Module Refinements
INTERNAL: This is an internal library; its interface may change without notice.
Provides classes for working with variable refinements.
Variable refinements are expressions that appear in a guard node
(such as an if
condition) and can be used to refine the information
derived about a variable by the flow analysis. Each refinement only
refines a single variable, and only certain simple constructs are
considered (primarily typeof
expressions and comparisons).
To perform the refinement, the expression is evaluated to a
RefinementValue
, which is a more fine-grained version of AbstractValue
that distinguishes individual constants value. This evaluation takes place
in a context that restricts the value of the refined variable to a single
candidate value, which is one of the AbstractValue
s that the flow analysis
infers for it.
If the expression evaluates to a refinement value that represents true
,
then the candidate value passes the refinement. Hence, it can be propagated
across a condition guard with outcome true
.
Conversely, if it evaluates to false
, the candidate value can be propagated
across a condition guard with outcome false
.
Note that, like all abstract values, refinement values are overapproximations,
so the refinement can evaluate to both true
and false
for the same
candidate value.
Import path
import semmle.javascript.dataflow.Refinements
Imports
javascript | Provides classes for working with JavaScript programs, as well as JSON, YAML and HTML. |
Classes
Refinement | A refinement candidate that references at most one variable, and hence can be used to refine the abstract values inferred for that variable. |
RefinementCandidate | An expression that has the right syntactic structure to be used to refine the abstract values inferred for a variable. |
RefinementContext | A context in which a refinement expression is analyzed. |
RefinementValue | An abstract value of a refinement expression. |
SingletonRefinementValue | A refinement value that represents exactly one concrete value. |
VarRefinementContext | A refinement context specifying that some variable is assumed to have one particular abstract value. |
Datatypes
TRefinementContext | A context in which a refinement expression is analyzed. |