Skip to content

Commit e4d2844

Browse files
committed
JS: Add content approximation
This seems to fix a performance issue for RegExpInjection in angular
1 parent df1eda4 commit e4d2844

File tree

1 file changed

+55
-2
lines changed

1 file changed

+55
-2
lines changed

javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -384,10 +384,63 @@ predicate compatibleTypes(DataFlowType t1, DataFlowType t2) {
384384

385385
predicate forceHighPrecision(Content c) { none() }
386386

387-
class ContentApprox = Unit;
387+
newtype TContentApprox =
388+
TApproxPropertyContent() or
389+
TApproxMapKey() or
390+
TApproxMapValue() or
391+
TApproxSetElement() or
392+
TApproxIteratorElement() or
393+
TApproxIteratorError() or
394+
TApproxPromiseValue() or
395+
TApproxPromiseError() or
396+
TApproxCapturedContent()
397+
398+
class ContentApprox extends TContentApprox {
399+
string toString() {
400+
this = TApproxPropertyContent() and result = "TApproxPropertyContent"
401+
or
402+
this = TApproxMapKey() and result = "TApproxMapKey"
403+
or
404+
this = TApproxMapValue() and result = "TApproxMapValue"
405+
or
406+
this = TApproxSetElement() and result = "TApproxSetElement"
407+
or
408+
this = TApproxIteratorElement() and result = "TApproxIteratorElement"
409+
or
410+
this = TApproxIteratorError() and result = "TApproxIteratorError"
411+
or
412+
this = TApproxPromiseValue() and result = "TApproxPromiseValue"
413+
or
414+
this = TApproxPromiseError() and result = "TApproxPromiseError"
415+
or
416+
this = TApproxCapturedContent() and result = "TApproxCapturedContent"
417+
}
418+
}
388419

389420
pragma[inline]
390-
ContentApprox getContentApprox(Content c) { exists(result) and exists(c) }
421+
ContentApprox getContentApprox(Content c) {
422+
c instanceof MkPropertyContent and result = TApproxPropertyContent()
423+
or
424+
c instanceof MkArrayElementUnknown and result = TApproxPropertyContent()
425+
or
426+
c instanceof MkMapKey and result = TApproxMapKey()
427+
or
428+
c instanceof MkMapValueWithKnownKey and result = TApproxMapValue()
429+
or
430+
c instanceof MkMapValueWithUnknownKey and result = TApproxMapValue()
431+
or
432+
c instanceof MkSetElement and result = TApproxSetElement()
433+
or
434+
c instanceof MkIteratorElement and result = TApproxIteratorElement()
435+
or
436+
c instanceof MkIteratorError and result = TApproxIteratorError()
437+
or
438+
c instanceof MkPromiseValue and result = TApproxPromiseValue()
439+
or
440+
c instanceof MkPromiseError and result = TApproxPromiseError()
441+
or
442+
c instanceof MkCapturedContent and result = TApproxCapturedContent()
443+
}
391444

392445
cached
393446
private newtype TDataFlowCall =

0 commit comments

Comments
 (0)