CodeQL library for JavaScript/TypeScript
codeql/javascript-all 2.1.1 (changelog, source)
Search

Module TypeInference

Provides classes implementing a simple intra-procedural flow analysis for inferring abstract values of nodes in the data-flow graph representation of the program.

Properties of object literals and class/function instances are tracked to some degree, but completeness should not be relied upon.

The abstract value inference consists of a local layer implemented by AnalyzedNode.getALocalValue() and a full layer implemented by AnalyzedNode.getAValue(). The former only models flow through expressions, variables (both local and global), IIFEs, ES6 imports that can be resolved unambiguously, and flow through properties of CommonJS module and exports objects (including require).

The full layer adds some modeling of flow through properties of object literals and of function/class instances: any value that flows into the right-hand-side of a write to property p of an abstract value a that represents an object literal or instance is considered to flow out of all reads of p on a. However, in inferring which abstract value a some property read or write refers to and what flows into the right-hand-side of a property write, only local reasoning is used. In particular, the full layer does not allow reasoning about nested property writes of the form p.q.r (except where p.q is a module/exports object and hence handled by local flow).

Also note that object inheritance is not modeled. Soundness is, however, preserved in the sense that all expressions whole value derives (directly or indirectly) from a property read are marked as indefinite.

Import path

import semmle.javascript.dataflow.TypeInference

Imports

AbstractValues

Provides classes for working with abstract values.

BasicExprTypeInference

INTERNAL: Do not use directly; use semmle.javascript.dataflow.TypeInference instead.

InterModuleTypeInference

INTERNAL: Do not use directly; use semmle.javascript.dataflow.TypeInference instead.

InterProceduralTypeInference

INTERNAL: Do not use directly; use semmle.javascript.dataflow.TypeInference instead.

PropertyTypeInference

INTERNAL: Do not use directly; use semmle.javascript.dataflow.TypeInference instead.

VariableTypeInference

INTERNAL: Do not use directly; use semmle.javascript.dataflow.TypeInference instead.

Classes

AnalyzedFunction

A function for which analysis results are available.

AnalyzedModule

A module for which analysis results are available.

AnalyzedNode

A data flow node for which analysis results are available.

AnalyzedValueNode

A value node for which analysis results are available.