github / github/codeql

[JS]General issue: ES6 Analysis Seems Unsupported

Ouverte
#20,261 3 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
question
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

## **ES6 Analysis Seems Unsupported**

When I use:

```javascript
const { chromium } = require('playwright');

// ... other code ...

const newBrowser = await chromium.launch({ headless: true });
```

The following CodeQL cannot track the variable `chromium`:

```ql
SourceNode playwright(TypeTracker t) {
t.start() and
(
result = globalVarRef("chromium")
or
result = moduleImport("playwright")
)
or
exists(TypeTracker t2 |
result = playwright(t2).track(t2, t)
)
}

SourceNode playwright() {
result = playwright(TypeTracker::end())
}

SourceNode playwrightLaunch(TypeTracker t) {
t.start() and
result = playwright().getAMethodCall("launch")
or
exists(TypeTracker t2 |
result = playwrightLaunch(t2).track(t2, t)
)
}

SourceNode playwrightLaunch() {
result = playwrightLaunch(TypeTracker::end())
}
```

However, if it is:

```javascript
const path = require('path');

// ... other code ...

path.join(...);
```

It works!

So, what should I do to track `chromium` in `{chromium}`?

Looking forward to your response.

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start with the provided JavaScript destructuring example and the CodeQL entry points `globalVarRef("chromium")`, `moduleImport("playwright")`, and the `playwright` and `playwrightLaunch` predicates. Compare their behavior with the working `path.join(...)` example; done means the analysis tracks `chromium` from `{ chromium }` through `chromium.launch(...)`.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
javascript
Domaine
security
Type d'issue
Bug
Difficulté
3/5
Temps estimé
1-2 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.