hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Move all hidden node definitions into DataFlowPrivate

Browse Source
This commit is contained in:
Asger F
2025-01-07 10:44:09 +01:00
parent 47cc3c09f5
commit f17cc5af15
2 changed files with 26 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll
View File

@@ -75,6 +75,7 @@ private import internal.AccessPaths
private import semmle.javascript.Unit
private import semmle.javascript.internal.CachedStages
private import AdditionalFlowSteps
private import internal.DataFlowPrivate as DataFlowPrivate
/**
* A data flow tracking configuration for finding inter-procedural paths from
@@ -1794,39 +1795,7 @@ deprecated class MidPathNode extends PathNode, MkMidNode {
* Holds if this node is hidden from paths in path explanation queries, except
* in cases where it is the source or sink.
*/
predicate isHidden() { PathNode::shouldNodeBeHidden(nd) }
}
/** Companion module to the `PathNode` class. */
module PathNode {
/** Holds if `nd` should be hidden in data flow paths. */
predicate shouldNodeBeHidden(DataFlow::Node nd) {
// TODO: move to DataFlowPrivate
// Skip phi, refinement, and capture nodes
nd.(DataFlow::SsaDefinitionNode).getSsaVariable().getDefinition() instanceof
SsaImplicitDefinition
or
// Skip SSA definition of parameter as its location coincides with the parameter node
nd = DataFlow::ssaDefinitionNode(Ssa::definition(any(SimpleParameter p)))
or
// Skip to the top of big left-leaning string concatenation trees.
nd = any(AddExpr add).flow() and
nd = any(AddExpr add).getAnOperand().flow()
or
// Skip the exceptional return on functions, as this highlights the entire function.
nd = any(DataFlow::FunctionNode f).getExceptionalReturn()
or
// Skip the special return node for functions, as this highlights the entire function (and the returned expr is the previous node).
nd = any(DataFlow::FunctionNode f).getReturnNode()
or
// Skip the synthetic 'this' node, as a ThisExpr will be the next node anyway
nd = DataFlow::thisNode(_)
or
// Skip captured variable nodes as the successor will be a use of that variable anyway.
nd = DataFlow::capturedVariableNode(_)
or
nd instanceof DataFlow::FunctionSelfReferenceNode
}
predicate isHidden() { DataFlowPrivate::nodeIsHidden(nd) }
}
/**

25
javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll
View File

@@ -604,7 +604,30 @@ DataFlowType getNodeType(Node node) {
}
predicate nodeIsHidden(Node node) {
DataFlow::PathNode::shouldNodeBeHidden(node)
// Skip phi, refinement, and capture nodes
node.(DataFlow::SsaDefinitionNode).getSsaVariable().getDefinition() instanceof
SsaImplicitDefinition
or
// Skip SSA definition of parameter as its location coincides with the parameter node
node = DataFlow::ssaDefinitionNode(Ssa::definition(any(SimpleParameter p)))
or
// Skip to the top of big left-leaning string concatenation trees.
node = any(AddExpr add).flow() and
node = any(AddExpr add).getAnOperand().flow()
or
// Skip the exceptional return on functions, as this highlights the entire function.
node = any(DataFlow::FunctionNode f).getExceptionalReturn()
or
// Skip the special return node for functions, as this highlights the entire function (and the returned expr is the previous node).
node = any(DataFlow::FunctionNode f).getReturnNode()
or
// Skip the synthetic 'this' node, as a ThisExpr will be the next node anyway
node = DataFlow::thisNode(_)
or
// Skip captured variable nodes as the successor will be a use of that variable anyway.
node = DataFlow::capturedVariableNode(_)
or
node instanceof DataFlow::FunctionSelfReferenceNode
or
node instanceof FlowSummaryNode
or