Skip to content

Commit c858e49

Browse files
committed
fix Sqlite and BetterSqlite3 issues according to Review
1 parent e3dbdc3 commit c858e49

File tree

1 file changed

+18
-17
lines changed
  • javascript/ql/lib/semmle/javascript/frameworks

1 file changed

+18
-17
lines changed

javascript/ql/lib/semmle/javascript/frameworks/SQL.qll

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -280,11 +280,7 @@ private module Sqlite3 {
280280
private module Sqlite {
281281
/** Gets an expression that constructs or returns a Sqlite database instance. */
282282
API::Node database() {
283-
result =
284-
[
285-
API::moduleImport("sqlite").getMember("open").getReturn(),
286-
API::moduleImport("sqlite").getMember("open").getReturn().getPromised()
287-
]
283+
result = API::moduleImport("sqlite").getMember("open").getReturn().getPromised()
288284
}
289285

290286
/** A call to a Sqlite query method. */
@@ -293,7 +289,7 @@ private module Sqlite {
293289
this = database().getMember(["all", "each", "exec", "get", "prepare", "run"]).getACall()
294290
}
295291

296-
override DataFlow::Node getAResult() { result = this.getReturn().asSource() }
292+
override DataFlow::Node getAResult() { result = this }
297293

298294
override DataFlow::Node getAQueryArgument() { result = this.getArgument(0) }
299295
}
@@ -308,21 +304,26 @@ private module Sqlite {
308304
* Provides classes modeling the `better-sqlite3` package.
309305
*/
310306
private module BetterSqlite3 {
311-
/** Gets an expression that constructs or returns a better-sqlite3 database instance. */
307+
/**
308+
* Gets an expression that constructs or returns a `better-sqlite3` database instance.
309+
*/
312310
API::Node database() {
313-
result =
314-
[
315-
API::moduleImport("better-sqlite3").getMember("Database"),
316-
API::moduleImport("better-sqlite3").getReturn()
317-
]
311+
// initialDatabaseInstance is an instance of Database that constructed and instantiated in the first step of Database initialization,
312+
// not from a return value of the other library functions
313+
exists(API::Node initialDatabaseInstance |
314+
initialDatabaseInstance =
315+
[
316+
API::moduleImport("better-sqlite3").getInstance(),
317+
API::moduleImport("better-sqlite3").getReturn()
318+
]
319+
|
320+
result = [initialDatabaseInstance, initialDatabaseInstance.getMember("exec").getReturn()]
321+
)
318322
}
319323

320324
/** A call to a better-sqlite3 query method. */
321-
private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
322-
QueryCall() {
323-
this = database().getMember(["exec", "prepare"]).getACall() or
324-
this = database().getMember("exec").getReturn().getMember("prepare").getACall()
325-
}
325+
private class QueryCall extends DatabaseAccess, API::CallNode {
326+
QueryCall() { this = database().getMember(["exec", "prepare"]).getACall() }
326327

327328
override DataFlow::Node getAQueryArgument() { result = this.getArgument(0) }
328329
}

0 commit comments

Comments
 (0)