Module TypeInference
Provides classes implementing a simple intra-procedural flow analysis for inferring abstract values of nodes in the data-flow graph representation of the program.
Properties of object literals and class/function instances are tracked to some degree, but completeness should not be relied upon.
The abstract value inference consists of a local layer implemented by
AnalyzedNode.getALocalValue()
and a full layer implemented by
AnalyzedNode.getAValue()
. The former only models flow through expressions, variables
(both local and global), IIFEs, ES6 imports that can be resolved unambiguously, and
flow through properties of CommonJS module
and exports
objects (including require
).
The full layer adds some modeling of flow through properties of object literals and of
function/class instances: any value that flows into the right-hand-side of a write to
property p
of an abstract value a
that represents an object literal or instance is
considered to flow out of all reads of p
on a
. However, in inferring which abstract
value a
some property read or write refers to and what flows into the right-hand-side
of a property write, only local reasoning is used. In particular, the full layer does
not allow reasoning about nested property writes of the form p.q.r
(except where p.q
is a module/exports object and hence handled by local flow).
Also note that object inheritance is not modeled. Soundness is, however, preserved in the sense that all expressions whole value derives (directly or indirectly) from a property read are marked as indefinite.
Import path
import semmle.javascript.dataflow.TypeInference
Imports
AbstractValues | Provides classes for working with abstract values. |
BasicExprTypeInference | INTERNAL: Do not use directly; use |
InterModuleTypeInference | INTERNAL: Do not use directly; use |
InterProceduralTypeInference | INTERNAL: Do not use directly; use |
PropertyTypeInference | INTERNAL: Do not use directly; use |
VariableTypeInference | INTERNAL: Do not use directly; use |
Classes
AnalyzedFunction | A function for which analysis results are available. |
AnalyzedModule | A module for which analysis results are available. |
AnalyzedNode | A data flow node for which analysis results are available. |
AnalyzedValueNode | A value node for which analysis results are available. |