github / github/codeql

JavaScript: Restricting `isSource` predicate leads to more alerts

Ouverte
#7,790 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub
bug JS
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

I have the following test file for the `UnvalidatedDynamicMethodCall` query:

```js
var express = require('express');
var app = express();

var actions = {
play(data) {
// ...
},
pause(data) {
// ...
}
}

app.get('/perform/:action/:payload', function(req, res) {
if (actions.hasOwnProperty(req.params.action)) {
let action = actions[req.params.action];
if (typeof action === 'function') {
res.end(action(req.params.payload));
return;
}
}
res.end("Unsupported action.");
});
```

Running the query on it (using CodeQL 2.7.6) does not flag an alert.

Now I change the `UnvalidatedDynamicMethCallQuery` library by adding the following conjunct in its `isSource` predicate:

```ql
(...) and
source.getStartLine() = 15
```

And suddenly I get an alert on the call to `action`.

Quite apart from the question of whether or not this alert is correct, I don't see how adding a conjunct to the `isSource` predicate, thereby making it smaller (in this particular case, one source instead of three), can lead to more alerts being reported.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.