JavaScript: Improve CFG for non-toplevel imports #275
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 4 commits
October 3, 2018 13:08
aibaars
pushed a commit
that referenced
this pull request
Oct 14, 2021
API graphs: Fix bug for resolvable modules
smowton
added a commit
to smowton/codeql
that referenced
this pull request
Apr 16, 2022
…-locations-and-syntactic-enclosure Fix locations and enclosing statement/callable for assignments
MathiasVP
pushed a commit
to MathiasVP/ql
that referenced
this pull request
Nov 20, 2025
False Positive - `cs/zipslip`
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a non-standard language feature for which we have parser support. Previously, however, the CFG extractor and the QL library still assumed that all imports appear at the toplevel, which gave us strange results for example on meteor.
This PR updates the QL library to remove the assumption about imports being top-level. Furthermore, we patch the missing CFG edges for non-toplevel imports in the library. I will open an internal PR that teaches the extractor to add these edges to begin with. The QL-level patch is compatible with the extractor changes, so having either or both of them works, and consequently we can deal with the PRs independently.
I have verified that this removes the false positives on meteor and doesn't otherwise affect results, at a very moderate cost to performance (<5%, so probably within the margin of error).