JS: Cache PropRef.getBase

asgerf · asgerf · commit cc2a53168438 · 2021-03-26T10:48:25.000Z
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -492,6 +492,7 @@ module DataFlow {
      * Gets the data flow node corresponding to the base object
      * whose property is read from or written to.
      */
+    cached
     abstract Node getBase();
 
     /**
@@ -595,7 +596,10 @@ module DataFlow {
 
     PropLValueAsPropWrite() { astNode instanceof LValue }
 
-    override Node getBase() { result = valueNode(astNode.getBase()) }
+    override Node getBase() {
+      result = valueNode(astNode.getBase()) and
+      Stages::DataFlowStage::ref()
+    }
 
     override Expr getPropertyNameExpr() { result = astNode.getPropertyNameExpr() }
 
diff --git a/javascript/ql/src/semmle/javascript/internal/CachedStages.qll b/javascript/ql/src/semmle/javascript/internal/CachedStages.qll
@@ -133,6 +133,8 @@ module Stages {
       exists(any(DataFlow::Node node).toString())
       or
       exists(any(AccessPath a).getAnInstanceIn(_))
+      or
+      exists(any(DataFlow::PropRef ref).getBase())
     }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -133,6 +133,8 @@ module Stages {`
`133`	`133`	`exists(any(DataFlow::Node node).toString())`
`134`	`134`	`or`
`135`	`135`	`exists(any(AccessPath a).getAnInstanceIn(_))`
	`136`	`+ or`
	`137`	`+ exists(any(DataFlow::PropRef ref).getBase())`
`136`	`138`	`}`
`137`	`139`	`}`
`138`	`140`