hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix false positives in stream pipe analysis by improving error handler tracking via property access.

Browse Source
This commit is contained in:
Napalys Klicius
2025-05-30 18:08:04 +02:00
parent d3b2a57fbf
commit f843cc02f6
3 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/test.expected
View File

@@ -12,9 +12,9 @@
| test.js:182:17:182:40 | notStre ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:192:5:192:32 | copyStr ... nation) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:8:5:8:21 | source.pipe(gzip) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:29:5:29:40 | wrapper ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:37:21:37:56 | wrapper ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:44:5:44:40 | wrapper ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:52:5:52:37 | source. ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:59:18:59:39 | stream. ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:73:5:73:40 | wrapper ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| tst.js:111:5:111:26 | stream. ... Stream) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |

4
javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/tst.js
View File

@@ -26,7 +26,7 @@ function zip() {
function zip1() {
const zipStream = createWriteStream(zipPath);
let wrapper = new StreamWrapper();
wrapper.outputStream.pipe(zipStream); // $SPURIOUS:Alert
wrapper.outputStream.pipe(zipStream);
wrapper.outputStream.on('error', e);
zipStream.on('error', e);
}
@@ -49,7 +49,7 @@ function zip3() {
const zipStream = createWriteStream(zipPath);
let wrapper = new StreamWrapper();
let source = getStream();
source.pipe(wrapper.outputStream); // $MISSING:Alert
source.pipe(wrapper.outputStream); // $Alert
wrapper.outputStream.on('error', e);
}