Skip to content

/ codeql Public

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JS: Restrict what PackageExports considers to be public #6789

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

JS: Restrict what PackageExports considers to be public #6789

wants to merge 3 commits into from
+54 −9

Conversation

@asgerf
Copy link
Contributor

@asgerf asgerf commented Oct 1, 2021

Makes PackageExports.qll more conservative in what it considers to be public API:

  • Require that the first name of a property is a letter or number (for array indices), excluding things like _foo, $foo, ES private names like #foo, symbol keys, and non-ascii names such as the internal names used in Angular.
  • Exclude methods/constructors declared as private or protected in a TypeScript file.
asgerf added 3 commits Oct 1, 2021
@asgerf
JS: Restrict what property names that are considered public exports
af1b04d
@asgerf
JS: Exclude methods declared private/protected
600e5ba
@asgerf
JS: Add test case
c8e7df7
@asgerf asgerf requested a review from as a code owner Oct 1, 2021
@asgerf asgerf mentioned this pull request Oct 1, 2021
Open
@asgerf asgerf mentioned this pull request Oct 1, 2021
Open
erik-krogh
erik-krogh approved these changes Oct 1, 2021
View changes
Copy link
Contributor

@erik-krogh erik-krogh left a comment •
edited

👍

I've started an evaluation on the queries that use PackageExports.
_Edit: _ And the evaluation looks fine, the lost had sources from methods starting with an underscore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@erik-krogh erik-krogh

Assignees
No one assigned
Labels
JS no-change-note-required
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants
@asgerf @erik-krogh