JS: introduce SsaVarAccessWithNonLocalAnalysis

Esben Sparre Andreasen · Esben Sparre Andreasen · commit 0d1f4270d68e · 2019-01-29T10:20:36.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll
@@ -41,6 +41,27 @@ private class SsaVarAccessAnalysis extends DataFlow::AnalyzedValueNode {
   override AbstractValue getALocalValue() { result = def.getAnRhsValue() }
 }
 
+/**
+ * Flow analysis for accesses to SSA variables.
+ *
+ * Unlike `SsaVarAccessAnalysis`, this only contributes to `getAValue()`, not `getALocalValue()`.
+ */
+private class SsaVarAccessWithNonLocalAnalysis extends SsaVarAccessAnalysis {
+  DataFlow::AnalyzedValueNode src;
+
+  SsaVarAccessWithNonLocalAnalysis() {
+    exists(VarDef varDef |
+      varDef = def.(SsaExplicitDefinition).getDef() and
+      varDef.getSource().flow() = src and
+      src instanceof CallWithNonLocalAnalyzedReturnFlow and
+      // avoid relating `v` and `f()` in `var {v} = f();`
+      not varDef.getTarget() instanceof DestructuringPattern
+    )
+  }
+
+  override AbstractValue getAValue() { result = src.getAValue() }
+}
+
 /**
  * Flow analysis for `VarDef`s.
  */
diff --git a/javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.expected b/javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.expected
@@ -26,7 +26,9 @@
 | UselessConditional.js:135:6:135:32 | constan ... ined1() | This call to constantFalseOrUndefined1 always evaluates to false. |
 | UselessConditional.js:139:6:139:32 | constan ... ined2() | This call to constantFalseOrUndefined2 always evaluates to false. |
 | UselessConditional.js:148:6:148:8 | p() | This call to p always evaluates to true. |
+| UselessConditional.js:151:6:151:6 | v | This use of variable 'v' always evaluates to true. |
 | UselessConditional.js:163:5:163:17 | findOrThrow() | This call to findOrThrow always evaluates to true. |
+| UselessConditional.js:166:6:166:6 | v | This use of variable 'v' always evaluates to true. |
 | UselessConditionalGood.js:58:12:58:13 | x2 | This use of variable 'x2' always evaluates to false. |
 | UselessConditionalGood.js:69:12:69:13 | xy | This use of variable 'xy' always evaluates to false. |
 | UselessConditionalGood.js:85:12:85:13 | xy | This use of variable 'xy' always evaluates to false. |
