From e960bd967f91a39ea25c358b89b1a06241b3508e Mon Sep 17 00:00:00 2001 From: Max Schaefer Date: Thu, 13 Dec 2018 10:54:00 +0000 Subject: [PATCH] JavaScript: Make configuration IDs explicit in the API. --- javascript/ql/src/Security/Summaries/Shared.qll | 4 ++-- .../ql/src/semmle/javascript/dataflow/Configuration.qll | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/javascript/ql/src/Security/Summaries/Shared.qll b/javascript/ql/src/Security/Summaries/Shared.qll index 3111001fca8..a438f9f3ad8 100644 --- a/javascript/ql/src/Security/Summaries/Shared.qll +++ b/javascript/ql/src/Security/Summaries/Shared.qll @@ -5,11 +5,11 @@ import javascript /** - * Holds if `config` matches `spec`, that is, either `spec` is the name of `config` + * Holds if `config` matches `spec`, that is, either `spec` is the ID of `config` * or `spec` is the empty string and `config` is an arbitrary configuration. */ predicate configSpec(DataFlow::Configuration config, string spec) { - config.toString() = spec + config.getId() = spec or spec = "" } diff --git a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll index 9a65124f09f..e6b6f71fc94 100644 --- a/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll +++ b/javascript/ql/src/semmle/javascript/dataflow/Configuration.qll @@ -86,6 +86,12 @@ abstract class Configuration extends string { bindingset[this] Configuration() { any() } + /** + * Gets the unique identifier of this configuration among all data flow tracking + * configurations. + */ + string getId() { result = this } + /** * Holds if `source` is a relevant data flow source for this configuration. */