Merge pull request #8157 from erik-krogh/lodash-clone

erik-krogh · web-flow · commit b6b93065ff50 · 2022-02-22T18:12:10.000+01:00
JS: add lodash.{clone, cloneDeep} as a clone step
diff --git a/javascript/ql/lib/semmle/javascript/Extend.qll b/javascript/ql/lib/semmle/javascript/Extend.qll
@@ -182,6 +182,8 @@ private class CloneStep extends PreCallGraphStep {
       call = DataFlow::moduleImport(["clone", "fclone", "sort-keys", "camelcase-keys"]).getACall()
       or
       call = DataFlow::moduleMember("json-cycle", ["decycle", "retrocycle"]).getACall()
+      or
+      call = LodashUnderscore::member(["clone", "cloneDeep"]).getACall()
     |
       pred = call.getArgument(0) and
       succ = call

Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,8 @@ private class CloneStep extends PreCallGraphStep {`
`182`	`182`	`call = DataFlow::moduleImport(["clone", "fclone", "sort-keys", "camelcase-keys"]).getACall()`
`183`	`183`	`or`
`184`	`184`	`call = DataFlow::moduleMember("json-cycle", ["decycle", "retrocycle"]).getACall()`
	`185`	`+ or`
	`186`	`+ call = LodashUnderscore::member(["clone", "cloneDeep"]).getACall()`
`185`	`187`	`\|`
`186`	`188`	`pred = call.getArgument(0) and`
`187`	`189`	`succ = call`