JS: MissingUnicodeFlag now uses flags from RegExpLiteral, upgraded to accept v flag as well.

Author: Napalys

javascript/ql/lib/semmle/javascript/Expr.qll

@@ -481,6 +481,9 @@ class RegExpLiteral extends @regexp_literal, Literal, RegExpParent {
   /** Holds if this regular expression has an `s` flag. */
   predicate isDotAll() { RegExp::isDotAll(this.getFlags()) }
 
+  /** Holds if this regular expression has an `u` flag. */
+  predicate isUnicode() { RegExp::isUnicode(this.getFlags()) }
+
   /** Holds if this regular expression has an `v` flag. */
   predicate isUnicodeSets() { RegExp::isUnicodeSets(this.getFlags()) }
 

javascript/ql/lib/semmle/javascript/Regexp.qll

@@ -1162,6 +1162,10 @@ module RegExp {
   bindingset[flags]
   predicate isDotAll(string flags) { flags.matches("%s%") }
 
+  /** Holds if `flags` includes the `u` flag. */
+  bindingset[flags]
+  predicate isUnicode(string flags) { flags.matches("%u%") }
+
   /** Holds if `flags` includes the `v` flag. */
   bindingset[flags]
   predicate isUnicodeSets(string flags) { flags.matches("%v%") }
@@ -1182,6 +1186,10 @@ module RegExp {
   bindingset[flags]
   predicate maybeDotAll(string flags) { flags = unknownFlag() or isDotAll(flags) }
 
+  /** Holds if `flags` includes the `s` flag or is the unknown flag `?`. */
+  bindingset[flags]
+  predicate maybeUnicodeSets(string flags) { flags = unknownFlag() or isUnicodeSets(flags) }
+
   /** Holds if `term` and all of its disjuncts are anchored on both ends. */
   predicate isFullyAnchoredTerm(RegExpTerm term) {
     exists(RegExpSequence seq | term = seq |

javascript/ql/test/library-tests/RegExp/MissingUnicodeFlag/MissingUnicodeFlag.ql

@@ -3,7 +3,7 @@ import javascript
 from RegExpLiteral literal, RegExpConstant wideConstant
 where
   wideConstant.getLiteral() = literal and
-  not literal.getFlags().matches("%u%") and
+  not (literal.isUnicode() or literal.isUnicodeSets()) and
   wideConstant.getValue().length() > 1 and
   (
     wideConstant.getParent() instanceof RegExpCharacterClass

javascript/ql/test/library-tests/RegExp/MissingUnicodeFlag/tst.js

@@ -2,4 +2,5 @@
 /[𒍀-𒍅]/u; // OK
 /𒍀+/; // NOT OK
 /𒍀+/u; // OK
+/𒍀+/v; // OK
 /(𒍀)+/; // OK