JS: Do not view packages as nested in a private package

asgerf · asgerf · commit 8930ce74afa5 · 2024-01-30T13:20:57.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/NPM.qll b/javascript/ql/lib/semmle/javascript/NPM.qll
@@ -29,7 +29,8 @@ class PackageJson extends JsonObject {
       parentDir.getAChildContainer+() = currentDir and
       pkgNameDiff = currentDir.getAbsolutePath().suffix(parentDir.getAbsolutePath().length()) and
       not exists(pkgNameDiff.indexOf("/node_modules/")) and
-      result = parentPkgName + pkgNameDiff
+      result = parentPkgName + pkgNameDiff and
+      not parentPkg.isPrivate()
     )
   }
 

Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,8 @@ class PackageJson extends JsonObject {`
`29`	`29`	`parentDir.getAChildContainer+() = currentDir and`
`30`	`30`	`pkgNameDiff = currentDir.getAbsolutePath().suffix(parentDir.getAbsolutePath().length()) and`
`31`	`31`	`not exists(pkgNameDiff.indexOf("/node_modules/")) and`
`32`		`- result = parentPkgName + pkgNameDiff`
	`32`	`+ result = parentPkgName + pkgNameDiff and`
	`33`	`+ not parentPkg.isPrivate()`
`33`	`34`	`)`
`34`	`35`	`}`
`35`	`36`