JS: Correctly recognize Array.isArray calls

asgerf · asgerf · commit e3c84eefc11a · 2022-09-07T13:39:52.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/TypeConfusionThroughParameterTamperingQuery.qll
@@ -50,7 +50,7 @@ private class TypeOfTestBarrier extends DataFlow::BarrierGuardNode, DataFlow::Va
 }
 
 private class IsArrayBarrier extends DataFlow::BarrierGuardNode, DataFlow::CallNode {
-  IsArrayBarrier() { this = DataFlow::globalVarRef("Array").getAMemberCall("isArray").getACall() }
+  IsArrayBarrier() { this = DataFlow::globalVarRef("Array").getAMemberCall("isArray") }
 
   override predicate blocks(boolean outcome, Expr e) {
     e = getArgument(0).asExpr() and

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,7 @@ private class TypeOfTestBarrier extends DataFlow::BarrierGuardNode, DataFlow::Va`
`50`	`50`	`}`
`51`	`51`
`52`	`52`	`private class IsArrayBarrier extends DataFlow::BarrierGuardNode, DataFlow::CallNode {`
`53`		`- IsArrayBarrier() { this = DataFlow::globalVarRef("Array").getAMemberCall("isArray").getACall() }`
	`53`	`+ IsArrayBarrier() { this = DataFlow::globalVarRef("Array").getAMemberCall("isArray") }`
`54`	`54`
`55`	`55`	`override predicate blocks(boolean outcome, Expr e) {`
`56`	`56`	`e = getArgument(0).asExpr() and`