Merge pull request #1274 from asger-semmle/ts-export-equals

Approved by xiemaisi

Author: semmle-qlci

javascript/ql/src/semmle/javascript/dataflow/internal/InterModuleTypeInference.qll

@@ -156,7 +156,12 @@ private class AnalyzedImport extends AnalyzedPropertyRead, DataFlow::ValueNode {
     or
     // when importing CommonJS/AMD modules from ES2015, `module.exports` appears
     // as the default export
-    not imported instanceof ES2015Module and
+    (
+      not imported instanceof ES2015Module
+      or
+      // CommonJS/AMD module generated by TypeScript compiler
+      imported.getAStmt() instanceof ExportAssignDeclaration
+    ) and
     astNode.(ImportSpecifier).getImportedName() = "default" and
     base = TAbstractModuleObject(imported) and
     propName = "exports"

javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/export_equals.ts

@@ -0,0 +1,10 @@
+import * as dummy from "dummy"; // treat as ES module
+
+class C {
+  public x: int;
+  constructor() {}
+
+  static async staticMethod() {}
+}
+
+export = C;

javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/export_equals_client.ts

@@ -0,0 +1,5 @@
+import C from "./export_equals";
+
+function f() {
+  C.staticMethod(); // OK
+}