Merge pull request #5638 from erik-krogh/smartInliner

codeql-ci · web-flow · commit e8d835b4223b · 2021-04-12T04:17:25.000-07:00
Approved by esbena
diff --git a/javascript/ql/src/semmle/javascript/JSDoc.qll b/javascript/ql/src/semmle/javascript/JSDoc.qll
@@ -144,7 +144,7 @@ class JSDocParamTag extends JSDocTag {
   /** Gets the parameter this tag refers to, if it can be determined. */
   Variable getDocumentedParameter() {
     exists(Parameterized parm | parm.getDocumentation() = getParent() |
-      result = parm.getParameterVariable(getName())
+      result = pragma[only_bind_out](parm).getParameterVariable(getName())
     )
   }
 }
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -96,6 +96,7 @@ module DataFlow {
     predicate accessesGlobal(string g) { globalVarRef(g).flowsTo(this) }
 
     /** Holds if this node may evaluate to the string `s`, possibly through local data flow. */
+    pragma[nomagic]
     predicate mayHaveStringValue(string s) {
       getAPredecessor().mayHaveStringValue(s)
       or
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -688,8 +688,7 @@ module Express {
     override RouteHandler getRouteHandler() { result = rh }
 
     override Expr getNameExpr() {
-      exists(DataFlow::PropWrite write |
-        getAHeaderSource().flowsTo(write.getBase()) and
+      exists(DataFlow::PropWrite write | getAHeaderSource().getAPropertyWrite() = write |
         result = write.getPropertyNameExpr()
       )
     }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll b/javascript/ql/src/semmle/javascript/frameworks/Fastify.qll
@@ -283,8 +283,7 @@ module Fastify {
     override RouteHandler getRouteHandler() { result = rh }
 
     override Expr getNameExpr() {
-      exists(DataFlow::PropWrite write |
-        this.getAHeaderSource().flowsTo(write.getBase()) and
+      exists(DataFlow::PropWrite write | getAHeaderSource().getAPropertyWrite() = write |
         result = write.getPropertyNameExpr()
       )
     }

Original file line number	Diff line number	Diff line change
`@@ -144,7 +144,7 @@ class JSDocParamTag extends JSDocTag {`
`144`	`144`	`/** Gets the parameter this tag refers to, if it can be determined. */`
`145`	`145`	`Variable getDocumentedParameter() {`
`146`	`146`	`exists(Parameterized parm \| parm.getDocumentation() = getParent() \|`
`147`		`- result = parm.getParameterVariable(getName())`
	`147`	`+ result = pragma[only_bind_out](parm).getParameterVariable(getName())`
`148`	`148`	`)`
`149`	`149`	`}`
`150`	`150`	`}`
Original file line number	Diff line number	Diff line change
`@@ -688,8 +688,7 @@ module Express {`
`688`	`688`	`override RouteHandler getRouteHandler() { result = rh }`
`689`	`689`
`690`	`690`	`override Expr getNameExpr() {`
`691`		`- exists(DataFlow::PropWrite write \|`
`692`		`- getAHeaderSource().flowsTo(write.getBase()) and`
	`691`	`+ exists(DataFlow::PropWrite write \| getAHeaderSource().getAPropertyWrite() = write \|`
`693`	`692`	`result = write.getPropertyNameExpr()`
`694`	`693`	`)`
`695`	`694`	`}`
Original file line number	Diff line number	Diff line change
`@@ -283,8 +283,7 @@ module Fastify {`
`283`	`283`	`override RouteHandler getRouteHandler() { result = rh }`
`284`	`284`
`285`	`285`	`override Expr getNameExpr() {`
`286`		`- exists(DataFlow::PropWrite write \|`
`287`		`- this.getAHeaderSource().flowsTo(write.getBase()) and`
	`286`	`+ exists(DataFlow::PropWrite write \| getAHeaderSource().getAPropertyWrite() = write \|`
`288`	`287`	`result = write.getPropertyNameExpr()`
`289`	`288`	`)`
`290`	`289`	`}`