hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 05:01:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add DomValueSource for react useRef output (object's prop named current)

Browse Source
This commit is contained in:
Kristen Newbury
2025-10-22 16:51:03 -04:00
committed by Asger F
parent 9534188f1f
commit dd6db16550
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/lib/change-notes/2025-10-21-react-precallgraph-step.md
View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
* Added PreCallGraphStep flow model for React's `useRef` hook.
* Added `PreCallGraphStep` flow model for React's `useRef` hook.
* Added a `DomValueSource` that uses the `current` property off the object returned by React's `useRef` hook.

10
javascript/ql/lib/semmle/javascript/frameworks/React.qll
View File

@@ -804,6 +804,16 @@ private class ReactRouterLocationSource extends DOM::LocationSource::Range {
}
}
private class UseRefDomValueSource extends DOM::DomValueSource::Range {
UseRefDomValueSource() {
exists(DataFlow::PropRead current, UseRefStep step, string prop | current = this |
step.step(_, current) and
current.mayHavePropertyName(prop) and
prop = "current"
)
}
}
/**
* Gets a reference to a function which, if called with a React component, returns wrapped
* version of that component, which we model as a direct reference to the underlying component.