hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

add model for the array-from polyfill

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-07-15 10:51:55 +02:00
parent d34e748c83
commit f6f63e2811
4 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
javascript/ql/src/semmle/javascript/Arrays.qll
View File

@@ -68,7 +68,7 @@ module ArrayTaintTracking {
succ = call
or
// `e = Array.from(x)`: if `x` is tainted, then so is `e`.
call = DataFlow::globalVarRef("Array").getAPropertyRead("from").getACall() and
call = arrayFromCall() and
pred = call.getAnArgument() and
succ = call
or
@@ -97,7 +97,7 @@ private module ArrayDataFlow {
DataFlow::Node pred, DataFlow::Node succ, string fromProp, string toProp
) {
exists(DataFlow::CallNode call |
call = DataFlow::globalVarRef("Array").getAMemberCall("from") and
call = arrayFromCall() and
pred = call.getArgument(0) and
succ = call and
fromProp = arrayLikeElement() and
@@ -298,3 +298,19 @@ private module ArrayDataFlow {
}
}
}
private import ArrayLibraries
/**
* Classes and predicates modelling various libraries that work on arrays or array-like structures.
*/
private module ArrayLibraries {
/**
* Gets a call to `Array.from` or a polyfill implementing the same functionality.
*/
DataFlow::CallNode arrayFromCall() {
result = DataFlow::globalVarRef("Array").getAMemberCall("from")
or
result = DataFlow::moduleImport("array-from").getACall()
}
}