mirror of
https://github.com/github/codeql.git
synced 2025-12-27 14:16:34 +01:00
36 lines
1.1 KiB
Plaintext
36 lines
1.1 KiB
Plaintext
/**
|
|
* @name Assignment to property of primitive value
|
|
* @description Assigning to a property of a primitive value has no effect
|
|
* and may trigger a runtime error.
|
|
* @kind problem
|
|
* @problem.severity error
|
|
* @id js/property-assignment-on-primitive
|
|
* @tags correctness
|
|
* language-features
|
|
* external/cwe/cwe-704
|
|
* @precision high
|
|
*/
|
|
|
|
import javascript
|
|
private import semmle.javascript.dataflow.InferredTypes
|
|
|
|
/** Gets a description of the property written by `pwn`. */
|
|
string describeProp(DataFlow::PropWrite pwn) {
|
|
result = "property " + pwn.getPropertyName()
|
|
or
|
|
not exists(pwn.getPropertyName()) and result = "a property"
|
|
}
|
|
|
|
from DataFlow::PropWrite pwn, DataFlow::AnalyzedNode base
|
|
where
|
|
base = pwn.getBase() and
|
|
forex(InferredType tp | tp = base.getAType() |
|
|
tp instanceof PrimitiveType and
|
|
// assignments on `null` and `undefined` are covered by
|
|
// the query 'Property access on null or undefined'
|
|
tp != TTNull() and
|
|
tp != TTUndefined()
|
|
)
|
|
select base,
|
|
"Assignment to " + describeProp(pwn) + " of a primitive value with type " + base.ppTypes() + "."
|