JS: introduce RelationalComparison.isInclucive

Author: Esben Sparre Andreasen

javascript/ql/src/semmle/javascript/Expr.qll

@@ -1545,6 +1545,14 @@ class RelationalComparison extends Comparison {
   Expr getGreaterOperand() {
     result = getAnOperand() and result != getLesserOperand()
   }
+
+  /**
+   * Holds if this is a comparison with `<=` or `>=`.
+   */
+  predicate isInclusive() {
+    this instanceof LEExpr or
+    this instanceof GEExpr
+  }
 }
 
 /** A (pre or post) increment expression. */

javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll

@@ -643,16 +643,6 @@ module TaintTracking {
 
   }
 
-  /**
-   * A less-than or greater-than expression
-   */
-  private class ExclusiveRelationalComparison extends RelationalComparison {
-    ExclusiveRelationalComparison() {
-      this instanceof LTExpr or
-      this instanceof GTExpr
-    }
-  }
-
   /** 
    * A check of the form `if(whitelist.indexOf(x) >= 0)`, which sanitizes `x` in its "then" branch. 
    *
@@ -671,17 +661,17 @@ module TaintTracking {
         polarity = true and
         greater = indexOf and
         (
-          lesser.getIntValue() = 0 
+          lesser.getIntValue() >= 0
           or
-          lesser.getIntValue() = -1 and astNode instanceof ExclusiveRelationalComparison
+          lesser.getIntValue() = -1 and not astNode.isInclusive()
         )
         or 
         polarity = false and
         lesser = indexOf and
         (
           greater.getIntValue() = -1
           or
-          greater.getIntValue() = 0 and astNode instanceof ExclusiveRelationalComparison
+          greater.getIntValue() = 0 and not astNode.isInclusive()
         )
       )
     }