Update DataFlowImplConsistency.qll

asgerf · asgerf · commit 60c3d077b2fe · 2024-08-27T11:35:17.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowImplConsistency.qll b/javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowImplConsistency.qll
@@ -37,6 +37,12 @@ private module ConsistencyConfig implements InputSig<Location, JSDataFlow> {
     isAmbientNode(call.asOrdinaryCall()) or
     isAmbientNode(call.asAccessorCall())
   }
+
+  predicate argHasPostUpdateExclude(ArgumentNode node) {
+    // Side-effects directly on these can't propagate back to the caller, and for longer access paths it's too imprecise
+    node instanceof TStaticArgumentArrayNode or
+    node instanceof TDynamicArgumentArrayNode
+  }
 }
 
 module Consistency = MakeConsistency<Location, JSDataFlow, JSTaintFlow, ConsistencyConfig>;

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,12 @@ private module ConsistencyConfig implements InputSig<Location, JSDataFlow> {`
`37`	`37`	`isAmbientNode(call.asOrdinaryCall()) or`
`38`	`38`	`isAmbientNode(call.asAccessorCall())`
`39`	`39`	`}`
	`40`	`+`
	`41`	`+ predicate argHasPostUpdateExclude(ArgumentNode node) {`
	`42`	`+ // Side-effects directly on these can't propagate back to the caller, and for longer access paths it's too imprecise`
	`43`	`+ node instanceof TStaticArgumentArrayNode or`
	`44`	`+ node instanceof TDynamicArgumentArrayNode`
	`45`	`+ }`
`40`	`46`	`}`
`41`	`47`
`42`	`48`	`module Consistency = MakeConsistency<Location, JSDataFlow, JSTaintFlow, ConsistencyConfig>;`