JS: Fix bug in MkClassInstance use-nodes

This only worked when the RHS was a SourceNode, which is not generally the case
github · Apr 18, 2024 · 3c885f3 · 3c885f3
1 parent 5e7026c
commit 3c885f3
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/javascript/ql/lib/semmle/javascript/ApiGraphs.qll b/javascript/ql/lib/semmle/javascript/ApiGraphs.qll
@@ -1319,7 +1319,7 @@ module API {
         succ = MkDef(rhs)
         or
         exists(DataFlow::ClassNode cls |
-          cls.getAnInstanceReference() = rhs and
+          cls.getAnInstanceReference().flowsTo(rhs) and
           succ = MkClassInstance(cls)
         )
       )

diff --git a/javascript/ql/test/library-tests/ModelGeneration/ModelGeneration.expected b/javascript/ql/test/library-tests/ModelGeneration/ModelGeneration.expected
@@ -5,6 +5,7 @@ typeModel
 | (aliases).Alias1 | aliases | Member[Alias4].Member[x].Member[x] |
 | (aliases).Alias1 | aliases | Member[AliasedClass] |
 | (aliases).Alias1.prototype | (aliases).Alias1 | Instance |
+| (aliases).Alias1.prototype | (aliases).Alias1.prototype.foo | ReturnValue |
 | (aliases).Alias1.prototype.foo | (aliases).Alias1.prototype | Member[foo] |
 | (long-access-path).a.shortcut.d | long-access-path | Member[a].Member[b].Member[c].Member[d] |
 | (long-access-path).a.shortcut.d | long-access-path | Member[a].Member[shortcut].Member[d] |
@@ -14,6 +15,7 @@ typeModel
 | (return-this).FluentInterface.prototype | (return-this).FluentInterface | Instance |
 | (return-this).FluentInterface.prototype | (return-this).FluentInterface.prototype.bar | ReturnValue |
 | (return-this).FluentInterface.prototype | (return-this).FluentInterface.prototype.baz | ReturnValue |
+| (return-this).FluentInterface.prototype | (return-this).FluentInterface.prototype.foo | ReturnValue |
 | (return-this).FluentInterface.prototype.bar | (return-this).FluentInterface.prototype | Member[bar] |
 | (return-this).FluentInterface.prototype.baz | (return-this).FluentInterface.prototype | Member[baz] |
 | (return-this).FluentInterface.prototype.foo | (return-this).FluentInterface.prototype | Member[foo] |