|
| 1 | +/** |
| 2 | + * @name Loop iteration skipped due to shifting |
| 3 | + * @description Removing elements from an array while iterating over it can cause the loop to skip over some elements, |
| 4 | + * unless the loop index is decremented accordingly. |
| 5 | + * @kind problem |
| 6 | + * @problem.severity warning |
| 7 | + * @id js/loop-iteration-skipped-due-to-shifting |
| 8 | + * @tags correctness |
| 9 | + * @precision high |
| 10 | + */ |
| 11 | +import javascript |
| 12 | + |
| 13 | +/** |
| 14 | + * An operation that inserts or removes elements from an array while shifting all elements |
| 15 | + * occuring after the insertion/removal point. |
| 16 | + * |
| 17 | + * Does not include `push` and `pop` since these never shift any elements. |
| 18 | + */ |
| 19 | +class ArrayShiftingCall extends DataFlow::MethodCallNode { |
| 20 | + string name; |
| 21 | + |
| 22 | + ArrayShiftingCall() { |
| 23 | + name = getMethodName() and |
| 24 | + (name = "splice" or name = "shift" or name = "unshift") |
| 25 | + } |
| 26 | + |
| 27 | + DataFlow::SourceNode getArray() { |
| 28 | + result = getReceiver().getALocalSource() |
| 29 | + } |
| 30 | +} |
| 31 | + |
| 32 | +/** |
| 33 | + * A call to `splice` on an array. |
| 34 | + */ |
| 35 | +class SpliceCall extends ArrayShiftingCall { |
| 36 | + SpliceCall() { |
| 37 | + name = "splice" |
| 38 | + } |
| 39 | + |
| 40 | + /** |
| 41 | + * Gets the index from which elements are removed and possibly new elemenst are inserted. |
| 42 | + */ |
| 43 | + DataFlow::Node getIndex() { |
| 44 | + result = getArgument(0) |
| 45 | + } |
| 46 | + |
| 47 | + /** |
| 48 | + * Gets the number of removed elements. |
| 49 | + */ |
| 50 | + int getNumRemovedElements() { |
| 51 | + result = getArgument(1).asExpr().getIntValue() and |
| 52 | + result >= 0 |
| 53 | + } |
| 54 | + |
| 55 | + /** |
| 56 | + * Gets the number of inserted elements. |
| 57 | + */ |
| 58 | + int getNumInsertedElements() { |
| 59 | + result = getNumArgument() - 2 and |
| 60 | + result >= 0 |
| 61 | + } |
| 62 | +} |
| 63 | + |
| 64 | +/** |
| 65 | + * A `for` loop iterating over the indices of an array, in increasing order. |
| 66 | + */ |
| 67 | +class ArrayIterationLoop extends ForStmt { |
| 68 | + DataFlow::SourceNode array; |
| 69 | + LocalVariable indexVariable; |
| 70 | + |
| 71 | + ArrayIterationLoop() { |
| 72 | + exists (RelationalComparison compare | compare = getTest() | |
| 73 | + compare.getLesserOperand() = indexVariable.getAnAccess() and |
| 74 | + compare.getGreaterOperand() = array.getAPropertyRead("length").asExpr()) and |
| 75 | + getUpdate().(IncExpr).getOperand() = indexVariable.getAnAccess() |
| 76 | + } |
| 77 | + |
| 78 | + /** |
| 79 | + * Gets the variable holding the loop variable and current array index. |
| 80 | + */ |
| 81 | + LocalVariable getIndexVariable() { |
| 82 | + result = indexVariable |
| 83 | + } |
| 84 | + |
| 85 | + /** |
| 86 | + * Gets the loop entry point. |
| 87 | + */ |
| 88 | + ReachableBasicBlock getLoopEntry() { |
| 89 | + result = getTest().getFirstControlFlowNode().getBasicBlock() |
| 90 | + } |
| 91 | + |
| 92 | + /** |
| 93 | + * Gets a call that potentially shifts the elements of the given array. |
| 94 | + */ |
| 95 | + ArrayShiftingCall getAnArrayShiftingCall() { |
| 96 | + result.getArray() = array |
| 97 | + } |
| 98 | + |
| 99 | + /** |
| 100 | + * Gets a call to `splice` that removes elements from the looped-over array at the current index |
| 101 | + * |
| 102 | + * The `splice` call is not guaranteed to be inside the loop body. |
| 103 | + */ |
| 104 | + SpliceCall getACandidateSpliceCall() { |
| 105 | + result = getAnArrayShiftingCall() and |
| 106 | + result.getIndex().asExpr() = getIndexVariable().getAnAccess() and |
| 107 | + result.getNumRemovedElements() > result.getNumInsertedElements() |
| 108 | + } |
| 109 | + |
| 110 | + /** |
| 111 | + * Holds if `cfg` modifies the index variable or shifts array elements, disturbing the |
| 112 | + * relationship between the array and the index variable. |
| 113 | + */ |
| 114 | + predicate hasIndexingManipulation(ControlFlowNode cfg) { |
| 115 | + cfg.(VarDef).getAVariable() = getIndexVariable() or |
| 116 | + cfg = getAnArrayShiftingCall().asExpr() |
| 117 | + } |
| 118 | + |
| 119 | + /** |
| 120 | + * Holds if there is a `loop entry -> cfg` path that does not involve index manipulation or a successful index equality check. |
| 121 | + */ |
| 122 | + predicate hasPathTo(ControlFlowNode cfg) { |
| 123 | + exists(getACandidateSpliceCall()) and // restrict size of predicate |
| 124 | + cfg = getLoopEntry().getFirstNode() |
| 125 | + or |
| 126 | + hasPathTo(cfg.getAPredecessor()) and |
| 127 | + getLoopEntry().dominates(cfg.getBasicBlock()) and |
| 128 | + not hasIndexingManipulation(cfg) and |
| 129 | + |
| 130 | + // Ignore splice calls guarded by an index equality check. |
| 131 | + // This indicates that the index of an element is the basis for removal, not its value, |
| 132 | + // which means it may be okay to skip over elements. |
| 133 | + not exists (ConditionGuardNode guard, EqualityTest test | cfg = guard | |
| 134 | + test = guard.getTest() and |
| 135 | + test.getAnOperand() = getIndexVariable().getAnAccess() and |
| 136 | + guard.getOutcome() = test.getPolarity()) and |
| 137 | + |
| 138 | + // Block flow after inspecting an array element other than that at the current index. |
| 139 | + // For example, if the splice happens after inspecting `array[i + 1]`, then the next |
| 140 | + // element has already been "looked at" and so it doesn't matter if we skip it. |
| 141 | + not exists (IndexExpr index | cfg = index | |
| 142 | + array.flowsToExpr(index.getBase()) and |
| 143 | + not index.getIndex() = getIndexVariable().getAnAccess()) |
| 144 | + } |
| 145 | + |
| 146 | + /** |
| 147 | + * Holds if there is a `loop entry -> splice -> cfg` path that does not involve index manipulation, |
| 148 | + * other than the `splice` call. |
| 149 | + */ |
| 150 | + predicate hasPathThrough(SpliceCall splice, ControlFlowNode cfg) { |
| 151 | + splice = getACandidateSpliceCall() and |
| 152 | + cfg = splice.asExpr() and |
| 153 | + hasPathTo(cfg.getAPredecessor()) |
| 154 | + or |
| 155 | + hasPathThrough(splice, cfg.getAPredecessor()) and |
| 156 | + getLoopEntry().dominates(cfg.getBasicBlock()) and |
| 157 | + not hasIndexingManipulation(cfg) |
| 158 | + } |
| 159 | +} |
| 160 | + |
| 161 | +from ArrayIterationLoop loop, SpliceCall splice |
| 162 | +where loop.hasPathThrough(splice, loop.getUpdate().getFirstControlFlowNode()) |
| 163 | +select splice, "Removing an array item without adjusting the loop index '" + loop.getIndexVariable().getName() + "' causes the subsequent array item to be skipped." |
0 commit comments