@@ -1077,35 +1077,46 @@ private DataFlow::Node getAwaitOperand(DataFlow::Node await) {
10771077}
10781078
10791079/**
1080- * Holds if `f` may `read` property `prop` of parameter `parm `.
1080+ * Holds if property `prop` of `arg` is read inside a function and returned to the call `succ `.
10811081 */
10821082private predicate parameterPropRead (
1083- Function f , DataFlow:: Node invk , DataFlow :: Node arg , string prop , DataFlow:: Node read ,
1084- DataFlow :: Configuration cfg
1083+ DataFlow:: Node arg , string prop , DataFlow:: Node succ , DataFlow :: Configuration cfg ,
1084+ PathSummary summary
10851085) {
1086- exists ( DataFlow:: SourceNode parm |
1087- callInputStep ( f , invk , arg , parm , cfg ) and
1088- (
1089- read = parm .getAPropertyRead ( prop )
1090- or
1091- exists ( DataFlow:: Node use | parm .flowsTo ( use ) | isAdditionalLoadStep ( use , read , prop , cfg ) )
1086+ exists ( Function f , DataFlow:: Node read , DataFlow:: Node invk |
1087+ not f .isAsyncOrGenerator ( ) and invk = succ
1088+ or
1089+ // load from an immediately awaited function call
1090+ f .isAsync ( ) and
1091+ invk = getAwaitOperand ( succ )
1092+ |
1093+ exists ( DataFlow:: SourceNode parm |
1094+ callInputStep ( f , invk , arg , parm , cfg ) and
1095+ (
1096+ reachesReturn ( f , read , cfg , summary ) and
1097+ read = parm .getAPropertyRead ( prop )
1098+ or
1099+ reachesReturn ( f , read , cfg , summary ) and
1100+ exists ( DataFlow:: Node use | parm .flowsTo ( use ) | isAdditionalLoadStep ( use , read , prop , cfg ) )
1101+ )
10921102 )
10931103 )
10941104}
10951105
10961106/**
1097- * Holds if `nd ` may flow into a return statement of `f` under configuration `cfg`
1107+ * Holds if `read ` may flow into a return statement of `f` under configuration `cfg`
10981108 * (possibly through callees) along a path summarized by `summary`.
10991109 */
11001110private predicate reachesReturn (
1101- Function f , DataFlow:: Node nd , DataFlow:: Configuration cfg , PathSummary summary
1111+ Function f , DataFlow:: Node read , DataFlow:: Configuration cfg , PathSummary summary
11021112) {
1103- isRelevant ( nd , cfg ) and
1104- returnExpr ( f , nd , _) and
1105- summary = PathSummary:: level ( )
1113+ isRelevant ( read , cfg ) and
1114+ returnExpr ( f , read , _) and
1115+ summary = PathSummary:: level ( ) and
1116+ callInputStep ( f , _, _, _, _) // check that a relevant result can exist.
11061117 or
11071118 exists ( DataFlow:: Node mid , PathSummary oldSummary , PathSummary newSummary |
1108- flowStep ( nd , cfg , mid , oldSummary ) and
1119+ flowStep ( read , cfg , mid , oldSummary ) and
11091120 reachesReturn ( f , mid , cfg , newSummary ) and
11101121 summary = oldSummary .append ( newSummary )
11111122 )
@@ -1168,16 +1179,7 @@ private predicate loadStep(
11681179 isAdditionalLoadStep ( pred , succ , prop , cfg ) and
11691180 summary = PathSummary:: level ( )
11701181 or
1171- exists ( Function f , DataFlow:: Node read , DataFlow:: Node invk |
1172- not f .isAsyncOrGenerator ( ) and invk = succ
1173- or
1174- // load from an immediately awaited function call
1175- f .isAsync ( ) and
1176- invk = getAwaitOperand ( succ )
1177- |
1178- parameterPropRead ( f , invk , pred , prop , read , cfg ) and
1179- reachesReturn ( f , read , cfg , summary )
1180- )
1182+ parameterPropRead ( pred , prop , succ , cfg , summary )
11811183}
11821184
11831185/**
0 commit comments