JS: Support Promise.try and Array.prototype.with#20375
Conversation
76214f6 to
6b6caba
Compare
Note: This was authored by Copilot
a162be5 to
429c4ea
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for data flow tracking through two JavaScript methods: Promise.try and Array.prototype.with. These are modern JavaScript features that enable better promise handling and immutable array operations respectively.
- Implements flow summaries for
Promise.tryto track data flow through promise creation and execution - Implements flow summaries for
Array.prototype.withto track data flow through immutable array updates - Adds comprehensive test cases to verify data flow behavior for both methods
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| javascript/ql/test/library-tests/TripleDot/promise-try.js | Test cases for Promise.try data flow tracking |
| javascript/ql/test/library-tests/TripleDot/array-with.js | Test cases for Array.prototype.with data flow tracking |
| javascript/ql/src/change-notes/2025-09-16-promise-try-array-with.md | Release notes documenting the new features |
| javascript/ql/lib/semmle/javascript/internal/flow_summaries/Promises.qll | Flow summary implementation for Promise.try |
| javascript/ql/lib/semmle/javascript/internal/flow_summaries/FlowSummaryUtil.qll | Utility function to generate argument positions |
| javascript/ql/lib/semmle/javascript/internal/flow_summaries/Arrays.qll | Flow summary implementation for Array.prototype.with |
javascript/ql/lib/semmle/javascript/internal/flow_summaries/Promises.qll
Show resolved
Hide resolved
| exists(int i | i = getAnArgumentPosition() | | ||
| input = "Argument[" + (i + 1) + "]" and | ||
| output = "Argument[0].Parameter[" + i + "]" | ||
| ) |
There was a problem hiding this comment.
Just a quick question for my understanding. We would not have flow if a lambda would have more then 10 arguments?
Also what happens if we have ...args(arbitrary number of arguments), will it work?
There was a problem hiding this comment.
Correct on both accounts
Napalys
left a comment
There was a problem hiding this comment.
Looks great 👍 , I have just a small question so I would understand better.
Adds support for
Promise.tryandArray.prototype.with