Merge pull request #74 from xiemaisi/js/multi-step-export-from

Approved by asger-semmle

Author: semmle-qlci

change-notes/1.18/analysis-javascript.md

@@ -8,6 +8,8 @@
 
 * Modelling of global variables has been improved. This may give more true-positive results and fewer false-positive results for a variety of queries.
 
+* Modelling of re-export declarations has been improved. This may result in fewer false-positive results for a variety of queries.
+
 * Modelling of taint flow through the array operations `map` and `join` has been improved. This may give additional results for the security queries.
 
 * Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following libraries:

javascript/ql/src/semmle/javascript/ES2015Modules.qll

@@ -428,22 +428,39 @@ class ExportSpecifier extends Expr, @exportspecifier {
   string getExportedName() { result = getExported().getName() }
 }
 
-/** A named export specifier. */
+/**
+ * A named export specifier, for example `v` in `export { v }`.
+ */
 class NamedExportSpecifier extends ExportSpecifier, @namedexportspecifier {
 }
 
-/** A default export specifier. */
+/**
+ * A default export specifier, for example `default` in `export default 42`,
+ * or `v` in `export v from "mod"`.
+ */
 class ExportDefaultSpecifier extends ExportSpecifier, @exportdefaultspecifier {
-  override string getLocalName() {
-    getExportDeclaration() instanceof ReExportDeclaration and result = "default"
-  }
-
   override string getExportedName() {
     result = "default"
   }
 }
 
-/** A namespace export specifier. */
+/**
+ * A default export specifier in a re-export declaration, for example `v` in
+ * `export v from "mod"`.
+ */
+class ReExportDefaultSpecifier extends ExportDefaultSpecifier {
+  ReExportDefaultSpecifier() {
+    getExportDeclaration() instanceof ReExportDeclaration
+  }
+
+  override string getLocalName() { result = "default" }
+
+  override string getExportedName() { result = getExported().getName() }
+}
+
+/**
+ * A namespace export specifier, for example `*` in `export * from "mod"`.
+ */
 class ExportNamespaceSpecifier extends ExportSpecifier, @exportnamespacespecifier {
 }
 

javascript/ql/test/library-tests/Flow/AbstractValues.expected

@@ -217,6 +217,12 @@
 | reexport-mixins.js:1:1:4:0 | module object of module reexport-mixins |
 | reexport-unknown.js:1:1:2:0 | exports object of module reexport-unknown |
 | reexport-unknown.js:1:1:2:0 | module object of module reexport-unknown |
+| reexport/client/src/index.js:1:1:3:0 | exports object of module index |
+| reexport/client/src/index.js:1:1:3:0 | module object of module index |
+| reexport/lib/index.js:1:1:4:0 | exports object of module index |
+| reexport/lib/index.js:1:1:4:0 | module object of module index |
+| reexport/lib/src/utils/util.js:1:1:3:0 | exports object of module util |
+| reexport/lib/src/utils/util.js:1:1:3:0 | module object of module util |
 | refinements.js:1:1:8:1 | function f1 |
 | refinements.js:1:1:8:1 | instance of function f1 |
 | refinements.js:10:1:24:1 | function f2 |

javascript/ql/test/library-tests/Flow/abseval.expected

@@ -221,6 +221,7 @@
 | objlit.js:38:11:38:12 | x6 | objlit.js:38:16:38:21 | this.h | file://:0:0:0:0 | indefinite value (heap) |
 | objlit.js:38:11:38:12 | x6 | objlit.js:38:16:38:21 | this.h | objlit.js:41:10:41:22 | anonymous function |
 | objlit.js:43:7:43:8 | o3 | objlit.js:43:12:45:3 | {\\n    _ ...  o2\\n  } | objlit.js:43:12:45:3 | object literal |
+| reexport/client/src/index.js:2:5:2:8 | test | reexport/client/src/index.js:2:12:2:15 | data | file://:0:0:0:0 | non-empty, non-numeric string |
 | refinements.js:3:7:3:8 | x1 | refinements.js:3:12:3:12 | g | file://:0:0:0:0 | undefined |
 | refinements.js:7:7:7:8 | x3 | refinements.js:7:12:7:12 | g | file://:0:0:0:0 | undefined |
 | refinements.js:11:7:11:7 | a | refinements.js:11:11:11:72 | Math.ra ... ' : 42) | file://:0:0:0:0 | non-empty, non-numeric string |

javascript/ql/test/library-tests/Flow/reexport/client/src/index.js

@@ -0,0 +1,2 @@
+import { data } from '../../lib';
+var test = data;

javascript/ql/test/library-tests/Flow/reexport/lib/index.js

@@ -0,0 +1,3 @@
+export data from './src/utils/util'
+
+// semmle-extractor-options: --experimental

javascript/ql/test/library-tests/Flow/reexport/lib/src/utils/util.js

@@ -0,0 +1,2 @@
+export default "data";
+

javascript/ql/test/library-tests/Flow/types.expected

@@ -121,6 +121,7 @@
 | objlit.js:37:11:37:12 | x5 | objlit.js:37:16:37:21 | this.f | boolean, class, date, function, null, number, object, regular expression,string or undefined |
 | objlit.js:38:11:38:12 | x6 | objlit.js:38:16:38:21 | this.h | boolean, class, date, function, null, number, object, regular expression,string or undefined |
 | objlit.js:43:7:43:8 | o3 | objlit.js:43:12:45:3 | {\\n    _ ...  o2\\n  } | object |
+| reexport/client/src/index.js:2:5:2:8 | test | reexport/client/src/index.js:2:12:2:15 | data | string |
 | refinements.js:3:7:3:8 | x1 | refinements.js:3:12:3:12 | g | undefined |
 | refinements.js:5:9:5:10 | x2 | refinements.js:5:14:5:14 | g |  |
 | refinements.js:7:7:7:8 | x3 | refinements.js:7:12:7:12 | g | undefined |

javascript/ql/test/library-tests/Modules/ExportDeclarations.expected

@@ -1,10 +1,12 @@
 | a.js:1:1:3:1 | export  ... n 23;\\n} |
 | a.js:5:1:5:32 | export  ...  } = o; |
 | b.js:5:1:5:18 | export { f as g }; |
+| b.js:7:1:7:21 | export  ...  './a'; |
 | d.js:4:1:4:20 | export * from 'm/c'; |
 | e.js:2:1:2:16 | export { x, y }; |
 | e.js:3:1:3:35 | export  ...  './a'; |
 | es2015_require.js:3:1:3:25 | export  ... ss C {} |
 | export-in-mjs.mjs:1:1:1:34 | export  ... s = 42; |
 | f.ts:5:1:5:24 | export  ... oo() {} |
+| m/c.js:5:1:5:30 | export  ... '../b'; |
 | tst.html:7:3:7:22 | export const y = 42; |

javascript/ql/test/library-tests/Modules/ExportSpecifiers.expected

@@ -2,3 +2,4 @@
 | e.js:2:10:2:10 | x | e.js:2:10:2:10 | x | e.js:2:10:2:10 | x |
 | e.js:2:13:2:13 | y | e.js:2:13:2:13 | y | e.js:2:13:2:13 | y |
 | e.js:3:10:3:21 | default as g | e.js:3:10:3:16 | default | e.js:3:21:3:21 | g |
+| m/c.js:5:10:5:15 | g as h | m/c.js:5:10:5:10 | g | m/c.js:5:15:5:15 | h |