JS: Add getBoundFunction()

asger-semmle · asger-semmle · commit d6ba966c4e98 · 2019-10-09T12:16:10.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -359,6 +359,9 @@ class ArrayLiteralNode extends DataFlow::ValueNode, DataFlow::SourceNode {
 
   /** Gets an element of this array literal. */
   DataFlow::ValueNode getAnElement() { result = DataFlow::valueNode(astNode.getAnElement()) }
+
+  /** Gets the initial size of this array. */
+  int getSize() { result = astNode.getSize() }
 }
 
 /** A data flow node corresponding to a `new Array()` or `Array()` invocation. */
@@ -376,6 +379,14 @@ class ArrayConstructorInvokeNode extends DataFlow::InvokeNode {
     getNumArgument() > 1 and
     result = getAnArgument()
   }
+
+  /** Gets the initial size of the created array, if it can be determined. */
+  int getSize() {
+    if getNumArgument() = 1 then
+      result = getArgument(0).getIntValue()
+    else
+      result = count(getAnElement())
+  }
 }
 
 /**
@@ -396,6 +407,12 @@ class ArrayCreationNode extends DataFlow::ValueNode, DataFlow::SourceNode {
 
   /** Gets an initial element of this array, if one if provided. */
   DataFlow::ValueNode getAnElement() { result = getElement(_) }
+
+  /** Gets the initial size of the created array, if it can be determined. */
+  int getSize() {
+    result = this.(ArrayLiteralNode).getSize() or
+    result = this.(ArrayConstructorInvokeNode).getSize()
+  }
 }
 
 /**
@@ -991,6 +1008,11 @@ private class BindPartialCall extends AdditionalPartialInvokeNode, DataFlow::Met
     callback = getReceiver() and
     argument = getArgument(index + 1)
   }
+
+  override DataFlow::SourceNode getBoundFunction(int boundArgs) {
+    boundArgs = getNumArgument() - 1 and
+    result = this
+  }
 }
 
 /**
@@ -1004,6 +1026,11 @@ private class LodashPartialCall extends AdditionalPartialInvokeNode {
     callback = getArgument(0) and
     argument = getArgument(index + 1)
   }
+
+  override DataFlow::SourceNode getBoundFunction(int boundArgs) {
+    boundArgs = getNumArgument() - 1 and
+    result = this
+  }
 }
 
 /**
@@ -1020,4 +1047,9 @@ private class RamdaPartialCall extends AdditionalPartialInvokeNode {
     callback = getArgument(0) and
     argument = getArgumentsArray().getElement(index)
   }
+
+  override DataFlow::SourceNode getBoundFunction(int boundArgs) {
+    boundArgs = getArgumentsArray().getSize() and
+    result = this
+  }
 }
