Merge pull request #6962 from asgerf/js/template-db-constraint-err

codeql-ci · web-flow · commit e5e1046c8166 · 2021-10-26T13:43:57.000+01:00
Approved by erik-krogh
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -89,18 +89,23 @@ public void handleElement(Element elt, HtmlPopulator.Context context) {
         }
       } else {
         Attributes attributes = elt.getAttributes();
+        boolean attributesAreExtracted = shouldExtractAttributes(elt);
         // attributes can be null for directives
         if (attributes != null)
           for (Attribute attr : attributes) {
             // ignore empty attributes
             if (attr.getValue() == null || attr.getValue().isEmpty()) continue;
 
+            // If attributes are not extracted we can't use the attribute as the parent node.
+            // In this case, use the enclosing element as the node.
+            Segment parentSegment = attributesAreExtracted ? attr : elt;
+
             extractTemplateTags(
                 textualExtractor,
                 attr.getSource(),
                 attr.getBegin(),
                 attr.getEnd(),
-                () -> context.getNodeLabel(attr));
+                () -> context.getNodeLabel(parentSegment));
 
             String source = attr.getValue();
             int valueStart = attr.getValueSegment().getBegin();
@@ -113,7 +118,7 @@ public void handleElement(Element elt, HtmlPopulator.Context context) {
                   source,
                   valueStart,
                   false /* isTypeScript */,
-                  context.getNodeLabel(attr));
+                  context.getNodeLabel(parentSegment));
             } else if (isAngularTemplateAttributeName(attr.getName())) {
               // For an attribute *ngFor="let var of EXPR", start parsing at EXPR
               int offset = 0;
@@ -133,7 +138,7 @@ public void handleElement(Element elt, HtmlPopulator.Context context) {
                   source,
                   valueStart + offset,
                   false /* isTypeScript */,
-                  context.getNodeLabel(attr));
+                  context.getNodeLabel(parentSegment));
             } else if (source.startsWith("javascript:")) {
               source = source.substring(11);
               extractSnippet(
@@ -144,7 +149,7 @@ public void handleElement(Element elt, HtmlPopulator.Context context) {
                   source,
                   valueStart + 11,
                   false /* isTypeScript */,
-                  context.getNodeLabel(attr));
+                  context.getNodeLabel(parentSegment));
             }
           }
       }
diff --git a/javascript/extractor/src/com/semmle/js/extractor/Main.java b/javascript/extractor/src/com/semmle/js/extractor/Main.java
@@ -43,7 +43,7 @@ public class Main {
    * A version identifier that should be updated every time the extractor changes in such a way that
    * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
    */
-  public static final String EXTRACTOR_VERSION = "2021-09-01";
+  public static final String EXTRACTOR_VERSION = "2021-10-25";
 
   public static final Pattern NEWLINE = Pattern.compile("\n");
 
diff --git a/javascript/extractor/tests/generatedcode/input/attributes.html b/javascript/extractor/tests/generatedcode/input/attributes.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div foo={{foo}}></div>
+    <div foo={{{foo}}}{{/foo}}/>
+    <div foo={{#foo}}{{/foo}}/>
+    <div foo=bar {{#foo}}{{/foo}}/>
+    <div foo=bar {{#foo}}bar={{baz}}{{/foo}}/>
+  </body>
+</html>
diff --git a/javascript/extractor/tests/generatedcode/output/trap/attributes.html.trap b/javascript/extractor/tests/generatedcode/output/trap/attributes.html.trap
