You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/language/learn-ql/javascript/dataflow-cheat-sheet.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,7 +31,7 @@ Use the following template to create a taint tracking path query:
31
31
This query reports flow paths which:
32
32
33
33
- Begin at a node matched by `isSource <https://help.semmle.com/qldoc/javascript/semmle/javascript/dataflow/Configuration.qll/predicate.Configuration$Configuration$isSource.1.html>`__.
34
-
- Step through variables, function calls, properties, strings, arrays, promises, exceptions, and steps added by `isAdditionalTaintStep <https://help.semmle.com/qldoc/javascript/semmle/javascript/dataflow/Configuration.qll/predicate.Configuration$Configuration$isAdditionalTaintStep.2.html>`__.
34
+
- Step through variables, function calls, properties, strings, arrays, promises, exceptions, and steps added by `isAdditionalTaintStep <https://help.semmle.com/qldoc/javascript/semmle/javascript/dataflow/TaintTracking.qll/predicate.TaintTracking$TaintTracking$Configuration$isAdditionalTaintStep.2.html>`__.
35
35
- End at a node matched by `isSink <https://help.semmle.com/qldoc/javascript/semmle/javascript/dataflow/Configuration.qll/predicate.Configuration$Configuration$isSink.1.html>`__.
36
36
37
37
See also: `Global data flow <https://help.semmle.com/QL/learn-ql/javascript/dataflow.html#global-data-flow>`__ and :doc:`Constructing path queries <../writing-queries/path-queries>`.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/javascript/introduce-libraries-js.rst
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -357,7 +357,7 @@ JavaScript provides several ways of defining functions: in ECMAScript 5, there a
357
357
358
358
- ``Function.getId()`` returns the `Identifier <https://help.semmle.com/qldoc/javascript/semmle/javascript/Expr.qll/type.Expr$Identifier.html>`__ naming the function, which may not be defined for function expressions.
359
359
- ``Function.getParameter(i)`` and ``Function.getAParameter()`` access the ``i``\ th parameter or any parameter, respectively; parameters are modeled by the class `Parameter <https://help.semmle.com/qldoc/javascript/semmle/javascript/Variables.qll/type.Variables$Parameter.html>`__, which is a subclass of `BindingPattern <https://help.semmle.com/qldoc/javascript/semmle/javascript/Variables.qll/type.Variables$BindingPattern.html>`__ (see below).
360
-
- ``Function.getBody()`` returns the body of the function, which is usually a `Stmt <https://help.semmle.com/qldoc/javascript/semmle/javascript/Stmt.qll/type.Stmt$Stmt.html>`__, but may be an `Expr <https://help.semmle.com/qldoc/javascript/semmle/javascript/Expr.qll/type.Expr$Expr.html>`__ for arrow function expressions and legacy `expression closures <https://developer.mozilla.org/en/docs/Web/JavaScript/Guide/Closures#Expression_closures>`__.
360
+
- ``Function.getBody()`` returns the body of the function, which is usually a `Stmt <https://help.semmle.com/qldoc/javascript/semmle/javascript/Stmt.qll/type.Stmt$Stmt.html>`__, but may be an `Expr <https://help.semmle.com/qldoc/javascript/semmle/javascript/Expr.qll/type.Expr$Expr.html>`__ for arrow function expressions and legacy `expression closures <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Expression_closures>`__.
361
361
362
362
As an example, here is a query that finds all expression closures:
363
363
@@ -472,7 +472,7 @@ As an example of a query involving properties, consider the following query that
472
472
Modules
473
473
^^^^^^^
474
474
475
-
The JavaScript library has support for working with ECMAScript 2015 modules, as well as legacy CommonJS modules (still commonly employed by Node.js code bases) and AMD-style modules. The QL classes `ES2015Module <https://help.semmle.com/qldoc/javascript/semmle/javascript/ES2015Modules.qll/type.ES2015Modules$ES2015Module.html>`__, `NodeModule <https://help.semmle.com/qldoc/javascript/semmle/javascript/NodeJS.qll/type.NodeJS$NodeModule.html>`__ and `AMDModule <https://help.semmle.com/qldoc/javascript/semmle/javascript/AMD.qll/type.AMD$AMDModule.html>`__ represent these three types of modules, and all three extend the common superclass `Module <https://help.semmle.com/qldoc/javascript/semmle/javascript/Modules.qll/type.Modules$Module.html>`__.
475
+
The JavaScript library has support for working with ECMAScript 2015 modules, as well as legacy CommonJS modules (still commonly employed by Node.js code bases) and AMD-style modules. The QL classes `ES2015Module <https://help.semmle.com/qldoc/javascript/semmle/javascript/ES2015Modules.qll/type.ES2015Modules$ES2015Module.html>`__, `NodeModule <https://help.semmle.com/qldoc/javascript/semmle/javascript/NodeJS.qll/type.NodeJS$NodeModule.html>`__, and `AMDModule <https://help.semmle.com/qldoc/javascript/semmle/javascript/AMD.qll/type.AMD$AmdModule.html>`__ represent these three types of modules, and all three extend the common superclass `Module <https://help.semmle.com/qldoc/javascript/semmle/javascript/Modules.qll/type.Modules$Module.html>`__.
476
476
477
477
The most important member predicates defined by `Module <https://help.semmle.com/qldoc/javascript/semmle/javascript/Modules.qll/type.Modules$Module.html>`__ are:
478
478
@@ -682,28 +682,28 @@ You can add custom type inference rules by defining new subclasses of ``DataFlow
682
682
Call graph
683
683
~~~~~~~~~~
684
684
685
-
The library ``semmle.javascript.dataflow.CallGraph`` implements a simple `call graph <http://en.wikipedia.org/wiki/Call_graph>`__ construction algorithm to statically approximate the possible call targets of function calls and ``new`` expressions. Due to the dynamically typed nature of JavaScript and its support for higher-order functions and reflective language features, building static call graphs is quite difficult. Simple call graph algorithms tend to be incomplete, that is, they often fail to resolve all possible call targets. More sophisticated algorithms can suffer from the opposite problem of imprecision, that is, they may infer many spurious call targets.
685
+
The JavaScript library implements a simple `call graph <http://en.wikipedia.org/wiki/Call_graph>`__ construction algorithm to statically approximate the possible call targets of function calls and ``new`` expressions. Due to the dynamically typed nature of JavaScript and its support for higher-order functions and reflective language features, building static call graphs is quite difficult. Simple call graph algorithms tend to be incomplete, that is, they often fail to resolve all possible call targets. More sophisticated algorithms can suffer from the opposite problem of imprecision, that is, they may infer many spurious call targets.
686
686
687
-
The library provides a QL class `CallSite<https://help.semmle.com/qldoc/javascript/semmle/javascript/dataflow/CallGraph.qll/type.CallGraph$CallSite.html>`__, which extends `InvokeExpr <https://help.semmle.com/qldoc/javascript/semmle/javascript/Expr.qll/type.Expr$InvokeExpr.html>`__ with a member predicate ``getACallee()`` that computes possible callees of the given call site, that is, functions that may at runtime be invoked by this expression.
687
+
The call graph is represented by the member predicate ``getACallee()`` of class `DataFlow::InvokeNode<https://help.semmle.com/qldoc/javascript/semmle/javascript/dataflow/Nodes.qll/type.Nodes$InvokeNode.html>`__, which computes possible callees of the given invocation, that is, functions that may at runtime be invoked by this expression.
688
688
689
-
Furthermore, there are three member predicates that indicate the quality of the callee information for this call site:
689
+
Furthermore, there are three member predicates that indicate the quality of the callee information for this invocation:
690
690
691
-
- ``CallSite.isImprecise()``: holds for call sites where the call graph builder might infer spurious call targets.
692
-
- ``CallSite.isIncomplete()``: holds for call sites where the call graph builder might fail to infer possible call targets.
693
-
- ``CallSite.isUncertain()``: holds if either ``isImprecise()`` or ``isUncertain()`` holds.
691
+
- ``DataFlow::InvokeNode.isImprecise()``: holds for invocations where the call graph builder might infer spurious call targets.
692
+
- ``DataFlow::InvokeNode.isIncomplete()``: holds for invocations where the call graph builder might fail to infer possible call targets.
693
+
- ``DataFlow::InvokeNode.isUncertain()``: holds if either ``isImprecise()`` or ``isUncertain()`` holds.
694
694
695
-
As an example of a call-graph-based query, here is a query to find call sites for which the call graph builder could not find any callees, despite the analysis being complete for this call site:
695
+
As an example of a call-graph-based query, here is a query to find invocations for which the call graph builder could not find any callees, despite the analysis being complete for this invocation:
696
696
697
697
.. code-block:: ql
698
698
699
699
import javascript
700
700
701
-
from CallSite cs
702
-
where not cs.isIncomplete() and
703
-
not exists(cs.getACallee())
704
-
select cs, "Unable to find a callee for this call site."
701
+
from DataFlow::InvokeNode invk
702
+
where not invk.isIncomplete() and
703
+
not exists(invk.getACallee())
704
+
select invk, "Unable to find a callee for this invocation."
705
705
706
-
➤ `See this in the query console <https://lgtm.com/query/1506065666123/>`__
706
+
➤ `See this in the query console <https://lgtm.com/query/3260345690335671362/>`__
707
707
708
708
Inter-procedural data flow
709
709
~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -808,7 +808,7 @@ HTTP framework libraries
808
808
809
809
The library ``semmle.javacript.frameworks.HTTP`` provides classes modeling common concepts from various HTTP frameworks.
810
810
811
-
Currently supported frameworks are `Express <https://expressjs.com/>`__, the standard Node.js ``http`` and ``https`` modules, `Connect <https://github.com/senchalabs/connect>`__, `Koa <https://koajs.com>`__, `Hapi <https://hapijs.com/>`__ and `Restify <https://restify.com/>`__.
811
+
Currently supported frameworks are `Express <https://expressjs.com/>`__, the standard Node.js ``http`` and ``https`` modules, `Connect <https://github.com/senchalabs/connect>`__, `Koa <https://koajs.com>`__, `Hapi <https://hapijs.com/>`__ and `Restify <http://restify.com/>`__.
812
812
813
813
The most important classes include (all in module ``HTTP``):
814
814
@@ -1031,4 +1031,4 @@ What next?
1031
1031
1032
1032
- Learn about the QL standard libraries used to write queries for TypeScript in :doc:`Introducing the TypeScript libraries <introduce-libraries-ts>`.
1033
1033
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
1034
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
1034
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
0 commit comments