Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit be67d51

Browse files
author
Max Schaefer
committed
JavaScript: Add QL library support for E4X.
1 parent 5a89024 commit be67d51

3 files changed

Lines changed: 110 additions & 2 deletions

File tree

javascript/ql/src/javascript.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import semmle.javascript.Concepts
1414
import semmle.javascript.Constants
1515
import semmle.javascript.DefUse
1616
import semmle.javascript.DOM
17+
import semmle.javascript.E4X
1718
import semmle.javascript.EmailClients
1819
import semmle.javascript.Errors
1920
import semmle.javascript.ES2015Modules
Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
/**
2+
* Provides classes for working with E4X.
3+
*/
4+
5+
import javascript
6+
7+
module E4X {
8+
/**
9+
* An E4X wildcard pseudo-identifier.
10+
*/
11+
class XMLAnyName extends Expr, @e4x_xml_anyname {
12+
}
13+
14+
/**
15+
* An E4X qualified identifier of the form `q::n` or `q::[expr]`.
16+
*/
17+
class XMLQualifiedIdentifier extends Expr, @e4x_xml_qualident {
18+
/**
19+
* Gets the left operand of this qualified identifier, which is either
20+
* an identifier or a wildcard.
21+
*/
22+
Expr getLeft() { result = getChildExpr(0) }
23+
24+
/**
25+
* Gets the right operand of this qualified identifer, which is either
26+
* an identifier, or an arbitrary expression for computed qualified
27+
* identifiers.
28+
*/
29+
Expr getRight() { result = getChildExpr(1) }
30+
31+
/**
32+
* Holds if this is a qualified identifier with a computed name, as in
33+
* `q::[expr]`.
34+
*/
35+
predicate isComputed() { this instanceof @e4x_xml_dynamic_qualident }
36+
37+
override ControlFlowNode getFirstControlFlowNode() {
38+
result = getLeft().getFirstControlFlowNode()
39+
}
40+
}
41+
42+
/**
43+
* An E4X attribute selector of the form `@name` or `@[expr]`.
44+
*/
45+
class XMLAttributeSelector extends Expr, @e4x_xml_attribute_selector {
46+
/**
47+
* Gets the selected attribute, which is either a static name (that is, a
48+
* wildcard identifier or a possibly qualified name), or an arbitrary
49+
* expression for computed attribute selectors.
50+
*/
51+
Expr getAttribute() { result = getChildExpr(0) }
52+
53+
/**
54+
* Holds if this is an attribute selector with a computed name, as in
55+
* `@[expr]`.
56+
*/
57+
predicate isComputed() { this instanceof @e4x_xml_dynamic_attribute_selector }
58+
59+
override ControlFlowNode getFirstControlFlowNode() {
60+
result = getAttribute().getFirstControlFlowNode()
61+
}
62+
}
63+
64+
/**
65+
* An E4X filter expression of the form `left.(right)`.
66+
*/
67+
class XMLFilterExpression extends Expr, @e4x_xml_filter_expression {
68+
/**
69+
* Gets the left operand of this filter expression.
70+
*/
71+
Expr getLeft() { result = getChildExpr(0) }
72+
73+
/**
74+
* Gets the right operand of this filter expression.
75+
*/
76+
Expr getRight() { result = getChildExpr(1) }
77+
78+
override ControlFlowNode getFirstControlFlowNode() {
79+
result = getLeft().getFirstControlFlowNode()
80+
}
81+
}
82+
83+
/**
84+
* An E4X "dot-dot" expression of the form `e..id`.
85+
*/
86+
class XMLDotDotExpression extends Expr, @e4x_xml_dotdotexpr {
87+
/**
88+
* Gets the base expression of this dot-dot expression.
89+
*/
90+
Expr getBase() { result = getChildExpr(0) }
91+
92+
/**
93+
* Gets the index expression of this dot-dot expression.
94+
*/
95+
Expr getIndex() { result = getChildExpr(1) }
96+
97+
override ControlFlowNode getFirstControlFlowNode() {
98+
result = getBase().getFirstControlFlowNode()
99+
}
100+
}
101+
}

javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1078,8 +1078,14 @@ module DataFlow {
10781078
nd.asExpr() instanceof ExternalModuleReference and
10791079
cause = "import"
10801080
or
1081-
nd.asExpr() instanceof PropAccess and
1082-
cause = "heap"
1081+
exists (Expr e | e = nd.asExpr() and cause = "heap" |
1082+
e instanceof PropAccess or
1083+
e instanceof E4X::XMLAnyName or
1084+
e instanceof E4X::XMLAttributeSelector or
1085+
e instanceof E4X::XMLDotDotExpression or
1086+
e instanceof E4X::XMLFilterExpression or
1087+
e instanceof E4X::XMLQualifiedIdentifier
1088+
)
10831089
or
10841090
exists(Expr e | e = nd.asExpr() |
10851091
(e instanceof YieldExpr or e instanceof FunctionSentExpr) and

0 commit comments

Comments
 (0)