Skip to content

Commit df0488a

Browse files
committed
Ensure Member tokens from flow summaries are seen in PropertyName
1 parent c52a4b0 commit df0488a

File tree

2 files changed

+17
-7
lines changed

2 files changed

+17
-7
lines changed

javascript/ql/lib/semmle/javascript/dataflow/internal/Contents.qll

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
private import javascript
22
private import semmle.javascript.frameworks.data.internal.ApiGraphModels as ApiGraphModels
3+
private import semmle.javascript.dataflow.internal.FlowSummaryPrivate as FlowSummaryPrivate
4+
private import codeql.dataflow.internal.AccessPathSyntax as AccessPathSyntax
35

46
module Private {
57
import Public
@@ -15,6 +17,15 @@ module Private {
1517
/** Gets the largest array index should be propagated precisely through flow summaries. */
1618
int getAPreciseArrayIndex() { result = [0 .. getMaxPreciseArrayIndex()] }
1719

20+
/**
21+
* Holds if a MaD access path token of form `name[arg]` exists.
22+
*/
23+
predicate isAccessPathTokenPresent(string name, string arg) {
24+
arg = any(FlowSummaryPrivate::AccessPathToken tok).getAnArgument(name)
25+
or
26+
arg = any(ApiGraphModels::AccessPathToken tok).getAnArgument(name)
27+
}
28+
1829
/**
1930
* Holds if values associated with `key` should be tracked as a individual contents of a `Map` object.
2031
*/
@@ -25,10 +36,7 @@ module Private {
2536
call.getArgument(0).getStringValue() = key
2637
)
2738
or
28-
exists(ApiGraphModels::AccessPathToken token |
29-
token.getName() = "MapValue" and
30-
token.getAnArgument() = key
31-
)
39+
isAccessPathTokenPresent("MapValue", key)
3240
}
3341

3442
/**
@@ -47,9 +55,7 @@ module Private {
4755
or
4856
this = getAPreciseArrayIndex().toString()
4957
or
50-
exists(ApiGraphModels::AccessPathToken tok |
51-
tok.getName() = "Member" and this = tok.getAnArgument()
52-
)
58+
isAccessPathTokenPresent("Member", this)
5359
}
5460

5561
/** Gets the array index corresponding to this property name. */

javascript/ql/lib/semmle/javascript/dataflow/internal/FlowSummaryPrivate.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,10 @@ module Steps = Private::Steps<FlowSummaryStepInput>;
141141

142142
module RenderSummarizedCallable = Private::RenderSummarizedCallable<FlowSummaryStepInput>;
143143

144+
class AccessPath = Private::AccessPath;
145+
146+
class AccessPathToken = Private::AccessPathToken;
147+
144148
/**
145149
* Gets the textual representation of return kind `rk` used in MaD.
146150
*

0 commit comments

Comments
 (0)