JS: Fix attributes nodes missing an enclosing callable #18973
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
asgerf
force-pushed
the
js/vue-fix
branch
2 times, most recently
from
b3be197 to
2c8da21
Compare
Contributor
There was a problem hiding this comment.
Pull Request Overview
A fix for Vue attribute nodes where attributes were missing an enclosing callable, ensuring that the shared data flow library now properly tracks the flow for the v-html attribute.
- Updated change note file to document the bug fix.
- Added inline test comments in the Vue test file to mark source and alert markers.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| javascript/ql/src/change-notes/2025-03-11-vue-fix.md | Added change notes for the bug fix |
| javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/v-html.vue | Updated test file with inline comments for source and alert markers |
Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more
adityasharad
approved these changes
Mar 11, 2025
Collaborator
adityasharad
left a comment
adityasharad
left a comment
There was a problem hiding this comment.
Looks sensible, thanks for the clear explanation.
| or | ||
| result = this.asLibraryCallable() | ||
| or | ||
| result = this.asFileCallable().toString() |
Collaborator
There was a problem hiding this comment.
I always worry about missing cases like this - this kind of pattern matching feels like a good candidate for a QL-for-QL query :)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Attribute nodes were missing their enclosing callable, which means the shared data flow library was unable to track flow there. As far as I can tell this only affects Vue.
I'm honestly not sure why
DataFlow::XmlAttributeNodeexists since we don't seem to use it for anything 😕.