Merge pull request #1220 from esben-semmle/js/another-getAPropertyAttribut-performance-fix

JS: inline CallToObjectDefineProperty::getAPropertyAttribute

Author: Max Schaefer

javascript/ql/src/Declarations/DeadStoreOfProperty.ql

@@ -161,7 +161,7 @@ where
   // exclude results from non-value definitions from `Object.defineProperty`
   (
     assign1 instanceof CallToObjectDefineProperty implies
-    assign1.(CallToObjectDefineProperty).getAPropertyAttribute().getPropertyName() = "value"
+    assign1.(CallToObjectDefineProperty).hasPropertyAttributeWrite("value", _)
   )
 select assign1.getWriteNode(),
   "This write to property '" + name + "' is useless, since $@ always overrides it.",

javascript/ql/src/Expressions/ExprHasNoEffect.ql

@@ -39,7 +39,7 @@ predicate isGetterProperty(string name) {
   exists(CallToObjectDefineProperty defProp |
     name = defProp.getPropertyName() |
     // ... where `descriptor` defines a getter
-    defProp.getAPropertyAttribute().getPropertyName() = "get" or
+    defProp.hasPropertyAttributeWrite("get", _) or
     // ... where `descriptor` may define a getter
     exists (DataFlow::SourceNode descriptor |
       descriptor.flowsTo(defProp.getPropertyDescriptor()) |

javascript/ql/src/semmle/javascript/StandardLibrary.qll

@@ -22,14 +22,17 @@ class CallToObjectDefineProperty extends DataFlow::MethodCallNode {
   /** Gets the data flow node denoting the descriptor of the property being defined. */
   DataFlow::Node getPropertyDescriptor() { result = getArgument(2) }
 
-  /** Gets a data flow node defining a descriptor attribute of the property being defined. */
-  DataFlow::PropWrite getAPropertyAttribute() {
-    exists (DataFlow::SourceNode descriptor |
+  /**
+   * Holds if there is an assignment to property `name` to the
+   * attributes object on this node, and the right hand side of the
+   * assignment is `rhs`.
+   */
+  predicate hasPropertyAttributeWrite(string name, DataFlow::Node rhs) {
+    exists(DataFlow::SourceNode descriptor |
       descriptor.flowsTo(getPropertyDescriptor()) and
-      result = descriptor.getAPropertyWrite()
+      descriptor.hasPropertyWrite(name, rhs)
     )
   }
-
 }
 
 /**