@@ -108,6 +108,7 @@ private module Reach<ReachInputSig Input> {
108108 )
109109 }
110110
111+ /** Holds if `n` is forwards and backwards reachable with type tracker `t`. */
111112 pragma [ nomagic]
112113 predicate reached ( DataFlow:: LocalSourceNode n , TypeTracker t ) {
113114 n = forward ( t ) and
@@ -132,10 +133,11 @@ private module Reach<ReachInputSig Input> {
132133 }
133134}
134135
136+ /** Holds if `inputStr` is compiled to a regular expression that is returned at `call`. */
135137pragma [ nomagic]
136- private predicate regFromString ( DataFlow:: LocalSourceNode n , DataFlow:: CallNode call ) {
138+ private predicate regFromString ( DataFlow:: LocalSourceNode inputStr , DataFlow:: CallNode call ) {
137139 exists ( DataFlow:: Node mid |
138- n .flowsTo ( mid ) and
140+ inputStr .flowsTo ( mid ) and
139141 call = API:: getTopLevelMember ( "Regexp" ) .getAMethodCall ( [ "compile" , "new" ] ) and
140142 mid = call .getArgument ( 0 )
141143 )
@@ -183,9 +185,10 @@ private DataFlow::LocalSourceNode trackStrings(DataFlow::Node start, TypeTracker
183185 exists ( TypeTracker t2 | t = StringReach:: stepReached ( t2 , trackStrings ( start , t2 ) , result ) )
184186}
185187
188+ /** Holds if `strConst` flows to a regex compilation (tracked by `t`), where the resulting regular expression is stored in `reg`. */
186189pragma [ nomagic]
187- private predicate regFromStringStart ( DataFlow:: Node start , TypeTracker t , DataFlow:: CallNode nodeTo ) {
188- regFromString ( trackStrings ( start , t ) , nodeTo ) and
190+ private predicate regFromStringStart ( DataFlow:: Node strConst , TypeTracker t , DataFlow:: CallNode reg ) {
191+ regFromString ( trackStrings ( strConst , t ) , reg ) and
189192 exists ( t .continue ( ) )
190193}
191194
0 commit comments