github / github/codeql

[JS]General issue: ES6 Analysis Seems Unsupported

Open
#20,261 3 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

## **ES6 Analysis Seems Unsupported**

When I use:

```javascript
const { chromium } = require('playwright');

// ... other code ...

const newBrowser = await chromium.launch({ headless: true });
```

The following CodeQL cannot track the variable `chromium`:

```ql
SourceNode playwright(TypeTracker t) {
t.start() and
(
result = globalVarRef("chromium")
or
result = moduleImport("playwright")
)
or
exists(TypeTracker t2 |
result = playwright(t2).track(t2, t)
)
}

SourceNode playwright() {
result = playwright(TypeTracker::end())
}

SourceNode playwrightLaunch(TypeTracker t) {
t.start() and
result = playwright().getAMethodCall("launch")
or
exists(TypeTracker t2 |
result = playwrightLaunch(t2).track(t2, t)
)
}

SourceNode playwrightLaunch() {
result = playwrightLaunch(TypeTracker::end())
}
```

However, if it is:

```javascript
const path = require('path');

// ... other code ...

path.join(...);
```

It works!

So, what should I do to track `chromium` in `{chromium}`?

Looking forward to your response.

Contributor guide

Open the contributing guide

Research direction

Start with the provided JavaScript destructuring example and the CodeQL entry points `globalVarRef("chromium")`, `moduleImport("playwright")`, and the `playwright` and `playwrightLaunch` predicates. Compare their behavior with the working `path.join(...)` example; done means the analysis tracks `chromium` from `{ chromium }` through `chromium.launch(...)`.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.