Merge pull request #15760 from asgerf/js/summarised-tt-store-steps

JS: Summarise store steps for type tracking

Author: asgerf

javascript/ql/lib/semmle/javascript/dataflow/internal/StepSummary.qll

@@ -45,6 +45,8 @@ private module Cached {
       CopyStep(PropertyName prop) or
       LoadStoreStep(PropertyName fromProp, PropertyName toProp) {
         SharedTypeTrackingStep::loadStoreStep(_, _, fromProp, toProp)
+        or
+        summarizedLoadStoreStep(_, _, fromProp, toProp)
       } or
       WithoutPropStep(PropertySet props) { SharedTypeTrackingStep::withoutPropStep(_, _, props) }
   }
@@ -69,6 +71,26 @@ private module Cached {
     AccessPath::isAssignedInUniqueFile(global)
   }
 
+  bindingset[fun]
+  pragma[inline_late]
+  private DataFlow::PropRead getStoredPropRead(DataFlow::FunctionNode fun, string storeProp) {
+    result = fun.getAReturn().getALocalSource().getAPropertySource(storeProp)
+  }
+
+  /**
+   * Holds if `loadProp` of `param` is stored in the `storeProp` property of the return value of `fun`.
+   */
+  pragma[nomagic]
+  private predicate summarizedLoadStoreStep(
+    DataFlow::ParameterNode param, DataFlow::FunctionNode fun, string loadProp, string storeProp
+  ) {
+    exists(DataFlow::PropRead read |
+      read = getStoredPropRead(fun, storeProp) and
+      read.getBase().getALocalSource() = param and
+      read.getPropertyName() = loadProp
+    )
+  }
+
   /**
    * INTERNAL: Use `TypeBackTracker.smallstep()` instead.
    */
@@ -156,6 +178,14 @@ private module Cached {
         exists(string prop |
           param.getAPropertyRead(prop).flowsTo(fun.getAReturn()) and
           summary = LoadStep(prop)
+          or
+          fun.getAReturn().getALocalSource().getAPropertySource(prop) = param and
+          summary = StoreStep(prop)
+        )
+        or
+        exists(string loadProp, string storeProp |
+          summarizedLoadStoreStep(param, fun, loadProp, storeProp) and
+          summary = LoadStoreStep(loadProp, storeProp)
         )
       ) and
       if param = fun.getAParameter()

javascript/ql/test/library-tests/TypeTracking/summarize.js

@@ -0,0 +1,41 @@
+import 'dummy';
+
+function identity(x) {
+    return x;
+}
+function load(x) {
+    return x.loadProp;
+}
+function store(x) {
+    return { storeProp: x };
+}
+function loadStore(x) {
+    return { storeProp: x.loadProp };
+}
+function loadStore2(x) {
+    let mid = x.loadProp;
+    return { storeProp: mid };
+}
+
+identity({});
+load({});
+store({});
+loadStore({});
+loadStore2({});
+
+const obj = {}; // name: obj
+
+let x = identity(obj);
+x; // track: obj
+
+x = load({ loadProp: obj });
+x; // track: obj
+
+x = store(obj);
+x.storeProp; // track: obj
+
+x = loadStore({ loadProp: obj });
+x.storeProp; // track: obj
+
+x = loadStore2({ loadProp: obj });
+x.storeProp; // track: obj