add .getALocalSource() when testing for lodash-members

erik-krogh · erik-krogh · commit 28056791a57d · 2019-10-14T14:14:26.000+02:00
diff --git a/javascript/ql/src/Statements/UseOfReturnlessFunction.ql b/javascript/ql/src/Statements/UseOfReturnlessFunction.ql
@@ -113,8 +113,8 @@ DataFlow::SourceNode array(DataFlow::TypeTracker t) {
 
 DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }
 
-predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {
-  hasNonVoidCallbackMethod(call.getMethodName()) and
+predicate voidArrayCallback(DataFlow::CallNode call, Function func) {
+  hasNonVoidCallbackMethod(call.getCalleeName()) and
   func = call.getAnArgument().getALocalSource().asExpr() and
   1 = count(DataFlow::Node arg | arg = call.getAnArgument() and arg.getALocalSource().asExpr() instanceof Function) and
   returnsVoid(func) and
@@ -123,7 +123,7 @@ predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {
   (
     call.getReceiver().getALocalSource() = array()
     or
-    call.getCalleeNode() instanceof LodashUnderscore::Member
+    call.getCalleeNode().getALocalSource() instanceof LodashUnderscore::Member
   )
 }
 
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/UseOfReturnlessFunction.expected
@@ -4,3 +4,4 @@
 | tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:11:5:13:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
 | tst.js:53:10:53:34 | bothOnl ... fects() | the $@ does not return anything, yet the return value is used. | tst.js:48:2:50:5 | functio ... )\\n    } | function bothOnlyHaveSideEffects |
 | tst.js:76:12:76:46 | [1,2,3] ... n, 3)}) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:76:27:76:45 | n => {equals(n, 3)} | callback function |
+| tst.js:80:12:80:50 | filter( ...  3) } ) | the $@ does not return anything, yet the return value from the call to filter() is used. | tst.js:80:28:80:48 | x => {  ... x, 3) } | callback function |
diff --git a/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js b/javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
@@ -75,4 +75,8 @@
 	
 	var foo = [1,2,3].filter(n => {equals(n, 3)}) // NOT OK!
 	console.log(foo);
+	
+	import { filter } from 'lodash'
+	var bar = filter([1,2,4], x => { equals(x, 3) } ) // NOT OK!
+	console.log(bar);
 })();

Original file line number	Diff line number	Diff line change
`@@ -113,8 +113,8 @@ DataFlow::SourceNode array(DataFlow::TypeTracker t) {`
`113`	`113`
`114`	`114`	`DataFlow::SourceNode array() { result = array(DataFlow::TypeTracker::end()) }`
`115`	`115`
`116`		`-predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {`
`117`		`- hasNonVoidCallbackMethod(call.getMethodName()) and`
	`116`	`+predicate voidArrayCallback(DataFlow::CallNode call, Function func) {`
	`117`	`+ hasNonVoidCallbackMethod(call.getCalleeName()) and`
`118`	`118`	`func = call.getAnArgument().getALocalSource().asExpr() and`
`119`	`119`	`1 = count(DataFlow::Node arg \| arg = call.getAnArgument() and arg.getALocalSource().asExpr() instanceof Function) and`
`120`	`120`	`returnsVoid(func) and`
`@@ -123,7 +123,7 @@ predicate voidArrayCallback(DataFlow::MethodCallNode call, Function func) {`
`123`	`123`	`(`
`124`	`124`	`call.getReceiver().getALocalSource() = array()`
`125`	`125`	`or`
`126`		`- call.getCalleeNode() instanceof LodashUnderscore::Member`
	`126`	`+ call.getCalleeNode().getALocalSource() instanceof LodashUnderscore::Member`
`127`	`127`	`)`
`128`	`128`	`}`
`129`	`129`