Merge pull request #678 from asger-semmle/function-receiver

Approved by xiemaisi

Author: semmle-qlci

javascript/ql/src/semmle/javascript/dataflow/Nodes.qll

@@ -311,6 +311,25 @@ class FunctionNode extends DataFlow::ValueNode, DataFlow::DefaultSourceNode {
   Function getFunction() {
     result = astNode
   }
+
+  /**
+   * Gets the function whose `this` binding a `this` expression in this function refers to,
+   * which is the nearest enclosing non-arrow function.
+   */
+  FunctionNode getThisBinder() {
+    result.getFunction() = getFunction().getThisBinder()
+  }
+
+  /**
+   * Gets the dataflow node holding the value of the receiver passed to the given function.
+   *
+   * Has no result for arrow functions, as they ignore the receiver argument.
+   *
+   * To get the data flow node for `this` in an arrow function, consider using `getThisBinder().getReceiver()`.
+   */
+  ThisNode getReceiver() {
+    result.getBinder() = this
+  }
 }
 
 /** A data flow node corresponding to an object literal expression. */

javascript/ql/test/library-tests/Receiver/GetReceiver.expected

@@ -0,0 +1,6 @@
+| tst.js:1:1:13:1 | functio ... \\n  };\\n} | tst.js:1:1:1:0 | this |
+| tst.js:2:3:2:21 | function inner() {} | tst.js:2:3:2:2 | this |
+| tst.js:5:11:5:10 | () {} | tst.js:5:11:5:10 | this |
+| tst.js:6:11:6:15 | () {} | tst.js:6:11:6:10 | this |
+| tst.js:10:15:10:19 | () {} | tst.js:10:15:10:14 | this |
+| tst.js:11:15:11:20 | (x) {} | tst.js:11:15:11:14 | this |

javascript/ql/test/library-tests/Receiver/GetReceiver.ql

@@ -0,0 +1,4 @@
+import javascript
+
+from DataFlow::FunctionNode function
+select function, function.getReceiver()

javascript/ql/test/library-tests/Receiver/tst.js

@@ -0,0 +1,13 @@
+function f() {
+  function inner() {}
+  let arrow = () => 5;
+  
+  class C {
+    method() {}
+  };
+  
+  let obj = {
+    get getter() {},
+    set setter(x) {}
+  };
+}