Skip to content

Commit 3fcf4ef

Browse files
committed
JS: More precise model of .shift()
Array.prototype.shift only returns the first array element. The mutation of Argument[this] is not yet modelled, and is better handled when we have use-use flow.
1 parent e4f7560 commit 3fcf4ef

File tree

1 file changed

+1
-1
lines changed
  • javascript/ql/lib/semmle/javascript/internal/flow_summaries

1 file changed

+1
-1
lines changed

javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -484,7 +484,7 @@ class Shift extends SummarizedCallable {
484484

485485
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
486486
preservesValue = true and
487-
input = "Argument[this].ArrayElement" and
487+
input = "Argument[this].ArrayElement[0]" and
488488
output = "ReturnValue"
489489
}
490490
}

0 commit comments

Comments
 (0)