JavaScript: Teach Function.isGenerator to check for yield.

Author: Max Schaefer

javascript/ql/src/LanguageFeatures/YieldInNonGenerator.ql

@@ -15,6 +15,6 @@ import javascript
 from YieldExpr yield, Function f
 where
   f = yield.getEnclosingFunction() and
-  not f.isGenerator()
+  not isGenerator(f)
 select yield, "This yield expression is contained in $@ which is not marked as a generator.",
   f.getFirstToken(), f.describe()

javascript/ql/src/semmle/javascript/Functions.qll

@@ -79,7 +79,12 @@ class Function extends @function, Parameterized, TypeParameterized, StmtContaine
   TypeExpr getReturnTypeAnnotation() { typeexprs(result, _, this, -3, _) }
 
   /** Holds if this function is a generator function. */
-  predicate isGenerator() { isGenerator(this) }
+  predicate isGenerator() {
+    isGenerator(this)
+    or
+    // we also support `yield` in non-generator functions
+    exists(YieldExpr yield | this = yield.getEnclosingFunction())
+  }
 
   /** Holds if the last parameter of this function is a rest parameter. */
   predicate hasRestParameter() { hasRestParameter(this) }

javascript/ql/test/query-tests/Expressions/SuspiciousPropAccess/yield_in_non_generator.js

@@ -0,0 +1,8 @@
+function outer() {
+  function inner() {
+    yield 1;
+  }
+  inner().next()
+}
+
+// semmle-extractor-options: --experimental