mirror of
https://github.com/github/codeql.git
synced 2025-12-17 09:13:20 +01:00
7faa4fd938
This test case exposes two bugs in our data flow library (fixed by the
two previous commits):
- the charpreds of `SourcePathNode` and `SinkPathNode` only ensured
that they were on a path from a source to a sink, not that they
actually were the source/sink themselves;
- function summarization would allow for non-level paths; in the
test case, this meant that one of the summaries for `source`
represented the path returning from `source` on line 13 and then
flowing back into the call on line 15, in the process transforming
the parity of the flow label and hence causing a spurious flow.
19 lines
365 B
JavaScript
19 lines
365 B
JavaScript
function source(x) {
|
|
return x;
|
|
}
|
|
|
|
function sink(x) {
|
|
return x;
|
|
}
|
|
|
|
function inc(x) {
|
|
return x+1;
|
|
}
|
|
|
|
var flow = source(0); // source
|
|
flow = inc(flow);
|
|
flow = source(flow); // source
|
|
flow = sink(flow); // sink for line 15, but not for line 13 (wrong parity)
|
|
flow = inc(flow);
|
|
sink(flow); // sink for line 13, but not for line 15 (wrong parity)
|