JS: Fix perf issue in data flow step generation

asgerf · asgerf · commit 635ac0a209d1 · 2021-12-07T10:46:18.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/Routing.qll b/javascript/ql/lib/semmle/javascript/Routing.qll
@@ -907,13 +907,15 @@ module Routing {
   /**
    * Like `getAnAccessPathRhs` but with `base` mapped to its root node.
    */
+  pragma[nomagic]
   private DataFlow::Node getAnAccessPathRhsUnderRoot(RootNode root, int n, string path) {
     result = getAnAccessPathRhs(root.getADescendant(), n, path)
   }
 
   /**
    * Like `getAnAccessPathRead` but with `base` mapped to its root node.
    */
+  pragma[nomagic]
   private DataFlow::SourceNode getAnAccessPathReadUnderRoot(RootNode root, int n, string path) {
     result = getAnAccessPathRead(root.getADescendant(), n, path)
   }
@@ -928,7 +930,7 @@ module Routing {
   private predicate middlewareApiStep(DataFlow::SourceNode pred, DataFlow::SourceNode succ) {
     exists(RootNode root, int n, string path |
       pred = getAnAccessPathRhsUnderRoot(root, n, path) and
-      succ = getAnAccessPathReadUnderRoot(root, n, path)
+      succ = getAnAccessPathReadUnderRoot(root, n, pragma[only_bind_out](path))
     )
     or
     // We can't augment the call graph as this depends on type tracking, so just
@@ -947,13 +949,21 @@ module Routing {
     }
   }
 
+  pragma[nomagic]
+  private predicate potentialAccessPathStep(
+    Node writer, DataFlow::SourceNode pred, Node reader, DataFlow::SourceNode succ, int n,
+    string path
+  ) {
+    pred = getAnAccessPathRhs(writer, n, path) and
+    succ = getAnAccessPathRead(reader, n, pragma[only_bind_out](path))
+  }
+
   /**
    * Holds if `pred -> succ` is a data-flow step between access paths on request input objects.
    */
   private predicate middlewareDataFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
     exists(Node writer, Node reader, int n, string path |
-      pred = getAnAccessPathRhs(writer, n, path) and
-      succ = getAnAccessPathRead(reader, n, path) and
+      potentialAccessPathStep(writer, pred, reader, succ, n, path) and
       pragma[only_bind_out](reader).isGuardedByNode(pragma[only_bind_out](writer))
     )
     or
