JS: type tracking for js/incomplete-hostname-regexp #1211
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ghost
self-requested a review
as a 
xiemaisi
suggested changes
Apr 5, 2019
xiemaisi
left a comment
xiemaisi
left a comment
There was a problem hiding this comment.
Nice! Glad to see this has finally come together. Have you tested this version of the query on a few of the projects we discussed earlier where the query used to take very long?
asger-semmle
reviewed
Apr 5, 2019
Author
|
Author
|
As discussed, I have added We should follow this up with a similar change for the forwards tracker soon. |
ghost
mentioned this pull request
xiemaisi
reviewed
Apr 10, 2019
Could you make a JIRA issue for this? |
added 8 commits
April 12, 2019 08:51
xiemaisi
approved these changes
Apr 15, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This query reformulates
js/incomplete-hostname-regexpto use backwards type tracking to avoid forwards taint tracking of irrelevant strings.To do this, the type tracking library is trivially generalized to support tracking of non-
SourceNodes.The expressivity of the reformulated query is not exactly the same, but I expect more results from the query since we now support additional sources, and no longer spuriously sanitize programmer-provided strings.
I suspect the idiom
(t.continue() = t2 or t = t2)should be encapsulated as ast.taint() = t2, but I would like to see another use case before moving it into the library.I have performed two evaluations: javscript-lgtm on big-apps.slugs, js/incomplete-hostname-regexp on default.slugs. There are no changes to the results (which I think is a good thing for this change), and the performance improves a bit.