add IndirectInclusionTest and IndirectEndsWith

Author: erik-krogh

javascript/ql/src/semmle/javascript/InclusionTests.qll

@@ -58,6 +58,40 @@ module InclusionTest {
     boolean getPolarity() { result = true }
   }
 
+  /**
+   * A call to a utility function (`callee`) that performs an InclusionTest (`inner`).
+   */
+  private class IndirectInclusionTest extends Range, DataFlow::CallNode {
+    InclusionTest inner;
+    Function callee;
+
+    IndirectInclusionTest() {
+      inner.getEnclosingExpr() = callee.getAReturnedExpr() and
+      this.getACallee() = callee and
+      count(this.getACallee()) = 1 and
+      count(callee.getAReturnedExpr()) = 1 and
+      not this.isImprecise() and
+      inner.getContainerNode().getALocalSource().getEnclosingExpr() = callee.getAParameter() and
+      inner.getContainedNode().getALocalSource().getEnclosingExpr() = callee.getAParameter()
+    }
+
+    override DataFlow::Node getContainerNode() {
+      exists(int arg |
+        inner.getContainerNode().getALocalSource().getEnclosingExpr() = callee.getParameter(arg) and
+        result = this.getArgument(arg)
+      )
+    }
+
+    override DataFlow::Node getContainedNode() {
+      exists(int arg |
+        inner.getContainedNode().getALocalSource().getEnclosingExpr() = callee.getParameter(arg) and
+        result = this.getArgument(arg)
+      )
+    }
+
+    override boolean getPolarity() { result = inner.getPolarity() }
+  }
+
   /**
    * A call to a method named `includes`, assumed to refer to `String.prototype.includes`
    * or `Array.prototype.includes`.

javascript/ql/src/semmle/javascript/StringOps.qll

@@ -287,6 +287,41 @@ module StringOps {
       boolean getPolarity() { result = true }
     }
 
+    /**
+     * A call to a utility function (`callee`) that performs an EndsWith check (`inner`).
+     */
+    private class IndirectEndsWith extends Range, DataFlow::CallNode {
+      EndsWith inner;
+      Function callee;
+
+      IndirectEndsWith() {
+        inner.getEnclosingExpr() = callee.getAReturnedExpr() and
+        this.getACallee() = callee and
+        count(this.getACallee()) = 1 and
+        count(callee.getAReturnedExpr()) = 1 and 
+        not this.isImprecise() and
+        inner.getBaseString().getALocalSource().getEnclosingExpr() = callee.getAParameter() and
+        inner.getSubstring().getALocalSource().getEnclosingExpr() = callee.getAParameter()
+      }
+
+      override DataFlow::Node getBaseString() {
+        exists(int arg |
+          inner.getBaseString().getALocalSource().getEnclosingExpr() = callee.getParameter(arg) and
+          result = this.getArgument(arg)
+        )
+      }
+
+      override DataFlow::Node getSubstring() {
+        exists(int arg |
+          inner.getSubstring().getALocalSource().getEnclosingExpr() = callee.getParameter(arg) and
+          result = this.getArgument(arg)
+        )
+      }
+
+      override boolean getPolarity() { result = inner.getPolarity() }
+    }
+
+
     /**
      * A call of form `A.endsWith(B)`.
      */