JS: Track DOM elements out of collections

asgerf · asgerf · commit cf1e87de9e2b · 2023-04-26T14:55:34.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/DOM.qll b/javascript/ql/lib/semmle/javascript/DOM.qll
@@ -421,6 +421,9 @@ module DOM {
     t.startInProp("target") and
     result = domEventSource()
     or
+    t.startInProp(DataFlow::PseudoProperties::arrayElement()) and
+    result = domElementCollection()
+    or
     exists(DataFlow::TypeTracker t2 | result = domValueRef(t2).track(t2, t))
   }
 
diff --git a/javascript/ql/test/library-tests/DOM/Customizations.expected b/javascript/ql/test/library-tests/DOM/Customizations.expected
@@ -23,5 +23,6 @@ test_domValueRef
 | nameditems.js:1:1:2:19 | documen ... em('x') |
 | querySelectorAll.js:2:5:2:29 | documen ... ctorAll |
 | querySelectorAll.js:2:5:2:36 | documen ... ('foo') |
+| querySelectorAll.js:2:46:2:48 | elm |
 | tst.js:49:3:49:8 | window |
 | tst.js:50:3:50:8 | window |

Original file line number	Diff line number	Diff line change
`@@ -421,6 +421,9 @@ module DOM {`
`421`	`421`	`t.startInProp("target") and`
`422`	`422`	`result = domEventSource()`
`423`	`423`	`or`
	`424`	`+ t.startInProp(DataFlow::PseudoProperties::arrayElement()) and`
	`425`	`+ result = domElementCollection()`
	`426`	`+ or`
`424`	`427`	`exists(DataFlow::TypeTracker t2 \| result = domValueRef(t2).track(t2, t))`
`425`	`428`	`}`
`426`	`429`