8000 JS: Add class harness to recover localFieldStep edges by asgerf · Pull Request #18302 · github/codeql · GitHub
[go: up one dir, main page]
Skip to content

JS: Add class harness to recover localFieldStep edges #18302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

JS: Add class harness to recover localFieldStep edges #18302

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f7c7aee
JS: Add class harness callable
asgerf Dec 9, 2024
6c1ec8c
JS: Add test for flow from constructor to method
asgerf Dec 9, 2024
8239758
JS: Add more features to AdditionalFlowInternal
asgerf Dec 9, 2024
335d965
JS: Add ClassHarness
asgerf Dec 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
JS: Add class harness callable
  • Loading branch information
@asgerf
asgerf committed Dec 9, 2024
commit f7c7aeefe2b695aea35546b03ba7ad631695334e
19 changes: 17 additions & 2 deletions javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -390,7 +390,15 @@ class CastNode extends DataFlow::Node {
cached
newtype TDataFlowCallable =
MkSourceCallable(StmtContainer container) or
MkLibraryCallable(LibraryCallable callable)
MkLibraryCallable(LibraryCallable callable) or
MkClassHarnessCallable(Function f) {
// We only need a class harness for functions that act as classes (i.e. constructors),
// but since DataFlow::Node has not been materialised at this stage, we can't use DataFlow::ClassNode.
// Exclude arrow functions as they can't be called with 'new'.
not f instanceof ArrowFunctionExpr and
// We also don't need harnesses for externs
not f.getTopLevel().isExterns()
}

/**
* A callable entity. This is a wrapper around either a `StmtContainer` or a `LibraryCallable`.
Expand All @@ -401,14 +409,21 @@ class DataFlowCallable extends TDataFlowCallable {
result = this.asSourceCallable().toString()
or
result = this.asLibraryCallable()
or
result = this.asClassHarness().toString()
}

/** Gets the location of this callable, if it is present in the source code. */
Location getLocation() { result = this.asSourceCallable().getLocation() }
Location getLocation() {
result = this.asSourceCallable().getLocation() or result = this.asClassHarness().getLocation()
}

/** Gets the corresponding `StmtContainer` if this is a source callable. */
StmtContainer asSourceCallable() { this = MkSourceCallable(result) }

/** Gets the class constructor for which this is a class harness. */
Function asClassHarness() { this = MkClassHarnessCallable(result) }

/** Gets the corresponding `StmtContainer` if this is a source callable. */
pragma[nomagic]
StmtContainer asSourceCallableNotExterns() {
Expand Down
0