circle-ir 3.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +15 -0
- package/README.md +200 -0
- package/configs/sinks/code_injection.yaml +672 -0
- package/configs/sinks/command.yaml +917 -0
- package/configs/sinks/deserialization.yaml +105 -0
- package/configs/sinks/ldap.yaml +136 -0
- package/configs/sinks/nodejs.json +629 -0
- package/configs/sinks/path.yaml +715 -0
- package/configs/sinks/python.json +501 -0
- package/configs/sinks/rust.json +339 -0
- package/configs/sinks/sql.yaml +233 -0
- package/configs/sinks/ssrf.yaml +160 -0
- package/configs/sinks/xpath.yaml +121 -0
- package/configs/sinks/xss.yaml +727 -0
- package/configs/sources/db_sources.yaml +90 -0
- package/configs/sources/env_sources.yaml +94 -0
- package/configs/sources/express.json +197 -0
- package/configs/sources/file_sources.yaml +164 -0
- package/configs/sources/http_sources.yaml +379 -0
- package/configs/sources/io_sources.yaml +519 -0
- package/configs/sources/network_sources.yaml +99 -0
- package/configs/sources/python.json +230 -0
- package/configs/sources/rust.json +286 -0
- package/configs/sources/spring.yaml +70 -0
- package/dist/analysis/advisory-db.d.ts +86 -0
- package/dist/analysis/advisory-db.js +104 -0
- package/dist/analysis/advisory-db.js.map +1 -0
- package/dist/analysis/cargo-parser.d.ts +42 -0
- package/dist/analysis/cargo-parser.js +102 -0
- package/dist/analysis/cargo-parser.js.map +1 -0
- package/dist/analysis/config-loader.d.ts +37 -0
- package/dist/analysis/config-loader.js +1561 -0
- package/dist/analysis/config-loader.js.map +1 -0
- package/dist/analysis/constant-propagation/ast-utils.d.ts +25 -0
- package/dist/analysis/constant-propagation/ast-utils.js +34 -0
- package/dist/analysis/constant-propagation/ast-utils.js.map +1 -0
- package/dist/analysis/constant-propagation/evaluator.d.ts +32 -0
- package/dist/analysis/constant-propagation/evaluator.js +296 -0
- package/dist/analysis/constant-propagation/evaluator.js.map +1 -0
- package/dist/analysis/constant-propagation/index.d.ts +62 -0
- package/dist/analysis/constant-propagation/index.js +152 -0
- package/dist/analysis/constant-propagation/index.js.map +1 -0
- package/dist/analysis/constant-propagation/patterns.d.ts +8 -0
- package/dist/analysis/constant-propagation/patterns.js +126 -0
- package/dist/analysis/constant-propagation/patterns.js.map +1 -0
- package/dist/analysis/constant-propagation/propagator.d.ts +180 -0
- package/dist/analysis/constant-propagation/propagator.js +1985 -0
- package/dist/analysis/constant-propagation/propagator.js.map +1 -0
- package/dist/analysis/constant-propagation/types.d.ts +63 -0
- package/dist/analysis/constant-propagation/types.js +5 -0
- package/dist/analysis/constant-propagation/types.js.map +1 -0
- package/dist/analysis/constant-propagation.d.ts +9 -0
- package/dist/analysis/constant-propagation.js +18 -0
- package/dist/analysis/constant-propagation.js.map +1 -0
- package/dist/analysis/dependency-scanner.d.ts +79 -0
- package/dist/analysis/dependency-scanner.js +122 -0
- package/dist/analysis/dependency-scanner.js.map +1 -0
- package/dist/analysis/dfg-verifier.d.ts +116 -0
- package/dist/analysis/dfg-verifier.js +399 -0
- package/dist/analysis/dfg-verifier.js.map +1 -0
- package/dist/analysis/findings.d.ts +11 -0
- package/dist/analysis/findings.js +228 -0
- package/dist/analysis/findings.js.map +1 -0
- package/dist/analysis/index.d.ts +16 -0
- package/dist/analysis/index.js +18 -0
- package/dist/analysis/index.js.map +1 -0
- package/dist/analysis/interprocedural.d.ts +99 -0
- package/dist/analysis/interprocedural.js +526 -0
- package/dist/analysis/interprocedural.js.map +1 -0
- package/dist/analysis/path-finder.d.ts +133 -0
- package/dist/analysis/path-finder.js +354 -0
- package/dist/analysis/path-finder.js.map +1 -0
- package/dist/analysis/rules.d.ts +75 -0
- package/dist/analysis/rules.js +332 -0
- package/dist/analysis/rules.js.map +1 -0
- package/dist/analysis/semver.d.ts +27 -0
- package/dist/analysis/semver.js +127 -0
- package/dist/analysis/semver.js.map +1 -0
- package/dist/analysis/taint-matcher.d.ts +15 -0
- package/dist/analysis/taint-matcher.js +634 -0
- package/dist/analysis/taint-matcher.js.map +1 -0
- package/dist/analysis/taint-propagation.d.ts +67 -0
- package/dist/analysis/taint-propagation.js +298 -0
- package/dist/analysis/taint-propagation.js.map +1 -0
- package/dist/analysis/unresolved.d.ts +14 -0
- package/dist/analysis/unresolved.js +202 -0
- package/dist/analysis/unresolved.js.map +1 -0
- package/dist/analyzer.d.ts +43 -0
- package/dist/analyzer.js +1010 -0
- package/dist/analyzer.js.map +1 -0
- package/dist/browser/circle-ir.js +16576 -0
- package/dist/browser.d.ts +38 -0
- package/dist/browser.js +38 -0
- package/dist/browser.js.map +1 -0
- package/dist/core/circle-ir-core.cjs +13626 -0
- package/dist/core/circle-ir-core.d.ts +59 -0
- package/dist/core/circle-ir-core.js +13591 -0
- package/dist/core/extractors/calls.d.ts +13 -0
- package/dist/core/extractors/calls.js +1429 -0
- package/dist/core/extractors/calls.js.map +1 -0
- package/dist/core/extractors/cfg.d.ts +9 -0
- package/dist/core/extractors/cfg.js +519 -0
- package/dist/core/extractors/cfg.js.map +1 -0
- package/dist/core/extractors/dfg.d.ts +12 -0
- package/dist/core/extractors/dfg.js +1081 -0
- package/dist/core/extractors/dfg.js.map +1 -0
- package/dist/core/extractors/exports.d.ts +14 -0
- package/dist/core/extractors/exports.js +80 -0
- package/dist/core/extractors/exports.js.map +1 -0
- package/dist/core/extractors/imports.d.ts +9 -0
- package/dist/core/extractors/imports.js +739 -0
- package/dist/core/extractors/imports.js.map +1 -0
- package/dist/core/extractors/index.d.ts +10 -0
- package/dist/core/extractors/index.js +11 -0
- package/dist/core/extractors/index.js.map +1 -0
- package/dist/core/extractors/meta.d.ts +10 -0
- package/dist/core/extractors/meta.js +109 -0
- package/dist/core/extractors/meta.js.map +1 -0
- package/dist/core/extractors/types.d.ts +10 -0
- package/dist/core/extractors/types.js +1479 -0
- package/dist/core/extractors/types.js.map +1 -0
- package/dist/core/index.d.ts +5 -0
- package/dist/core/index.js +8 -0
- package/dist/core/index.js.map +1 -0
- package/dist/core/parser.d.ts +84 -0
- package/dist/core/parser.js +250 -0
- package/dist/core/parser.js.map +1 -0
- package/dist/core-lib.d.ts +59 -0
- package/dist/core-lib.js +62 -0
- package/dist/core-lib.js.map +1 -0
- package/dist/index.d.ts +15 -0
- package/dist/index.js +20 -0
- package/dist/index.js.map +1 -0
- package/dist/languages/index.d.ts +11 -0
- package/dist/languages/index.js +14 -0
- package/dist/languages/index.js.map +1 -0
- package/dist/languages/plugins/base.d.ts +44 -0
- package/dist/languages/plugins/base.js +82 -0
- package/dist/languages/plugins/base.js.map +1 -0
- package/dist/languages/plugins/index.d.ts +14 -0
- package/dist/languages/plugins/index.js +25 -0
- package/dist/languages/plugins/index.js.map +1 -0
- package/dist/languages/plugins/java.d.ts +49 -0
- package/dist/languages/plugins/java.js +402 -0
- package/dist/languages/plugins/java.js.map +1 -0
- package/dist/languages/plugins/javascript.d.ts +48 -0
- package/dist/languages/plugins/javascript.js +445 -0
- package/dist/languages/plugins/javascript.js.map +1 -0
- package/dist/languages/plugins/python.d.ts +47 -0
- package/dist/languages/plugins/python.js +480 -0
- package/dist/languages/plugins/python.js.map +1 -0
- package/dist/languages/plugins/rust.d.ts +47 -0
- package/dist/languages/plugins/rust.js +405 -0
- package/dist/languages/plugins/rust.js.map +1 -0
- package/dist/languages/registry.d.ts +30 -0
- package/dist/languages/registry.js +80 -0
- package/dist/languages/registry.js.map +1 -0
- package/dist/languages/types.d.ts +184 -0
- package/dist/languages/types.js +8 -0
- package/dist/languages/types.js.map +1 -0
- package/dist/resolution/cross-file.d.ts +146 -0
- package/dist/resolution/cross-file.js +439 -0
- package/dist/resolution/cross-file.js.map +1 -0
- package/dist/resolution/index.d.ts +12 -0
- package/dist/resolution/index.js +10 -0
- package/dist/resolution/index.js.map +1 -0
- package/dist/resolution/symbol-table.d.ts +136 -0
- package/dist/resolution/symbol-table.js +336 -0
- package/dist/resolution/symbol-table.js.map +1 -0
- package/dist/resolution/type-hierarchy.d.ts +124 -0
- package/dist/resolution/type-hierarchy.js +515 -0
- package/dist/resolution/type-hierarchy.js.map +1 -0
- package/dist/types/config.d.ts +45 -0
- package/dist/types/config.js +5 -0
- package/dist/types/config.js.map +1 -0
- package/dist/types/index.d.ts +392 -0
- package/dist/types/index.js +7 -0
- package/dist/types/index.js.map +1 -0
- package/dist/utils/logger.d.ts +85 -0
- package/dist/utils/logger.js +198 -0
- package/dist/utils/logger.js.map +1 -0
- package/dist/wasm/tree-sitter-java.wasm +0 -0
- package/dist/wasm/tree-sitter-javascript.wasm +0 -0
- package/dist/wasm/tree-sitter-python.wasm +0 -0
- package/dist/wasm/tree-sitter-rust.wasm +0 -0
- package/dist/wasm/web-tree-sitter.wasm +0 -0
- package/docs/SPEC.md +1021 -0
- package/examples/browser-example.html +610 -0
- package/examples/node-example.ts +215 -0
- package/package.json +107 -0
- package/wasm/tree-sitter-java.wasm +0 -0
- package/wasm/tree-sitter-javascript.wasm +0 -0
- package/wasm/tree-sitter-python.wasm +0 -0
- package/wasm/tree-sitter-rust.wasm +0 -0
|
@@ -0,0 +1,296 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Expression evaluation for constant propagation.
|
|
3
|
+
*
|
|
4
|
+
* Evaluates AST expressions to determine their constant values.
|
|
5
|
+
*/
|
|
6
|
+
import { isKnown, createUnknown, createConstant, getNodeText, getNodeLine } from './ast-utils.js';
|
|
7
|
+
/**
|
|
8
|
+
* Expression evaluator for constant propagation.
|
|
9
|
+
*
|
|
10
|
+
* Takes a symbol lookup function to resolve variable values,
|
|
11
|
+
* allowing it to be used with different symbol tables.
|
|
12
|
+
*/
|
|
13
|
+
export class ExpressionEvaluator {
|
|
14
|
+
source;
|
|
15
|
+
getSymbol;
|
|
16
|
+
constructor(source, getSymbol) {
|
|
17
|
+
this.source = source;
|
|
18
|
+
this.getSymbol = getSymbol;
|
|
19
|
+
}
|
|
20
|
+
/**
|
|
21
|
+
* Evaluate an expression node to determine its constant value.
|
|
22
|
+
*/
|
|
23
|
+
evaluate(node) {
|
|
24
|
+
const line = getNodeLine(node);
|
|
25
|
+
const text = getNodeText(node, this.source);
|
|
26
|
+
switch (node.type) {
|
|
27
|
+
// Literals
|
|
28
|
+
case 'decimal_integer_literal':
|
|
29
|
+
case 'hex_integer_literal':
|
|
30
|
+
case 'octal_integer_literal':
|
|
31
|
+
return createConstant(parseInt(text, 10), 'int', line);
|
|
32
|
+
case 'decimal_floating_point_literal':
|
|
33
|
+
return createConstant(parseFloat(text), 'float', line);
|
|
34
|
+
case 'string_literal':
|
|
35
|
+
return createConstant(text.slice(1, -1), 'string', line);
|
|
36
|
+
case 'character_literal': {
|
|
37
|
+
let char = text.slice(1, -1);
|
|
38
|
+
if (char.startsWith('\\')) {
|
|
39
|
+
char = this.unescapeChar(char);
|
|
40
|
+
}
|
|
41
|
+
return createConstant(char, 'char', line);
|
|
42
|
+
}
|
|
43
|
+
case 'true':
|
|
44
|
+
return createConstant(true, 'bool', line);
|
|
45
|
+
case 'false':
|
|
46
|
+
return createConstant(false, 'bool', line);
|
|
47
|
+
case 'null_literal':
|
|
48
|
+
return createConstant(null, 'null', line);
|
|
49
|
+
// Variable reference
|
|
50
|
+
case 'identifier': {
|
|
51
|
+
const existing = this.getSymbol(text);
|
|
52
|
+
if (existing) {
|
|
53
|
+
return existing;
|
|
54
|
+
}
|
|
55
|
+
return createUnknown(line);
|
|
56
|
+
}
|
|
57
|
+
// Parenthesized expression
|
|
58
|
+
case 'parenthesized_expression': {
|
|
59
|
+
const inner = node.children.find((c) => c.type !== '(' && c.type !== ')');
|
|
60
|
+
if (inner) {
|
|
61
|
+
return this.evaluate(inner);
|
|
62
|
+
}
|
|
63
|
+
return createUnknown(line);
|
|
64
|
+
}
|
|
65
|
+
// Binary expression
|
|
66
|
+
case 'binary_expression':
|
|
67
|
+
return this.evaluateBinary(node);
|
|
68
|
+
// Unary expression
|
|
69
|
+
case 'unary_expression':
|
|
70
|
+
return this.evaluateUnary(node);
|
|
71
|
+
// Ternary expression
|
|
72
|
+
case 'ternary_expression':
|
|
73
|
+
return this.evaluateTernary(node);
|
|
74
|
+
// Method invocation
|
|
75
|
+
case 'method_invocation':
|
|
76
|
+
return this.evaluateMethodCall(node);
|
|
77
|
+
// Field access
|
|
78
|
+
case 'field_access':
|
|
79
|
+
return this.evaluateFieldAccess(node);
|
|
80
|
+
default:
|
|
81
|
+
return createUnknown(line);
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
evaluateBinary(node) {
|
|
85
|
+
const line = getNodeLine(node);
|
|
86
|
+
const left = node.childForFieldName('left');
|
|
87
|
+
const right = node.childForFieldName('right');
|
|
88
|
+
const operatorNode = node.childForFieldName('operator');
|
|
89
|
+
if (!left || !right || !operatorNode) {
|
|
90
|
+
return createUnknown(line);
|
|
91
|
+
}
|
|
92
|
+
const leftVal = this.evaluate(left);
|
|
93
|
+
const rightVal = this.evaluate(right);
|
|
94
|
+
if (!isKnown(leftVal) || !isKnown(rightVal)) {
|
|
95
|
+
return createUnknown(line);
|
|
96
|
+
}
|
|
97
|
+
const lv = leftVal.value;
|
|
98
|
+
const rv = rightVal.value;
|
|
99
|
+
const op = getNodeText(operatorNode, this.source);
|
|
100
|
+
try {
|
|
101
|
+
// Arithmetic
|
|
102
|
+
if (op === '+') {
|
|
103
|
+
if (typeof lv === 'string' || typeof rv === 'string') {
|
|
104
|
+
return createConstant(String(lv) + String(rv), 'string', line);
|
|
105
|
+
}
|
|
106
|
+
if (typeof lv === 'number' && typeof rv === 'number') {
|
|
107
|
+
const result = lv + rv;
|
|
108
|
+
return createConstant(result, Number.isInteger(result) ? 'int' : 'float', line);
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
if (op === '-' && typeof lv === 'number' && typeof rv === 'number') {
|
|
112
|
+
const result = lv - rv;
|
|
113
|
+
return createConstant(result, Number.isInteger(result) ? 'int' : 'float', line);
|
|
114
|
+
}
|
|
115
|
+
if (op === '*' && typeof lv === 'number' && typeof rv === 'number') {
|
|
116
|
+
const result = lv * rv;
|
|
117
|
+
return createConstant(result, Number.isInteger(result) ? 'int' : 'float', line);
|
|
118
|
+
}
|
|
119
|
+
if (op === '/' && typeof lv === 'number' && typeof rv === 'number' && rv !== 0) {
|
|
120
|
+
if (Number.isInteger(lv) && Number.isInteger(rv)) {
|
|
121
|
+
return createConstant(Math.floor(lv / rv), 'int', line);
|
|
122
|
+
}
|
|
123
|
+
return createConstant(lv / rv, 'float', line);
|
|
124
|
+
}
|
|
125
|
+
if (op === '%' && typeof lv === 'number' && typeof rv === 'number' && rv !== 0) {
|
|
126
|
+
return createConstant(lv % rv, 'int', line);
|
|
127
|
+
}
|
|
128
|
+
// Comparison
|
|
129
|
+
if (op === '>' && typeof lv === 'number' && typeof rv === 'number') {
|
|
130
|
+
return createConstant(lv > rv, 'bool', line);
|
|
131
|
+
}
|
|
132
|
+
if (op === '<' && typeof lv === 'number' && typeof rv === 'number') {
|
|
133
|
+
return createConstant(lv < rv, 'bool', line);
|
|
134
|
+
}
|
|
135
|
+
if (op === '>=' && typeof lv === 'number' && typeof rv === 'number') {
|
|
136
|
+
return createConstant(lv >= rv, 'bool', line);
|
|
137
|
+
}
|
|
138
|
+
if (op === '<=' && typeof lv === 'number' && typeof rv === 'number') {
|
|
139
|
+
return createConstant(lv <= rv, 'bool', line);
|
|
140
|
+
}
|
|
141
|
+
if (op === '==') {
|
|
142
|
+
return createConstant(lv === rv, 'bool', line);
|
|
143
|
+
}
|
|
144
|
+
if (op === '!=') {
|
|
145
|
+
return createConstant(lv !== rv, 'bool', line);
|
|
146
|
+
}
|
|
147
|
+
// Logical
|
|
148
|
+
if (op === '&&') {
|
|
149
|
+
return createConstant(Boolean(lv) && Boolean(rv), 'bool', line);
|
|
150
|
+
}
|
|
151
|
+
if (op === '||') {
|
|
152
|
+
return createConstant(Boolean(lv) || Boolean(rv), 'bool', line);
|
|
153
|
+
}
|
|
154
|
+
}
|
|
155
|
+
catch {
|
|
156
|
+
// Division by zero, etc.
|
|
157
|
+
}
|
|
158
|
+
return createUnknown(line);
|
|
159
|
+
}
|
|
160
|
+
evaluateUnary(node) {
|
|
161
|
+
const line = getNodeLine(node);
|
|
162
|
+
const operatorNode = node.childForFieldName('operator');
|
|
163
|
+
const operandNode = node.childForFieldName('operand');
|
|
164
|
+
if (!operatorNode || !operandNode) {
|
|
165
|
+
return createUnknown(line);
|
|
166
|
+
}
|
|
167
|
+
const op = getNodeText(operatorNode, this.source);
|
|
168
|
+
const operand = this.evaluate(operandNode);
|
|
169
|
+
if (!isKnown(operand)) {
|
|
170
|
+
return createUnknown(line);
|
|
171
|
+
}
|
|
172
|
+
if (op === '!' && typeof operand.value === 'boolean') {
|
|
173
|
+
return createConstant(!operand.value, 'bool', line);
|
|
174
|
+
}
|
|
175
|
+
if (op === '-' && typeof operand.value === 'number') {
|
|
176
|
+
return createConstant(-operand.value, operand.type, line);
|
|
177
|
+
}
|
|
178
|
+
if (op === '+' && typeof operand.value === 'number') {
|
|
179
|
+
return operand;
|
|
180
|
+
}
|
|
181
|
+
return createUnknown(line);
|
|
182
|
+
}
|
|
183
|
+
evaluateTernary(node) {
|
|
184
|
+
const line = getNodeLine(node);
|
|
185
|
+
const condition = node.childForFieldName('condition');
|
|
186
|
+
const consequence = node.childForFieldName('consequence');
|
|
187
|
+
const alternative = node.childForFieldName('alternative');
|
|
188
|
+
if (!condition || !consequence || !alternative) {
|
|
189
|
+
return createUnknown(line);
|
|
190
|
+
}
|
|
191
|
+
const condValue = this.evaluate(condition);
|
|
192
|
+
if (isKnown(condValue) && condValue.type === 'bool') {
|
|
193
|
+
if (condValue.value === true) {
|
|
194
|
+
return this.evaluate(consequence);
|
|
195
|
+
}
|
|
196
|
+
else {
|
|
197
|
+
return this.evaluate(alternative);
|
|
198
|
+
}
|
|
199
|
+
}
|
|
200
|
+
return createUnknown(line);
|
|
201
|
+
}
|
|
202
|
+
evaluateMethodCall(node) {
|
|
203
|
+
const line = getNodeLine(node);
|
|
204
|
+
const objectNode = node.childForFieldName('object');
|
|
205
|
+
const nameNode = node.childForFieldName('name');
|
|
206
|
+
const argsNode = node.childForFieldName('arguments');
|
|
207
|
+
if (!objectNode || !nameNode) {
|
|
208
|
+
return createUnknown(line);
|
|
209
|
+
}
|
|
210
|
+
const objValue = this.evaluate(objectNode);
|
|
211
|
+
const methodName = getNodeText(nameNode, this.source);
|
|
212
|
+
if (!isKnown(objValue)) {
|
|
213
|
+
return createUnknown(line);
|
|
214
|
+
}
|
|
215
|
+
// String methods
|
|
216
|
+
if (objValue.type === 'string' && typeof objValue.value === 'string') {
|
|
217
|
+
const s = objValue.value;
|
|
218
|
+
if (methodName === 'charAt' && argsNode) {
|
|
219
|
+
const argValues = this.getArgumentValues(argsNode);
|
|
220
|
+
if (argValues.length > 0 && isKnown(argValues[0]) && argValues[0].type === 'int') {
|
|
221
|
+
const idx = argValues[0].value;
|
|
222
|
+
if (idx >= 0 && idx < s.length) {
|
|
223
|
+
return createConstant(s[idx], 'char', line);
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
}
|
|
227
|
+
if (methodName === 'length') {
|
|
228
|
+
return createConstant(s.length, 'int', line);
|
|
229
|
+
}
|
|
230
|
+
if (methodName === 'substring' && argsNode) {
|
|
231
|
+
const argValues = this.getArgumentValues(argsNode);
|
|
232
|
+
if (argValues.length === 1 && isKnown(argValues[0]) && argValues[0].type === 'int') {
|
|
233
|
+
const start = argValues[0].value;
|
|
234
|
+
return createConstant(s.substring(start), 'string', line);
|
|
235
|
+
}
|
|
236
|
+
if (argValues.length >= 2 && isKnown(argValues[0]) && isKnown(argValues[1])) {
|
|
237
|
+
const start = argValues[0].value;
|
|
238
|
+
const end = argValues[1].value;
|
|
239
|
+
return createConstant(s.substring(start, end), 'string', line);
|
|
240
|
+
}
|
|
241
|
+
}
|
|
242
|
+
if (methodName === 'equals' && argsNode) {
|
|
243
|
+
const argValues = this.getArgumentValues(argsNode);
|
|
244
|
+
if (argValues.length > 0 && isKnown(argValues[0]) && argValues[0].type === 'string') {
|
|
245
|
+
return createConstant(s === argValues[0].value, 'bool', line);
|
|
246
|
+
}
|
|
247
|
+
}
|
|
248
|
+
if (methodName === 'toUpperCase') {
|
|
249
|
+
return createConstant(s.toUpperCase(), 'string', line);
|
|
250
|
+
}
|
|
251
|
+
if (methodName === 'toLowerCase') {
|
|
252
|
+
return createConstant(s.toLowerCase(), 'string', line);
|
|
253
|
+
}
|
|
254
|
+
if (methodName === 'trim') {
|
|
255
|
+
return createConstant(s.trim(), 'string', line);
|
|
256
|
+
}
|
|
257
|
+
}
|
|
258
|
+
return createUnknown(line);
|
|
259
|
+
}
|
|
260
|
+
evaluateFieldAccess(node) {
|
|
261
|
+
const line = getNodeLine(node);
|
|
262
|
+
const text = getNodeText(node, this.source);
|
|
263
|
+
// Common constants
|
|
264
|
+
if (text === 'Integer.MAX_VALUE') {
|
|
265
|
+
return createConstant(2147483647, 'int', line);
|
|
266
|
+
}
|
|
267
|
+
if (text === 'Integer.MIN_VALUE') {
|
|
268
|
+
return createConstant(-2147483648, 'int', line);
|
|
269
|
+
}
|
|
270
|
+
return createUnknown(line);
|
|
271
|
+
}
|
|
272
|
+
/**
|
|
273
|
+
* Get argument values from an argument list node.
|
|
274
|
+
*/
|
|
275
|
+
getArgumentValues(argsNode) {
|
|
276
|
+
const values = [];
|
|
277
|
+
for (const child of argsNode.children) {
|
|
278
|
+
if (child.type !== '(' && child.type !== ')' && child.type !== ',') {
|
|
279
|
+
values.push(this.evaluate(child));
|
|
280
|
+
}
|
|
281
|
+
}
|
|
282
|
+
return values;
|
|
283
|
+
}
|
|
284
|
+
unescapeChar(char) {
|
|
285
|
+
switch (char) {
|
|
286
|
+
case '\\n': return '\n';
|
|
287
|
+
case '\\t': return '\t';
|
|
288
|
+
case '\\r': return '\r';
|
|
289
|
+
case '\\\\': return '\\';
|
|
290
|
+
case "\\'": return "'";
|
|
291
|
+
case '\\"': return '"';
|
|
292
|
+
default: return char;
|
|
293
|
+
}
|
|
294
|
+
}
|
|
295
|
+
}
|
|
296
|
+
//# sourceMappingURL=evaluator.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElG;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAEpB;IACA;IAFV,YACU,MAAc,EACd,SAAsD;QADtD,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAA6C;IAC7D,CAAC;IAEJ;;OAEG;IACH,QAAQ,CAAC,IAAU;QACjB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,WAAW;YACX,KAAK,yBAAyB,CAAC;YAC/B,KAAK,qBAAqB,CAAC;YAC3B,KAAK,uBAAuB;gBAC1B,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAEzD,KAAK,gCAAgC;gBACnC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAEzD,KAAK,gBAAgB;gBACnB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAE3D,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAED,KAAK,MAAM;gBACT,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,KAAK,OAAO;gBACV,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE7C,KAAK,cAAc;gBACjB,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,qBAAqB;YACrB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,2BAA2B;YAC3B,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAChF,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,oBAAoB;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAEnC,mBAAmB;YACnB,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAElC,qBAAqB;YACrB,KAAK,oBAAoB;gBACvB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAEpC,oBAAoB;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEvC,eAAe;YACf,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAExC;gBACE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,IAAU;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,aAAa;YACb,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrD,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;oBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/E,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBACjD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/E,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,aAAa;YACb,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,UAAU;YACV,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,aAAa,CAAC,IAAU;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAuB,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,eAAe,CAAC,IAAU;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE3C,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpD,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,kBAAkB,CAAC,IAAU;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,iBAAiB;QACjB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;YAEzB,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACjF,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBACzC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;wBAC/B,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,UAAU,KAAK,WAAW,IAAI,QAAQ,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBAC3C,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBACzC,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpF,OAAO,cAAc,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,mBAAmB,CAAC,IAAU;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,mBAAmB;QACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAc;QAC9B,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC;YACzB,KAAK,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC;YACvB,KAAK,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC;YACvB,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Constant Propagation Engine
|
|
3
|
+
*
|
|
4
|
+
* Tracks constant values through variable assignments and evaluates expressions
|
|
5
|
+
* to detect dead code and reduce false positives in taint analysis.
|
|
6
|
+
*
|
|
7
|
+
* @module constant-propagation
|
|
8
|
+
*/
|
|
9
|
+
import type { Tree } from 'web-tree-sitter';
|
|
10
|
+
import type { ConstantPropagatorResult, ConstantPropagationOptions } from './types.js';
|
|
11
|
+
export type { ConstantType, ConstantValue, ConstantPropagatorResult, ConstantPropagationOptions, TaintedParameter } from './types.js';
|
|
12
|
+
export { isKnown, createUnknown, createConstant, getNodeText, getNodeLine } from './ast-utils.js';
|
|
13
|
+
export { TAINT_PATTERNS, TAINT_PATTERN_REGEX, SANITIZER_METHODS, PROPAGATOR_METHODS } from './patterns.js';
|
|
14
|
+
export { ExpressionEvaluator } from './evaluator.js';
|
|
15
|
+
export { ConstantPropagator } from './propagator.js';
|
|
16
|
+
/**
|
|
17
|
+
* Analyze source code for constant propagation.
|
|
18
|
+
*
|
|
19
|
+
* @param tree - Parsed AST from tree-sitter
|
|
20
|
+
* @param sourceCode - Original source code
|
|
21
|
+
* @param options - Analysis options
|
|
22
|
+
* @returns Constant propagation result with symbols, tainted vars, and unreachable lines
|
|
23
|
+
*/
|
|
24
|
+
export declare function analyzeConstantPropagation(tree: Tree, sourceCode: string, options?: ConstantPropagationOptions): ConstantPropagatorResult;
|
|
25
|
+
/**
|
|
26
|
+
* Check if a potential vulnerability is a false positive.
|
|
27
|
+
*
|
|
28
|
+
* @param result - Constant propagation result
|
|
29
|
+
* @param sinkLine - Line number of the sink
|
|
30
|
+
* @param taintedVar - Name of the potentially tainted variable
|
|
31
|
+
* @returns Object indicating if it's a false positive and the reason
|
|
32
|
+
*/
|
|
33
|
+
export declare function isFalsePositive(result: ConstantPropagatorResult, sinkLine: number, taintedVar: string): {
|
|
34
|
+
isFalsePositive: boolean;
|
|
35
|
+
reason: string | null;
|
|
36
|
+
};
|
|
37
|
+
/**
|
|
38
|
+
* Check if a taint flow is a false positive due to correlated predicates.
|
|
39
|
+
*
|
|
40
|
+
* This handles cases like:
|
|
41
|
+
* if(choice) { x = tainted; }
|
|
42
|
+
* if(!choice) { sink(x); }
|
|
43
|
+
*
|
|
44
|
+
* The taint of x only applies when choice=true, but the sink only executes
|
|
45
|
+
* when choice=false. These are mutually exclusive paths, so no vulnerability.
|
|
46
|
+
*
|
|
47
|
+
* @param result - Constant propagation result with conditional taint info
|
|
48
|
+
* @param flow - The taint flow to check
|
|
49
|
+
* @returns true if this is a false positive due to correlated predicates
|
|
50
|
+
*/
|
|
51
|
+
export declare function isCorrelatedPredicateFP(result: ConstantPropagatorResult, flow: {
|
|
52
|
+
source: {
|
|
53
|
+
line: number;
|
|
54
|
+
};
|
|
55
|
+
sink: {
|
|
56
|
+
line: number;
|
|
57
|
+
};
|
|
58
|
+
path: Array<{
|
|
59
|
+
variable: string;
|
|
60
|
+
line: number;
|
|
61
|
+
}>;
|
|
62
|
+
}): boolean;
|
|
@@ -0,0 +1,152 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Constant Propagation Engine
|
|
3
|
+
*
|
|
4
|
+
* Tracks constant values through variable assignments and evaluates expressions
|
|
5
|
+
* to detect dead code and reduce false positives in taint analysis.
|
|
6
|
+
*
|
|
7
|
+
* @module constant-propagation
|
|
8
|
+
*/
|
|
9
|
+
import { ConstantPropagator } from './propagator.js';
|
|
10
|
+
// Re-export utilities
|
|
11
|
+
export { isKnown, createUnknown, createConstant, getNodeText, getNodeLine } from './ast-utils.js';
|
|
12
|
+
// Re-export patterns
|
|
13
|
+
export { TAINT_PATTERNS, TAINT_PATTERN_REGEX, SANITIZER_METHODS, PROPAGATOR_METHODS } from './patterns.js';
|
|
14
|
+
// Re-export classes
|
|
15
|
+
export { ExpressionEvaluator } from './evaluator.js';
|
|
16
|
+
export { ConstantPropagator } from './propagator.js';
|
|
17
|
+
/**
|
|
18
|
+
* Analyze source code for constant propagation.
|
|
19
|
+
*
|
|
20
|
+
* @param tree - Parsed AST from tree-sitter
|
|
21
|
+
* @param sourceCode - Original source code
|
|
22
|
+
* @param options - Analysis options
|
|
23
|
+
* @returns Constant propagation result with symbols, tainted vars, and unreachable lines
|
|
24
|
+
*/
|
|
25
|
+
export function analyzeConstantPropagation(tree, sourceCode, options = {}) {
|
|
26
|
+
const propagator = new ConstantPropagator();
|
|
27
|
+
return propagator.analyze(tree, sourceCode, options.additionalTaintPatterns ?? [], options.sanitizerMethods ?? [], options.taintedParameters ?? []);
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* Check if a potential vulnerability is a false positive.
|
|
31
|
+
*
|
|
32
|
+
* @param result - Constant propagation result
|
|
33
|
+
* @param sinkLine - Line number of the sink
|
|
34
|
+
* @param taintedVar - Name of the potentially tainted variable
|
|
35
|
+
* @returns Object indicating if it's a false positive and the reason
|
|
36
|
+
*/
|
|
37
|
+
export function isFalsePositive(result, sinkLine, taintedVar) {
|
|
38
|
+
// Reason 1: Sink is in dead code
|
|
39
|
+
if (result.unreachableLines.has(sinkLine)) {
|
|
40
|
+
return { isFalsePositive: true, reason: 'sink_in_dead_code' };
|
|
41
|
+
}
|
|
42
|
+
// Reason 2: Variable has constant value (not tainted)
|
|
43
|
+
const varValue = result.symbols.get(taintedVar);
|
|
44
|
+
if (varValue && varValue.type !== 'unknown' && !result.tainted.has(taintedVar)) {
|
|
45
|
+
return { isFalsePositive: true, reason: `variable_is_constant: ${varValue.value}` };
|
|
46
|
+
}
|
|
47
|
+
// Reason 3: Variable not tainted
|
|
48
|
+
if (!result.tainted.has(taintedVar)) {
|
|
49
|
+
return { isFalsePositive: true, reason: 'variable_not_tainted' };
|
|
50
|
+
}
|
|
51
|
+
return { isFalsePositive: false, reason: null };
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* Check if a taint flow is a false positive due to correlated predicates.
|
|
55
|
+
*
|
|
56
|
+
* This handles cases like:
|
|
57
|
+
* if(choice) { x = tainted; }
|
|
58
|
+
* if(!choice) { sink(x); }
|
|
59
|
+
*
|
|
60
|
+
* The taint of x only applies when choice=true, but the sink only executes
|
|
61
|
+
* when choice=false. These are mutually exclusive paths, so no vulnerability.
|
|
62
|
+
*
|
|
63
|
+
* @param result - Constant propagation result with conditional taint info
|
|
64
|
+
* @param flow - The taint flow to check
|
|
65
|
+
* @returns true if this is a false positive due to correlated predicates
|
|
66
|
+
*/
|
|
67
|
+
export function isCorrelatedPredicateFP(result, flow) {
|
|
68
|
+
// Get the condition that guards the sink line
|
|
69
|
+
const sinkCondition = result.lineConditions?.get(flow.sink.line);
|
|
70
|
+
if (!sinkCondition) {
|
|
71
|
+
return false; // Sink is not under a known condition
|
|
72
|
+
}
|
|
73
|
+
// Check each variable in the taint path
|
|
74
|
+
for (const step of flow.path) {
|
|
75
|
+
const varName = step.variable;
|
|
76
|
+
// Check both scoped and unscoped variable names
|
|
77
|
+
const checkNames = [varName, varName.split(':').pop() || varName];
|
|
78
|
+
// Find which condition this variable was tainted under
|
|
79
|
+
for (const [taintCond, taintedVars] of result.conditionalTaints?.entries() ?? []) {
|
|
80
|
+
// Check if any of our variable names match tainted vars (considering scoping)
|
|
81
|
+
let matched = false;
|
|
82
|
+
for (const checkName of checkNames) {
|
|
83
|
+
if (taintedVars.has(checkName)) {
|
|
84
|
+
matched = true;
|
|
85
|
+
break;
|
|
86
|
+
}
|
|
87
|
+
// Also check if any tainted var ends with :checkName (scoped match)
|
|
88
|
+
for (const taintedVar of taintedVars) {
|
|
89
|
+
if (taintedVar.endsWith(':' + checkName)) {
|
|
90
|
+
matched = true;
|
|
91
|
+
break;
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
if (matched)
|
|
95
|
+
break;
|
|
96
|
+
}
|
|
97
|
+
if (matched) {
|
|
98
|
+
// Check if the taint condition and sink condition are mutually exclusive
|
|
99
|
+
if (areNegatedConditions(taintCond, sinkCondition)) {
|
|
100
|
+
return true; // Correlated predicate FP
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
}
|
|
105
|
+
return false;
|
|
106
|
+
}
|
|
107
|
+
/**
|
|
108
|
+
* Check if two condition expressions are negations of each other.
|
|
109
|
+
* "x" and "!x" are negations.
|
|
110
|
+
* "!x" and "x" are negations.
|
|
111
|
+
*/
|
|
112
|
+
function areNegatedConditions(cond1, cond2) {
|
|
113
|
+
const norm1 = normalizeCondition(cond1);
|
|
114
|
+
const norm2 = normalizeCondition(cond2);
|
|
115
|
+
// Check if one is the negation of the other
|
|
116
|
+
if (norm1.startsWith('!') && normalizeCondition(norm1.slice(1)) === norm2) {
|
|
117
|
+
return true;
|
|
118
|
+
}
|
|
119
|
+
if (norm2.startsWith('!') && normalizeCondition(norm2.slice(1)) === norm1) {
|
|
120
|
+
return true;
|
|
121
|
+
}
|
|
122
|
+
return false;
|
|
123
|
+
}
|
|
124
|
+
/**
|
|
125
|
+
* Normalize a condition expression for comparison.
|
|
126
|
+
*/
|
|
127
|
+
function normalizeCondition(cond) {
|
|
128
|
+
let normalized = cond.trim();
|
|
129
|
+
// Remove outer parentheses
|
|
130
|
+
while (normalized.startsWith('(') && normalized.endsWith(')')) {
|
|
131
|
+
let depth = 0;
|
|
132
|
+
let balanced = true;
|
|
133
|
+
for (let i = 0; i < normalized.length - 1; i++) {
|
|
134
|
+
if (normalized[i] === '(')
|
|
135
|
+
depth++;
|
|
136
|
+
else if (normalized[i] === ')')
|
|
137
|
+
depth--;
|
|
138
|
+
if (depth === 0 && i > 0) {
|
|
139
|
+
balanced = false;
|
|
140
|
+
break;
|
|
141
|
+
}
|
|
142
|
+
}
|
|
143
|
+
if (balanced) {
|
|
144
|
+
normalized = normalized.slice(1, -1).trim();
|
|
145
|
+
}
|
|
146
|
+
else {
|
|
147
|
+
break;
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
return normalized;
|
|
151
|
+
}
|
|
152
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAKrD,sBAAsB;AACtB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElG,qBAAqB;AACrB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAE3G,oBAAoB;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAU,EACV,UAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC,OAAO,CACvB,IAAI,EACJ,UAAU,EACV,OAAO,CAAC,uBAAuB,IAAI,EAAE,EACrC,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAC9B,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAgC,EAChC,QAAgB,EAChB,UAAkB;IAElB,iCAAiC;IACjC,IAAI,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,IAA2G;IAE3G,8CAA8C;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,CAAC,sCAAsC;IACtD,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,gDAAgD;QAChD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,CAAC;QAElE,uDAAuD;QACvD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjF,8EAA8E;YAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC/B,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;gBACD,oEAAoE;gBACpE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;wBACzC,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO;oBAAE,MAAM;YACrB,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,yEAAyE;gBACzE,IAAI,oBAAoB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC,CAAC,0BAA0B;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAExC,4CAA4C;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Taint source patterns, sanitizer methods, and propagator methods.
|
|
3
|
+
*/
|
|
4
|
+
export declare const TAINT_PATTERNS: string[];
|
|
5
|
+
export declare const TAINT_PATTERN_REGEX: RegExp;
|
|
6
|
+
export declare const SANITIZER_METHODS: Set<string>;
|
|
7
|
+
export declare const ANTI_SANITIZER_METHODS: Set<string>;
|
|
8
|
+
export declare const PROPAGATOR_METHODS: Set<string>;
|