JS: Support return value of x++

asger-semmle · asger-semmle · commit 09ca6652fb03 · 2018-11-29T11:22:13.000Z
diff --git a/javascript/ql/src/semmle/javascript/RangeAnalysis.qll b/javascript/ql/src/semmle/javascript/RangeAnalysis.qll
@@ -163,6 +163,12 @@ module RangeAnalysis {
         else
           bias = -1)
       or
+      exists (UpdateExpr update | r.asExpr() = update | // Return value of x++ is just x (coerced to an int)
+        root = update.getOperand().flow() and
+        not update.isPrefix() and
+        sign = 1 and
+        bias = 0)
+      or
       exists (CompoundAssignExpr assign | r = compoundAssignResult(assign) |
         root = assign.getLhs().flow() and
         sign = 1 and
diff --git a/javascript/ql/test/library-tests/RangeAnalysis/plus.js b/javascript/ql/test/library-tests/RangeAnalysis/plus.js
@@ -26,3 +26,8 @@ function g(x) {
   if (z < x + 5) {} // NOT OK - always true
   if (z > x + 5) {} // NOT OK - always false 
 }
+
+function h(x) {
+  let y = x++;
+  if (x > y) {} // NOT OK - always true
+}
