add support for the when polyfill, and expand the defition of ES2015PromiseDefinition

Author: erik-krogh

javascript/change-notes/2021-06-18-promises.md

@@ -6,4 +6,5 @@ lgtm,codescanning
     [promise-polyfill](https://npmjs.com/package/promise-polyfill),
     [rsvp](https://npmjs.com/package/rsvp),
     [es6-promise](https://npmjs.com/package/es6-promise),
-    [native-promise-only](https://npmjs.com/package/native-promise-only)
+    [native-promise-only](https://npmjs.com/package/native-promise-only),
+    [when](https://npmjs.com/package/when)

javascript/ql/src/semmle/javascript/Promises.qll

@@ -81,6 +81,8 @@ private DataFlow::SourceNode getAPromiseObject() {
   result = DataFlow::moduleMember(["es6-promise", "rsvp"], "Promise")
   or
   result = DataFlow::moduleImport("native-promise-only")
+  or
+  result = DataFlow::moduleImport("when")
 }
 
 /**
@@ -97,10 +99,11 @@ class PromiseCandidate extends DataFlow::InvokeNode {
 }
 
 /**
- * A promise object created by the standard ECMAScript 2015 `Promise` constructor.
+ * A promise object created by the standard ECMAScript 2015 `Promise` constructor,
+ * or a polyfill implementing a superset of the ECMAScript 2015 `Promise` API.
  */
-private class ES2015PromiseDefinition extends PromiseDefinition, DataFlow::NewNode {
-  ES2015PromiseDefinition() { this = getAPromiseObject().getAnInstantiation() }
+private class ES2015PromiseDefinition extends PromiseDefinition, DataFlow::InvokeNode {
+  ES2015PromiseDefinition() { this = getAPromiseObject().getAnInvocation() }
 
   override DataFlow::FunctionNode getExecutor() { result = getCallback(0) }
 }

javascript/ql/test/library-tests/Promises/AdditionalPromises.expected

@@ -81,3 +81,4 @@
 | promises.js:79:19:79:41 | Promise ... source) |
 | promises.js:88:17:90:4 | Q.Promi ... );\\n  }) |
 | promises.js:112:17:112:62 | new RSV ... ct) {}) |
+| promises.js:124:19:124:30 | when(source) |

javascript/ql/test/library-tests/Promises/promises.js

@@ -118,3 +118,9 @@
   var Promise = require('native-promise-only');
   Promise.resolve(source);
 })();
+
+(function() {
+  const when = require('when');
+  const promise = when(source);
+  const promise2 = when.resolve(source);
+})();

javascript/ql/test/library-tests/Promises/tests.expected

@@ -42,6 +42,7 @@ test_ResolvedPromiseDefinition
 | promises.js:107:3:107:26 | Promise ... source) | promises.js:107:20:107:25 | source |
 | promises.js:114:3:114:25 | Promise ... source) | promises.js:114:19:114:24 | source |
 | promises.js:119:3:119:25 | Promise ... source) | promises.js:119:19:119:24 | source |
+| promises.js:125:20:125:39 | when.resolve(source) | promises.js:125:33:125:38 | source |
 test_PromiseDefinition_getARejectHandler
 | flow.js:26:2:26:49 | new Pro ... ource)) | flow.js:26:69:26:80 | y => sink(y) |
 | flow.js:32:2:32:49 | new Pro ... ource)) | flow.js:32:57:32:68 | x => sink(x) |
@@ -127,6 +128,7 @@ test_PromiseDefinition
 | promises.js:43:19:45:6 | Q.Promi ... \\n    }) |
 | promises.js:88:17:90:4 | Q.Promi ... );\\n  }) |
 | promises.js:112:17:112:62 | new RSV ... ct) {}) |
+| promises.js:124:19:124:30 | when(source) |
 test_PromiseDefinition_getAResolveHandler
 | flow.js:24:2:24:49 | new Pro ... ource)) | flow.js:24:56:24:67 | x => sink(x) |
 | flow.js:26:2:26:49 | new Pro ... ource)) | flow.js:26:56:26:66 | x => foo(x) |
@@ -429,3 +431,5 @@ typetrack
 | promises.js:114:3:114:25 | Promise ... source) | promises.js:114:19:114:24 | source | store $PromiseResolveField$ |
 | promises.js:119:3:119:25 | Promise ... source) | promises.js:119:19:119:24 | source | copy $PromiseResolveField$ |
 | promises.js:119:3:119:25 | Promise ... source) | promises.js:119:19:119:24 | source | store $PromiseResolveField$ |
+| promises.js:125:20:125:39 | when.resolve(source) | promises.js:125:33:125:38 | source | copy $PromiseResolveField$ |
+| promises.js:125:20:125:39 | when.resolve(source) | promises.js:125:33:125:38 | source | store $PromiseResolveField$ |