JS: treat +/- equally in suffix check query

asger-semmle · asger-semmle · commit d79342763023 · 2019-02-13T15:55:19.000Z
diff --git a/javascript/ql/src/Security/CWE-020/IncorrectSuffixCheck.ql b/javascript/ql/src/Security/CWE-020/IncorrectSuffixCheck.ql
@@ -95,9 +95,9 @@ predicate isDerivedFromLength(DataFlow::Node length, DataFlow::Node operand) {
   or
   isDerivedFromLength(length.getAPredecessor(), operand)
   or
-  exists(SubExpr sub |
-    isDerivedFromLength(sub.getAnOperand().flow(), operand) and
-    length = sub.flow()
+  exists(BinaryExpr expr | expr instanceof SubExpr or expr instanceof AddExpr |
+    isDerivedFromLength(expr.getAnOperand().flow(), operand) and
+    length = expr.flow()
   )
 }
 

Original file line number	Diff line number	Diff line change
`@@ -95,9 +95,9 @@ predicate isDerivedFromLength(DataFlow::Node length, DataFlow::Node operand) {`
`95`	`95`	`or`
`96`	`96`	`isDerivedFromLength(length.getAPredecessor(), operand)`
`97`	`97`	`or`
`98`		`- exists(SubExpr sub \|`
`99`		`- isDerivedFromLength(sub.getAnOperand().flow(), operand) and`
`100`		`- length = sub.flow()`
	`98`	`+ exists(BinaryExpr expr \| expr instanceof SubExpr or expr instanceof AddExpr \|`
	`99`	`+ isDerivedFromLength(expr.getAnOperand().flow(), operand) and`
	`100`	`+ length = expr.flow()`
`101`	`101`	`)`
`102`	`102`	`}`
`103`	`103`