Improve data flow in the async package
#19770
Conversation
|
Also, let me know if there's a way to avoid having two |
| * For example, `memberVariant("map")` finds references to `map`, `mapLimit`, and `mapSeries`. | ||
| * For example, `memberNameVariant("map")` returns `map`, `mapLimit`, and `mapSeries`. | ||
| */ | ||
| DataFlow::SourceNode memberVariant(string name) { |
There was a problem hiding this comment.
Since this is a publicly accessible predicate, we should avoid changing its signature. Instead, deprecate the original predicate and give a different name to the new predicate.
This predicate probably shouldn't have been public in the first place. Feel free to make the new one private.
| succ = final.getParameter(1) and | ||
| call.getName() = "sortBy" | ||
| ) | ||
| class IterationPreserveTaintStepFlowSummary extends DataFlow::SummarizedCallable { |
There was a problem hiding this comment.
| class IterationPreserveTaintStepFlowSummary extends DataFlow::SummarizedCallable { | |
| private class IterationPreserveTaintStepFlowSummary extends DataFlow::SummarizedCallable { |
You can merge the two classes by adding a field to the class, and embedding the value of the field in its |
Thanks, I'll make sure to fix the discrepancy. |
|
I fixed what you pointed out in your comments and merged the I don't have time to test now, but in a codebase I was running this on, there was an |
2 participants
This PR makes these changes:
FlowSummaryPrivate.qll: Added support foranyPropertycontent set in flow summaries:async_.map({a: source()}, call_sink)case. Let me know if there's a better way to do itElement, which, according to the documentation, should select "an element of an array, iterator, or set object."AsyncPackage.qll: Improve taint tracking through functions from theasyncpackage: