Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit dc8123d

Browse files
semmle-qlcisemmle-qlci
authored
Merge pull request #1355 from xiemaisi/js/data-flow-api-fiddling
Approved by asger-semmle
2 parents c100c70 + 7b7f92c commit dc8123d

10 files changed

Lines changed: 39 additions & 45 deletions

File tree

‎javascript/ql/src/semmle/javascript/RangeAnalysis.qll‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -126,9 +126,7 @@ module RangeAnalysis {
126126
* the given increment/decrement expression.
127127
*/
128128
private DataFlow::Node updateExprResult(UpdateExpr expr) {
129-
exists(SsaExplicitDefinition def | def.getDef() = expr |
130-
result = DataFlow::ssaDefinitionNode(def)
131-
)
129+
result = DataFlow::ssaDefinitionNode(SSA::definition(expr))
132130
or
133131
expr.isPrefix() and
134132
result = expr.flow()
@@ -138,9 +136,7 @@ module RangeAnalysis {
138136
* Gets a data flow node holding the result of the given componund assignment.
139137
*/
140138
private DataFlow::Node compoundAssignResult(CompoundAssignExpr expr) {
141-
exists(SsaExplicitDefinition def | def.getDef() = expr |
142-
result = DataFlow::ssaDefinitionNode(def)
143-
)
139+
result = DataFlow::ssaDefinitionNode(SSA::definition(expr))
144140
or
145141
result = expr.flow()
146142
}

‎javascript/ql/src/semmle/javascript/SSA.qll‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -699,3 +699,11 @@ class SsaRefinementNode extends SsaPseudoDefinition, TRefinement {
699699
getGuard().getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
700700
}
701701
}
702+
703+
module SSA {
704+
/** Gets the SSA definition corresponding to `d`. */
705+
SsaExplicitDefinition definition(VarDef d) { result.getDef() = d }
706+
707+
/** Gets the SSA variable corresponding to `d`. */
708+
SsaVariable variable(VarDef d) { result.getDefinition() = definition(d) }
709+
}

‎javascript/ql/src/semmle/javascript/StringConcatenation.qll‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ module StringConcatenation {
99
private DataFlow::Node getAssignAddResult(AssignAddExpr expr) {
1010
result = expr.flow()
1111
or
12-
exists(SsaExplicitDefinition def | def.getDef() = expr |
13-
result = DataFlow::ssaDefinitionNode(def)
14-
)
12+
result = DataFlow::ssaDefinitionNode(SSA::definition(expr))
1513
}
1614

1715
/** Gets the `n`th operand to the string concatenation defining `node`. */

‎javascript/ql/src/semmle/javascript/Variables.qll‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,7 @@ class ArgumentsVariable extends Variable {
217217
/** An identifier that refers to a variable, either in a declaration or in a variable access. */
218218
class VarRef extends @varref, Identifier, BindingPattern, LexicalRef {
219219
/** Gets the variable this identifier refers to. */
220-
Variable getVariable() { none() } // Overriden in VarAccess and VarDecl
220+
override Variable getVariable() { none() } // Overriden in VarAccess and VarDecl
221221

222222
override string getName() { result = Identifier.super.getName() }
223223

@@ -316,6 +316,9 @@ class BindingPattern extends @pattern, Expr {
316316
/** Gets the name of this binding pattern if it is an identifier. */
317317
string getName() { none() }
318318

319+
/** Gets the variable this binding pattern refers to if it is an identifier. */
320+
Variable getVariable() { none() }
321+
319322
/** Gets a variable reference in binding position within this pattern. */
320323
VarRef getABindingVarRef() { none() }
321324

‎javascript/ql/src/semmle/javascript/dataflow/Configuration.qll‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -378,11 +378,8 @@ private class FlowStepThroughImport extends AdditionalFlowStep, DataFlow::ValueN
378378
override ImportSpecifier astNode;
379379

380380
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
381-
exists(SsaExplicitDefinition ssa |
382-
pred = this and
383-
ssa.getDef() = astNode and
384-
succ = DataFlow::ssaDefinitionNode(ssa)
385-
)
381+
pred = this and
382+
succ = DataFlow::ssaDefinitionNode(SSA::definition(astNode))
386383
}
387384
}
388385

@@ -927,9 +924,7 @@ class PathNode extends TPathNode {
927924
}
928925

929926
/** Gets a successor node of this path node. */
930-
PathNode getASuccessor() {
931-
result = getASuccessorInternal().getAHiddenSuccessor*()
932-
}
927+
PathNode getASuccessor() { result = getASuccessorInternal().getAHiddenSuccessor*() }
933928

934929
/** Gets a textual representation of this path node. */
935930
string toString() { result = nd.toString() }
@@ -953,7 +948,8 @@ class PathNode extends TPathNode {
953948
*/
954949
predicate isHidden() {
955950
// Skip phi, refinement, and capture nodes
956-
nd.(DataFlow::SsaDefinitionNode).getSsaVariable().getDefinition() instanceof SsaImplicitDefinition
951+
nd.(DataFlow::SsaDefinitionNode).getSsaVariable().getDefinition() instanceof
952+
SsaImplicitDefinition
957953
or
958954
// Skip to the top of big left-leaning string concatenation trees.
959955
nd = any(AddExpr add).flow() and

‎javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ module DataFlow {
3636
} or
3737
TThisNode(StmtContainer f) { f.(Function).getThisBinder() = f or f instanceof TopLevel } or
3838
TUnusedParameterNode(SimpleParameter p) {
39-
not exists(SsaExplicitDefinition ssa | p = ssa.getDef())
39+
not exists(SSA::definition(p))
4040
} or
4141
TDestructuredModuleImportNode(ImportDeclaration decl) {
4242
exists(decl.getASpecifier().getImportedName())
@@ -718,10 +718,7 @@ module DataFlow {
718718
ImportSpecifierAsPropRead() {
719719
spec = imprt.getASpecifier() and
720720
exists(spec.getImportedName()) and
721-
exists(SsaExplicitDefinition ssa |
722-
ssa.getDef() = spec and
723-
this = TSsaDefNode(ssa)
724-
)
721+
this = ssaDefinitionNode(SSA::definition(spec))
725722
}
726723

727724
override Node getBase() { result = TDestructuredModuleImportNode(imprt) }
@@ -980,6 +977,11 @@ module DataFlow {
980977
*/
981978
ValueNode valueNode(ASTNode nd) { result.getAstNode() = nd }
982979

980+
/**
981+
* Gets the data flow node corresponding to `e`.
982+
*/
983+
ExprNode exprNode(Expr e) { result = valueNode(e) }
984+
983985
/** Gets the data flow node corresponding to `ssa`. */
984986
SsaDefinitionNode ssaDefinitionNode(SsaDefinition ssa) { result = TSsaDefNode(ssa) }
985987

@@ -990,11 +992,7 @@ module DataFlow {
990992
* INTERNAL: Use `parameterNode(Parameter)` instead.
991993
*/
992994
predicate parameterNode(DataFlow::Node nd, Parameter p) {
993-
exists(SsaExplicitDefinition ssa |
994-
nd = ssaDefinitionNode(ssa) and
995-
p = ssa.getDef() and
996-
p instanceof SimpleParameter
997-
)
995+
nd = ssaDefinitionNode(SSA::definition((SimpleParameter)p))
998996
or
999997
nd = TDestructuringPatternNode(p)
1000998
or

‎javascript/ql/src/semmle/javascript/dataflow/Nodes.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@
66

77
import javascript
88

9+
/** A data flow node corresponding to an expression. */
10+
class ExprNode extends DataFlow::ValueNode {
11+
override Expr astNode;
12+
}
13+
914
/** A data flow node corresponding to a parameter. */
1015
class ParameterNode extends DataFlow::SourceNode {
1116
Parameter p;
@@ -467,11 +472,10 @@ module ModuleImportNode {
467472
)
468473
or
469474
// `import * as http from 'http'` or `import http from `http`'
470-
exists(ImportDeclaration id, ImportSpecifier is, SsaExplicitDefinition ssa |
475+
exists(ImportDeclaration id, ImportSpecifier is |
471476
id.getImportedPath().getValue() = path and
472477
is = id.getASpecifier() and
473-
ssa.getDef() = is and
474-
this = DataFlow::ssaDefinitionNode(ssa)
478+
this = DataFlow::ssaDefinitionNode(SSA::definition(is))
475479
|
476480
is instanceof ImportNamespaceSpecifier and
477481
count(id.getASpecifier()) = 1

‎javascript/ql/src/semmle/javascript/dataflow/Sources.qll‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -223,11 +223,7 @@ module SourceNode {
223223
astNode instanceof RegExpLiteral
224224
)
225225
or
226-
exists(SsaExplicitDefinition ssa, VarDef def |
227-
this = DataFlow::ssaDefinitionNode(ssa) and def = ssa.getDef()
228-
|
229-
def instanceof ImportSpecifier
230-
)
226+
this = DataFlow::ssaDefinitionNode(SSA::definition(any(ImportSpecifier imp)))
231227
or
232228
DataFlow::parameterNode(this, _)
233229
or

‎javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -198,11 +198,10 @@ module TaintTracking {
198198
succ.(DataFlow::PropRead).getBase() = pred
199199
or
200200
// iterating over a tainted iterator taints the loop variable
201-
exists(EnhancedForLoop efl, SsaExplicitDefinition ssa |
201+
exists(EnhancedForLoop efl |
202202
this = DataFlow::valueNode(efl.getIterationDomain()) and
203203
pred = this and
204-
ssa.getDef() = efl.getIteratorExpr() and
205-
succ = DataFlow::ssaDefinitionNode(ssa)
204+
succ = DataFlow::ssaDefinitionNode(SSA::definition(efl.getIteratorExpr()))
206205
)
207206
}
208207
}

‎javascript/ql/src/semmle/javascript/security/SensitiveActions.qll‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,7 @@ private class BasicSensitiveWrite extends SensitiveWrite {
165165
exists(VarDef v | v.getAVariable().getName() = name |
166166
if exists(v.getSource())
167167
then v.getSource() = this.asExpr()
168-
else
169-
exists(SsaExplicitDefinition ssa |
170-
DataFlow::ssaDefinitionNode(ssa) = this and
171-
ssa.getDef() = v
172-
)
168+
else this = DataFlow::ssaDefinitionNode(SSA::definition(v))
173169
)
174170
)
175171
}

0 commit comments

Comments
 (0)