JavaScript: Add support for tracking flow into receivers of reflective calls.

Max Schaefer · Max Schaefer · commit 7f95c20345c4 · 2019-07-01T17:54:43.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/FlowSteps.qll
@@ -136,7 +136,7 @@ private module CachedSteps {
         parm = DataFlow::parameterNode(p)
       )
       or
-      arg = invk.(DataFlow::MethodCallNode).getReceiver() and
+      arg = invk.(DataFlow::CallNode).getReceiver() and
       parm = DataFlow::thisNode(f)
     )
     or

Original file line number	Diff line number	Diff line change
`@@ -136,7 +136,7 @@ private module CachedSteps {`
`136`	`136`	`parm = DataFlow::parameterNode(p)`
`137`	`137`	`)`
`138`	`138`	`or`
`139`		`- arg = invk.(DataFlow::MethodCallNode).getReceiver() and`
	`139`	`+ arg = invk.(DataFlow::CallNode).getReceiver() and`
`140`	`140`	`parm = DataFlow::thisNode(f)`
`141`	`141`	`)`
`142`	`142`	`or`