JS: Use defSourceNode from getRhsNode

asger-semmle · asger-semmle · commit 28efadea735c · 2019-07-23T17:14:56.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/SSA.qll b/javascript/ql/src/semmle/javascript/SSA.qll
@@ -527,20 +527,7 @@ class SsaExplicitDefinition extends SsaDefinition, TExplicitDef {
    * if any.
    */
   DataFlow::Node getRhsNode() {
-    exists(VarDef def | def = getDef() |
-      result = def.getSource().flow()
-      or
-      exists(VarRef ref |
-        ref = getSourceVariable().getAReference() and
-        def.getTarget().(BindingPattern).getABindingVarRef() = ref and
-        result = DataFlow::patternPropRead(ref)
-      )
-      or
-      result = DataFlow::parameterNode(def)
-      or
-      // Handle class, function, namespace, and enum declaration statement
-      result.getAstNode() = def.(Stmt)
-    )
+    result = DataFlow::defSourceNode(getDef(), getSourceVariable())
   }
 }
 
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1318,10 +1318,12 @@ module DataFlow {
   }
 
   /**
+   * INTERNAL. DO NOT USE.
+   *
    * Gets the data flow node representing the source of the definition of `v` at `def`,
    * if any.
    */
-  private Node defSourceNode(VarDef def, SsaSourceVariable v) {
+  Node defSourceNode(VarDef def, SsaSourceVariable v) {
     exists(BindingPattern lhs, VarRef r |
       lhs = def.getTarget() and r = lhs.getABindingVarRef() and r.getVariable() = v
     |
diff --git a/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected b/javascript/ql/test/library-tests/GlobalAccessPaths/GlobalAccessPaths.expected
@@ -50,6 +50,12 @@ test_fromReference
 | test.js:24:9:24:10 | NS | NS |
 | test.js:24:9:24:16 | NS \|\| {} | NS |
 | test.js:26:1:26:8 | Conflict | Conflict |
+| test.js:33:7:33:18 | { bar = {} } | foo |
+| test.js:33:7:33:24 | bar | foo.bar |
+| test.js:33:9:33:16 | bar = {} | foo.bar |
+| test.js:33:22:33:24 | foo | foo |
+| test.js:34:11:34:13 | bar | foo.bar |
+| test.js:34:11:34:17 | bar.baz | foo.bar.baz |
 test_fromRhs
 | other_ns.js:4:9:4:16 | NS \|\| {} | NS |
 | other_ns.js:6:12:6:13 | {} | Conflict |
@@ -58,7 +64,9 @@ test_fromRhs
 | test.js:26:12:26:13 | {} | Conflict |
 | test.js:28:1:28:20 | class GlobalClass {} | GlobalClass |
 | test.js:30:1:30:28 | functio ... on() {} | globalFunction |
+| test.js:32:1:35:1 | functio ... .baz'\\n} | destruct |
 test_assignedUnique
 | GlobalClass |
+| destruct |
 | f |
 | globalFunction |
diff --git a/javascript/ql/test/library-tests/GlobalAccessPaths/test.js b/javascript/ql/test/library-tests/GlobalAccessPaths/test.js
@@ -28,3 +28,8 @@ Conflict = {}; // assigned in multiple files
 class GlobalClass {}
 
 function globalFunction() {}
+
+function destruct() {
+  let { bar = {} } = foo;
+  let v = bar.baz; // 'foo.bar.baz'
+}

Original file line number	Diff line number	Diff line change
`@@ -1318,10 +1318,12 @@ module DataFlow {`
`1318`	`1318`	`}`
`1319`	`1319`
`1320`	`1320`	`/**`
	`1321`	`+ * INTERNAL. DO NOT USE.`
	`1322`	`+ *`
`1321`	`1323`	* Gets the data flow node representing the source of the definition of `v` at `def`,
`1322`	`1324`	`* if any.`
`1323`	`1325`	`*/`
`1324`		`- private Node defSourceNode(VarDef def, SsaSourceVariable v) {`
	`1326`	`+ Node defSourceNode(VarDef def, SsaSourceVariable v) {`
`1325`	`1327`	`exists(BindingPattern lhs, VarRef r \|`
`1326`	`1328`	`lhs = def.getTarget() and r = lhs.getABindingVarRef() and r.getVariable() = v`
`1327`	`1329`	`\|`