JS: Test case for nested statements

Author: asger-semmle

javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected

@@ -34,6 +34,9 @@
 | exceptions.js:88:6:88:13 | source() | exceptions.js:33:10:33:21 | e.toString() |
 | exceptions.js:88:6:88:13 | source() | exceptions.js:34:10:34:18 | e.message |
 | exceptions.js:88:6:88:13 | source() | exceptions.js:35:10:35:19 | e.fileName |
+| exceptions.js:93:11:93:18 | source() | exceptions.js:95:10:95:10 | e |
+| exceptions.js:100:13:100:20 | source() | exceptions.js:102:12:102:12 | e |
+| exceptions.js:115:21:115:28 | source() | exceptions.js:121:10:121:10 | e |
 | indexOf.js:4:11:4:18 | source() | indexOf.js:9:10:9:10 | x |
 | partialCalls.js:4:17:4:24 | source() | partialCalls.js:17:14:17:14 | x |
 | partialCalls.js:4:17:4:24 | source() | partialCalls.js:20:14:20:14 | y |

javascript/ql/test/library-tests/TaintTracking/exceptions.js

@@ -88,4 +88,38 @@ async function throwAsync(x) {
 test(source(), "hello");
 test("hey", "hello"); // no single-call inlining
 
+function testNesting(x) {
+  try {
+    throw source();
+  } catch (e) {
+    sink(e); // NOT OK
+  }
+
+  try {
+    try {
+      throw source();
+    } catch (e) {
+      sink(e); // NOT OK
+    }
+  } catch (e) {
+    sink(e); // OK - not caught by this catch
+  }
+
+  try {
+    if (x) {
+      for (;x;) {
+        while(x) {
+          switch (x) {
+            case 1:
+            default:
+              throw source();
+          }
+        }
+      }
+    }
+  } catch (e) {
+    sink(e); // NOT OK
+  }
+}
+
 // semmle-extractor-options: --experimental