wip

Author: asgerf

javascript/ql/lib/semmle/javascript/internal/NameResolution.qll

@@ -356,6 +356,8 @@ module NameResolution {
         name = "$$promise-content" and
         result = imprt.getImportedPathExpr()
       )
+      or
+      storeToExports(result, mod, name)
     }
 
     /**
@@ -373,6 +375,58 @@ module NameResolution {
       value = target.getAnAssignedExpr().(ObjectExpr).getPropertyByName(prop).getInit()
     }
 
+    pragma[nomagic]
+    private GlobalVarAccess globalAccess(Module mod, string name) {
+      result.getName() = name and
+      result.getTopLevel() = mod and
+      name = ["exports", "module"] // manually restrict size of predicate
+    }
+
+    private Node moduleObjectRef(Module mod) {
+      result = mod.getScope().getVariable("module").getAnAccess()
+      or
+      result = globalAccess(mod, "module")
+      or
+      commonStep(moduleObjectRef(mod), result)
+    }
+
+    private Node exportsObjectRhs(Module mod) {
+      exists(AssignExpr assign |
+        assign.getLhs().(PropAccess).accesses(moduleObjectRef(mod), "exports") and
+        result = assign.getRhs()
+      )
+      or
+      commonStep(result, exportsObjectRhs(mod))
+    }
+
+    private Node exportsObjectAlias(Module mod) {
+      result = mod.getScope().getVariable("exports").getAnAccess()
+      or
+      result = globalAccess(mod, "exports")
+      or
+      result.(ThisExpr).getBindingContainer() = mod and
+      mod instanceof NodeModule
+      or
+      readStep(moduleObjectRef(mod), "exports", result)
+      or
+      result = exportsObjectRhs(mod)
+      or
+      commonStep(exportsObjectAlias(mod), result)
+    }
+
+    private predicate storeToExports(Node node, Module mod, string name) {
+      exists(AssignExpr assign |
+        node = assign.getRhs() and
+        assign.getLhs().(PropAccess).accesses(exportsObjectAlias(mod), name)
+      )
+      or
+      exists(Property prop |
+        node = prop.getInit() and
+        name = prop.getName() and
+        prop.getObjectExpr() = exportsObjectAlias(mod)
+      )
+    }
+
     /** Steps that only apply for this configuration. */
     private predicate specificStep(Node node1, Node node2) {
       exists(LexicalName var | S::isRelevantVariable(var) |

javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected

@@ -2,6 +2,7 @@ spuriousCallee
 missingCallee
 | constructor-field.ts:40:5:40:14 | f3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | calls |
 | constructor-field.ts:71:1:71:11 | bf3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | calls |
+| reExportLibClient.js:4:1:4:6 | ns.f() | lib.js:3:2:3:14 | function() {} | -1 | calls |
 badAnnotation
 accessorCall
 | accessors.js:12:1:12:5 | obj.f | accessors.js:5:8:5:12 | () {} |