Merge pull request #2636 from erik-krogh/NewSocketIO

Approved by esbena

Author: semmle-qlci

change-notes/1.24/analysis-javascript.md

@@ -13,6 +13,9 @@
   - [react](https://www.npmjs.com/package/react)
   - [typeahead.js](https://www.npmjs.com/package/typeahead.js)
   - [Handlebars](https://www.npmjs.com/package/handlebars)
+  - [Electron](https://electronjs.org/)
+  - [Node.js](https://nodejs.org/)
+  - [Socket.IO](https://socket.io/)
 
 ## New queries
 
@@ -37,3 +40,4 @@
 ## Changes to libraries
 
 * The predicates `RegExpTerm.getSuccessor` and `RegExpTerm.getPredecessor` have been changed to reflect textual, not operational, matching order. This only makes a difference in lookbehind assertions, which are operationally matched backwards. Previously, `getSuccessor` would mimick this, so in an assertion `(?<=ab)` the term `b` would be considered the predecessor, not the successor, of `a`. Textually, however, `a` is still matched before `b`, and this is the order we now follow.
+* An extensible model of the `EventEmitter` pattern has been implemented.

javascript/ql/src/semmle/javascript/frameworks/EventEmitter.qll

@@ -117,9 +117,9 @@ module EventRegistration {
 
     abstract DataFlow::Node getReceivedItem(int i);
 
-    abstract DataFlow::Node getAReturnedValue();
+    DataFlow::Node getAReturnedValue() { none() }
 
-    abstract EventDispatch::Range getAReturnDispatch();
+    EventDispatch::Range getAReturnDispatch() { none() }
   }
 
   /**
@@ -136,10 +136,6 @@ module EventRegistration {
     override DataFlow::Node getReceivedItem(int i) {
       result = this.getABoundCallbackParameter(1, i)
     }
-
-    override DataFlow::Node getAReturnedValue() { none() }
-
-    override EventDispatch::Range getAReturnDispatch() { none() }
   }
 }
 
@@ -227,3 +223,4 @@ private class EventEmitterTaintStep extends DataFlow::AdditionalFlowStep {
     succ = dispatch
   }
 }
+