FilesExpand file tree

 main

/

UnstableCyclicImport.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

155 lines (142 loc) · 5.7 KB

 main

/

UnstableCyclicImport.ql

Copy path

Top

File metadata and controls

• Code
• Blame

155 lines (142 loc) · 5.7 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

/**

* @name Unstable cyclic import

* @description If the top-level of a module accesses a variable from a cyclic import, its value depends on

* which module is globally imported first.

* @kind problem

* @problem.severity warning

* @id js/unstable-cyclic-import

* @tags maintainability

* @precision low

*/

import javascript

/**

* Holds if the contents of the given container are executed as part of the top-level code,

* and it is unreachable after top-level execution.

*

* Some of this code might be conditionally executed, but the fact that it can only execute

* as part of the top-level means cyclic imports can't be known to be resolved at this stage.

*/

predicate isImmediatelyExecutedContainer(StmtContainer container) {

container instanceof TopLevel

or

// Namespaces are immediately executed (they cannot be declared inside a function).

container instanceof NamespaceDeclaration

or

// IIFEs at the top-level are immediately executed

exists(ImmediatelyInvokedFunctionExpr function | container = function |

not function.isAsync() and

not function.isGenerator() and

isImmediatelyExecutedContainer(container.getEnclosingContainer())

)

}

/**

* Holds if the given import is only used to import type names, hence has no runtime effect.

*/

predicate isAmbientImport(ImportDeclaration decl) {

decl.getFile().getFileType().isTypeScript() and

exists(decl.getASpecifier()) and

not exists(decl.getASpecifier().getLocal().getVariable().getAnAccess())

}

/**

* Gets an import in `source` that imports `destination` at runtime.

*/

Import getARuntimeImport(Module source, Module destination) {

result = source.getAnImport() and

result.getImportedModule() = destination and

not isAmbientImport(result)

}

predicate isImportedAtRuntime(Module source, Module destination) {

exists(getARuntimeImport(source, destination))

}

/**

* A variable access that is executed as part of the top-level and is not part of an export.

*

* Exported variables reference the variable itself, as opposed it its current value, so it is not

* necessarily an error to export it before it has been initialized. Some runtimes and transpilers

* do not support such name bindings yet, but they are safe according to the spec, so we do not report them.

*/

class CandidateVarAccess extends VarAccess {

CandidateVarAccess() {

isImmediatelyExecutedContainer(this.getContainer()) and

not exists(ExportSpecifier spec | spec.getLocal() = this)

}

}

/**

* Gets the first candidate access to a variable imported by the given import declaration.

*

* We use this to avoid duplicate alerts about the same underlying cyclic import.

*/

VarAccess getFirstCandidateAccess(ImportDeclaration decl) {

result =

min(decl.getASpecifier().getLocal().getVariable().getAnAccess().(CandidateVarAccess) as p

order by

p.getLocation().getStartLine(), p.getLocation().getStartColumn()

)

}

/**

* This is the main alert definition.

*

* The predicate is used to restrict the path construction predicate to just those paths that

* are relevant for the alerts we found.

*/

predicate cycleAlert(Module mod, ImportDeclaration import_, Module importedModule, VarAccess access) {

import_ = mod.getAnImport() and

access = getFirstCandidateAccess(import_) and

importedModule = import_.getImportedModule() and

importedModule != mod and // don't report self-imports

// Suppress warning if this is the unique importer of that module.

// That's a sufficient and somewhat maintainable safety guarantee.

exists(Module otherEntry | isImportedAtRuntime(otherEntry, importedModule) and otherEntry != mod)

}

/** Holds if the length of the shortest sequence of runtime imports from `source` to `destination` is `steps`. */

predicate numberOfStepsToModule(Module source, Module destination, int steps) =

shortestDistances(anyModule/1, isImportedAtRuntime/2)(source, destination, steps)

predicate anyModule(Module m) { any() }

/**

* Gets the name of the module containing the given import.

*/

string repr(Import import_) { result = import_.getEnclosingModule().getName() }

/**

* Builds a string visualizing the shortest import path from `source` to `destination`, excluding

* the destination.

*

* For example, the path from `A` to `D` might be:

* ```

* A => B => C

* ```

* Notice that `D` is not mentioned in the output.

*

* The caller will then complete the cycle by putting `D` at the beginning and end:

* ```

* D => A => B => C => D

* ```

*/

string pathToModule(Module source, Module destination, int steps) {

// Restrict paths to those that are relevant for building a path from the imported module of an alert back to the importer.

exists(Module m | cycleAlert(destination, _, m, _) and numberOfStepsToModule(m, source, _)) and

numberOfStepsToModule(source, destination, steps) and

(

steps = 1 and

result = repr(getARuntimeImport(source, destination))

or

steps > 1 and

exists(Module next |

// Only extend the path to one of the potential successors, as we only need one example.

next =

min(Module mod |

isImportedAtRuntime(source, mod) and

numberOfStepsToModule(mod, destination, steps - 1)

|

mod order by mod.getName()

) and

result =

repr(getARuntimeImport(source, next)) + " => " + pathToModule(next, destination, steps - 1)

)

)

}

from Module mod, ImportDeclaration import_, Module importedModule, VarAccess access

where cycleAlert(mod, import_, importedModule, access)

select access,

access.getName() + " is uninitialized if $@ is loaded first in the cyclic import:" + " " +

repr(import_) + " => " + min(pathToModule(importedModule, mod, _)) + " => " + repr(import_) +

".", import_.getImportedPathExpr(), importedModule.getName()