TS: Fix infinite type expansion issue

asger-semmle · asger-semmle · commit dc6c33dd1282 · 2019-03-11T11:26:46.000Z
diff --git a/javascript/extractor/lib/typescript/src/type_table.ts b/javascript/extractor/lib/typescript/src/type_table.ts
@@ -23,6 +23,28 @@ function isTypeVariable(type: ts.Type): type is ts.TypeVariable {
   return (type.flags & ts.TypeFlags.TypeVariable) !== 0;
 }
 
+/**
+ * Returns `true` if the properties of the given type can safely be extracted
+ * without restricting expansion depth.
+ *
+ * This predicate is very approximate, and considers all unions, intersections,
+ * named types, and mapped types as potentially unsafe.
+ */
+function isTypeAlwaysSafeToExpand(type: ts.Type): boolean {
+  let flags = type.flags;
+  if (flags & ts.TypeFlags.UnionOrIntersection) {
+    return false;
+  }
+  if (flags & ts.TypeFlags.Object) {
+    let objectType = type as ts.ObjectType;
+    let objectFlags = objectType.objectFlags;
+    if (objectFlags & (ts.ObjectFlags.Reference | ts.ObjectFlags.Mapped)) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /**
  * If `type` is a `this` type, returns the enclosing type.
  * Otherwise returns `null`.
@@ -784,7 +806,7 @@ export class TypeTable {
     while (worklist.length > 0) {
       let [type, id] = worklist.pop();
       let isShallowContext = typeExtractionState[id] === TypeExtractionState.PendingShallow;
-      if (isShallowContext && isTypeReference(type)) {
+      if (isShallowContext && !isTypeAlwaysSafeToExpand(type)) {
         typeExtractionState[id] = TypeExtractionState.DoneShallow;
       } else {
         typeExtractionState[id] = TypeExtractionState.DoneFull;
diff --git a/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/recursiveMappedType.ts b/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/recursiveMappedType.ts
@@ -0,0 +1,8 @@
+interface X {
+    a: RecursiveMappedType<this> & X;
+    b: boolean;
+}
+
+type RecursiveMappedType<V> = {
+    [P in keyof V]?: X & RecursiveMappedType<V[P]>
+}
diff --git a/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/test.expected b/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/test.expected
@@ -0,0 +1,2 @@
+| recursiveMappedType.ts:2:5:2:5 | a | RecursiveMappedType<this> & X |
+| recursiveMappedType.ts:3:5:3:5 | b | boolean |
diff --git a/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/test.ql b/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/test.ql
@@ -0,0 +1,4 @@
+import javascript
+
+from Expr e
+select e, e.getType()
diff --git a/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/tsconfig.json b/javascript/ql/test/library-tests/TypeScript/InfiniteTypes/tsconfig.json
@@ -0,0 +1,3 @@
+{
+  "include": ["."]
+}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+\| recursiveMappedType.ts:2:5:2:5 \| a \| RecursiveMappedType<this> & X \|`
	`2`	`+\| recursiveMappedType.ts:3:5:3:5 \| b \| boolean \|`