Merge pull request github#4958 from asgerf/js/angular2

Approved by erik-krogh

Author: codeql-ci

javascript/change-notes/2021-01-18-angular-templates.md

@@ -0,0 +1,4 @@
+lgtm,codescanning
+* Support for Angular has improved. Angular templates are now parsed and used to
+  establish data flow between components.
+* Support for RxJS has improved. Taint is now tracked through RxJS Observable objects.

javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java

@@ -0,0 +1,63 @@
+package com.semmle.jcorn;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.semmle.js.ast.AngularPipeRef;
+import com.semmle.js.ast.CallExpression;
+import com.semmle.js.ast.Expression;
+import com.semmle.js.ast.Identifier;
+import com.semmle.js.ast.Position;
+import com.semmle.js.ast.SourceLocation;
+import com.semmle.ts.ast.NonNullAssertion;
+
+/**
+ * Parser for Angular template expressions, based on the JS parser with
+ * modified handling of the pipe operator.
+ */
+public class AngularExpressionParser extends CustomParser {
+  public AngularExpressionParser(Options options, String input, int startPos) {
+    super(options, input, startPos);
+  }
+
+  @Override
+  protected Expression buildBinary(
+      int startPos,
+      Position startLoc,
+      Expression left,
+      Expression right,
+      String op,
+      boolean logical) {
+    // Angular pipe expression: `x|f:a` is desugared to `f(x, a)`
+    if (op.equals("|")) {
+      DestructuringErrors refDestructuringErrors = new DestructuringErrors();
+      List<Expression> arguments = new ArrayList<>();
+      arguments.add(left);
+      while (this.type == TokenType.colon) {
+        this.next();
+        int argStartPos = this.pos;
+        Position argStartLocation = this.curPosition();
+        Expression arg = parseMaybeUnary(refDestructuringErrors, false);
+        arguments.add(parseExprOp(arg, argStartPos, argStartLocation, TokenType.plusMin.binop, true));
+      }
+      SourceLocation loc = new SourceLocation(startLoc);
+      if (right instanceof Identifier) {
+        right = new AngularPipeRef(new SourceLocation(right.getLoc()), (Identifier)right);
+      }
+      return this.finishNode(new CallExpression(loc, right, new ArrayList<>(), arguments, false, false));
+    }
+    return super.buildBinary(startPos, startLoc, left, right, op, logical);
+  }
+
+  @Override
+  protected Expression parseExprAtom(DestructuringErrors refDestructuringErrors) {
+    // Parse postfix "!" operator
+    Position startLoc = this.startLoc;
+    Expression expr = super.parseExprAtom(refDestructuringErrors);
+    if (this.type == TokenType.prefix && "!".equals(this.value)) {
+      this.next(); // consume "!" token
+      return finishNode(new NonNullAssertion(new SourceLocation(startLoc), expr));
+    }
+    return expr;
+  }
+}

javascript/extractor/src/com/semmle/jcorn/Parser.java

@@ -3,9 +3,21 @@
 import static com.semmle.jcorn.Whitespace.isNewLine;
 import static com.semmle.jcorn.Whitespace.lineBreak;
 
+import java.io.File;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.Stack;
+import java.util.function.Function;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
 import com.semmle.jcorn.Identifiers.Dialect;
 import com.semmle.jcorn.Options.AllowReserved;
-import com.semmle.jcorn.TokenType.Properties;
 import com.semmle.js.ast.ArrayExpression;
 import com.semmle.js.ast.ArrayPattern;
 import com.semmle.js.ast.ArrowFunctionExpression;
@@ -45,7 +57,6 @@
 import com.semmle.js.ast.IPattern;
 import com.semmle.js.ast.Identifier;
 import com.semmle.js.ast.IfStatement;
-import com.semmle.js.ast.FieldDefinition;
 import com.semmle.js.ast.ImportDeclaration;
 import com.semmle.js.ast.ImportDefaultSpecifier;
 import com.semmle.js.ast.ImportNamespaceSpecifier;
@@ -95,18 +106,6 @@
 import com.semmle.util.exception.CatastrophicError;
 import com.semmle.util.exception.Exceptions;
 import com.semmle.util.io.WholeIO;
-import java.io.File;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.Stack;
-import java.util.function.Function;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 /**
  * Java port of Acorn.
@@ -1462,7 +1461,7 @@ protected Expression parseExprOp(
     return left;
   }
 
-  private Expression buildBinary(
+  protected Expression buildBinary(
       int startPos,
       Position startLoc,
       Expression left,

javascript/extractor/src/com/semmle/js/ast/AngularPipeRef.java

@@ -0,0 +1,27 @@
+package com.semmle.js.ast;
+
+/**
+ * An identifier occurring as the right operand of an Angular pipe expression,
+ * which has been desugared to a function call with this expression as the callee.
+ * <p>
+ * For example, <code>x | f:y</code> is desugared to <code>f(x, y)</code> where the
+ * <code>f</code> is an instance of {@link AngularPipeRef}, and evaluates to the function
+ * being invoked.
+ */
+public class AngularPipeRef extends Expression {
+  private final Identifier identifier;
+
+  public AngularPipeRef(SourceLocation loc, Identifier identifier) {
+    super("AngularPipeRef", loc);
+    this.identifier = identifier;
+  }
+
+  @Override
+  public <Q, A> A accept(Visitor<Q, A> v, Q q) {
+    return v.visit(this, q);
+  }
+
+  public Identifier getIdentifier() {
+    return identifier;
+  }
+}

javascript/extractor/src/com/semmle/js/ast/DefaultVisitor.java

@@ -93,6 +93,11 @@ public R visit(IFunction nd, C c) {
     else return visit((Expression) nd, c);
   }
 
+  @Override
+  public R visit(AngularPipeRef nd, C c) {
+    return visit((Expression) nd, c);
+  }
+
   @Override
   public R visit(AssignmentExpression nd, C c) {
     return visit((Expression) nd, c);

javascript/extractor/src/com/semmle/js/ast/NodeCopier.java

@@ -1,5 +1,8 @@
 package com.semmle.js.ast;
 
+import java.util.ArrayList;
+import java.util.List;
+
 import com.semmle.js.ast.jsx.JSXAttribute;
 import com.semmle.js.ast.jsx.JSXClosingElement;
 import com.semmle.js.ast.jsx.JSXElement;
@@ -48,8 +51,6 @@
 import com.semmle.ts.ast.UnaryTypeExpr;
 import com.semmle.ts.ast.UnionTypeExpr;
 import com.semmle.util.data.IntList;
-import java.util.ArrayList;
-import java.util.List;
 
 /** Deep cloning of AST nodes. */
 public class NodeCopier implements Visitor<Void, INode> {
@@ -77,6 +78,11 @@ private IntList copy(IntList list) {
     return new IntList(list);
   }
 
+  @Override
+  public INode visit(AngularPipeRef nd, Void q) {
+    return new AngularPipeRef(nd.getLoc(), copy(nd.getIdentifier()));
+  }
+
   @Override
   public AssignmentExpression visit(AssignmentExpression nd, Void q) {
     return new AssignmentExpression(

javascript/extractor/src/com/semmle/js/ast/Position.java

@@ -1,6 +1,13 @@
 package com.semmle.js.ast;
 
-/** A source position identifying a single character. */
+/**
+ * A source position identifying a single character.
+ * <p>
+ * Note that this class remains distinct from {@link com.semmle.util.locations.Position},
+ * due to the 1-based line number convention and the tendency for users of this class to provide
+ * dummy offset values. Although the classes are structurally identical, it is not always safe to
+ * convert one into the other.
+ */
 public class Position implements Comparable<Position> {
   private final int line, column, offset;
 
@@ -23,6 +30,8 @@ public int getColumn() {
   /**
    * The offset (0-based) of this position from the start of the file, that is, the number of
    * characters that precede it.
+   * <p>
+   * Note that in some cases, a dummy value is filled in for the offset.
    */
   public int getOffset() {
     return offset;

javascript/extractor/src/com/semmle/js/ast/Visitor.java

@@ -54,6 +54,8 @@
  * <p>Visit methods take a context argument of type {@link C} and return a result of type {@link R}.
  */
 public interface Visitor<C, R> {
+  public R visit(AngularPipeRef nd, C q);
+
   public R visit(AssignmentExpression nd, C q);
 
   public R visit(AssignmentPattern nd, C q);