarget() and
not succ = any(DataFlow::FunctionNode f | f.getFunction().isAsync()).getExceptionalReturn()
)
}

2
javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
View File

@@ -52,8 +52,6 @@ typeInferenceMismatch
| exceptions.js:21:17:21:24 | source() | exceptions.js:24:10:24:21 | e.toString() |
| exceptions.js:21:17:21:24 | source() | exceptions.js:25:10:25:18 | e.message |
| exceptions.js:21:17:21:24 | source() | exceptions.js:26:10:26:19 | e.fileName |
| exceptions.js:48:16:48:23 | source() | exceptions.js:50:10:50:10 | e |
| exceptions.js:59:24:59:31 | source() | exceptions.js:61:12:61:12 | e |
| exceptions.js:88:6:88:13 | source() | exceptions.js:11:10:11:10 | e |
| exceptions.js:88:6:88:13 | source() | exceptions.js:32:10:32:10 | e |
| exceptions.js:88:6:88:13 | source() | exceptions.js:33:10:33:21 | e.toString() |

2
javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
View File

@@ -31,8 +31,6 @@
| constructor-calls.js:14:15:14:22 | source() | constructor-calls.js:17:8:17:14 | c.param |
| constructor-calls.js:14:15:14:22 | source() | constructor-calls.js:25:8:25:14 | d.param |
| exceptions.js:3:15:3:22 | source() | exceptions.js:5:10:5:10 | e |
| exceptions.js:48:16:48:23 | source() | exceptions.js:50:10:50:10 | e |
| exceptions.js:59:24:59:31 | source() | exceptions.js:61:12:61:12 | e |
| exceptions.js:88:6:88:13 | source() | exceptions.js:11:10:11:10 | e |
| exceptions.js:93:11:93:18 | source() | exceptions.js:95:10:95:10 | e |
| exceptions.js:100:13:100:20 | source() | exceptions.js:102:12:102:12 | e |