Extract Semgrep JS/TS positive dispatch
ober
67631de3c3655a0ea29c01a202d17d1a4046b5f0
--- a/SEMGREP_JERBOA_IMPLEMENTATION.md +++ b/SEMGREP_JERBOA_IMPLEMENTATION.md @@ -519,6 +519,10 @@ Completed in the repo: - moved positive-pattern seed selection helpers into `src/semgrep/engine/positive-dispatch.ss` so the entry-shape and entry-selection logic now live together + - extracted the JavaScript/TypeScript/JSON positive-pattern callback + ordering used by both plain and with-bindings scans into + `src/semgrep/engine/jsts-positive-dispatch.ss`, reducing another large + duplicated dispatch block in `scan.ss` - exported shared Python line-assignment analysis from `src/semgrep/engine/py-constant-prop.ss` so remaining Python fallbacks in `scan.ss` can reuse one assignment-info implementation @@ -541,8 +545,8 @@ Remaining Phase 0 work: constant-propagation, f-string/interpolated, return/list, and import special-case fallback surfaces are now out, and the duplicated positive-entry dispatch core is out too; the next meaningful cuts are the remaining larger - language-specific callback ownership in `scan.ss`, shared textual helper - ownership, and taint sections. + language-specific callback ownership in `scan.ss` outside the JS/TS block, + shared textual helper ownership, and taint sections. - Run broader upstream sweeps and grow the expected-fail baselines from real sampled data instead of one narrow seed run. new file mode 100644 --- /dev/null +++ b/lib/semgrep/engine/jsts-positive-dispatch.sls @@ -0,0 +1,88 @@ +#!chezscheme +;;; Generated by jerbuild — DO NOT EDIT +;;; Source: src/semgrep/engine/jsts-positive-dispatch.ss + +(library (semgrep engine jsts-positive-dispatch) + (export scan-jsts-positive-dispatch) + (import + (except (chezscheme) make-hash-table hash-table? sort sort! + printf fprintf format path-extension path-absolute? + with-input-from-string with-output-to-string iota \x31;+ + \x31;- partition make-date make-time meta atom?) + (except (jerboa prelude) meta atom?) + (semgrep lang)) + (def (javascript-like-language? language) + (or (string=? language "javascript") + (string=? language "js") + (string=? language "jsx") + (string=? language "typescript") + (string=? language "ts") + (string=? language "tsx"))) + (def (typescript-like-language? language) + (or (string=? language "typescript") + (string=? language "ts") + (string=? language "tsx"))) + (def (scan-jsts-positive-dispatch language ts-decorated-field + ts-decorated-async js-vardef-assign json-key-value + ts-object-type ts-req-param-assignment ts-mongo-where + ts-import-equals js-dependencies-field + js-constructor-typed-param js-arrow-assignment + js-arrow-object-param js-member-ellipsis-plus + js-string-concat js-template-sql-expression + js-new-function-sequence js-imported-bar-call + js-import-equivalence js-small-pattern-fallbacks + js-imported-member-call js-resolved-call + js-jsx-simple-element js-jsx-style js-jsx-attribute + js-this-props-destructure js-function-props-source + js-react-create-element-spread js-record) + (or (and (typescript-like-language? language) + (ts-decorated-field)) + (and (typescript-like-language? language) + (ts-decorated-async)) + (and (javascript-like-language? language) + (js-vardef-assign)) + (and (string=? language "json") (json-key-value)) + (and (typescript-like-language? language) (ts-object-type)) + (and (typescript-like-language? language) + (ts-req-param-assignment)) + (and (typescript-like-language? language) (ts-mongo-where)) + (and (typescript-like-language? language) + (ts-import-equals)) + (and (javascript-like-language? language) + (js-dependencies-field)) + (and (javascript-like-language? language) + (js-constructor-typed-param)) + (and (javascript-like-language? language) + (js-arrow-assignment)) + (and (javascript-like-language? language) + (js-arrow-object-param)) + (and (javascript-like-language? language) + (js-member-ellipsis-plus)) + (and (javascript-like-language? language) + (js-string-concat)) + (and (javascript-like-language? language) + (js-template-sql-expression)) + (and (javascript-like-language? language) + (js-new-function-sequence)) + (and (javascript-like-language? language) + (js-imported-bar-call)) + (and (javascript-like-language? language) + (js-import-equivalence)) + (and (javascript-like-language? language) + (js-small-pattern-fallbacks)) + (and (javascript-like-language? language) + (js-imported-member-call)) + (and (javascript-like-language? language) + (js-resolved-call)) + (and (javascript-like-language? language) + (js-jsx-simple-element)) + (and (javascript-like-language? language) (js-jsx-style)) + (and (javascript-like-language? language) + (js-jsx-attribute)) + (and (javascript-like-language? language) + (js-this-props-destructure)) + (and (javascript-like-language? language) + (js-function-props-source)) + (and (javascript-like-language? language) + (js-react-create-element-spread)) + (and (javascript-like-language? language) (js-record))))) --- a/lib/semgrep/scan.sls +++ b/lib/semgrep/scan.sls @@ -25,6 +25,7 @@ (semgrep engine js-eval-scan) (semgrep engine js-vardef-scan) (semgrep engine js-decorator-scan) + (semgrep engine jsts-positive-dispatch) (semgrep engine markup-scan) (semgrep engine positive-dispatch) (semgrep engine py-constant-scan) @@ -14730,175 +14731,172 @@ source pattern)) (def (scan-pattern pattern) - (or (and (typescript-like-language? language) - (scan-typescript-decorated-field-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-decorated-async-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-vardef-assign-pattern - rule - path - source - pattern)) + (or (scan-jsts-positive-dispatch language + (lambda () + (scan-typescript-decorated-field-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-decorated-async-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-vardef-assign-pattern + rule + path + source + pattern)) + (lambda () + (scan-json-key-value-pattern rule path source pattern)) + (lambda () + (scan-typescript-object-type-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-req-param-assignment-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-mongo-where-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-import-equals-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-dependencies-field-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-constructor-typed-param-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-arrow-assignment-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-arrow-object-param-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-member-ellipsis-plus-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-string-concat-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-template-sql-expression-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-new-function-sequence-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-imported-bar-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-import-equivalence-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-small-pattern-fallbacks + rule + path + source + pattern)) + (lambda () + (scan-javascript-imported-member-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-resolved-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-jsx-simple-element-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-jsx-style-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-jsx-attribute-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-this-props-destructure-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-function-props-source-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-react-create-element-spread-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-record-pattern + rule + path + source + pattern))) (scan-string-key-object-pattern rule path source pattern) - (and (string=? language "json") - (scan-json-key-value-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-object-type-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-req-param-assignment-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-mongo-where-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-import-equals-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-dependencies-field-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-constructor-typed-param-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-arrow-assignment-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-arrow-object-param-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-member-ellipsis-plus-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-string-concat-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-template-sql-expression-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-new-function-sequence-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-imported-bar-call-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-import-equivalence-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-small-pattern-fallbacks - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-imported-member-call-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-resolved-call-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-jsx-simple-element-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-jsx-style-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-jsx-attribute-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-this-props-destructure-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-function-props-source-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-react-create-element-spread-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-record-pattern - rule - path - source - pattern)) (and (symbolic-python-like-language? language) (scan-python-pattern-fallbacks rule path source pattern '())) @@ -14972,130 +14970,127 @@ source pattern)) (def (scan-pattern pattern) - (or (and (typescript-like-language? language) - (scan-typescript-decorated-field-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-decorated-async-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-vardef-assign-pattern - rule - path - source - pattern)) - (and (string=? language "json") - (scan-json-key-value-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-object-type-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-req-param-assignment-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-mongo-where-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-import-equals-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-dependencies-field-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-constructor-typed-param-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-arrow-assignment-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-arrow-object-param-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-member-ellipsis-plus-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-string-concat-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-template-sql-expression-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-new-function-sequence-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-imported-bar-call-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-import-equivalence-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-small-pattern-fallbacks - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-imported-member-call-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-resolved-call-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-jsx-simple-element-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-jsx-style-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-jsx-attribute-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-this-props-destructure-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-function-props-source-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-react-create-element-spread-pattern-with-bindings rule path source pattern initial-bindings)) - (and (javascript-like-language? language) - (scan-javascript-record-pattern - rule - path - source - pattern)) + (or (scan-jsts-positive-dispatch language + (lambda () + (scan-typescript-decorated-field-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-decorated-async-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-vardef-assign-pattern + rule + path + source + pattern)) + (lambda () + (scan-json-key-value-pattern rule path source pattern)) + (lambda () + (scan-typescript-object-type-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-req-param-assignment-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-mongo-where-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-import-equals-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-dependencies-field-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-constructor-typed-param-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-arrow-assignment-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-arrow-object-param-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-member-ellipsis-plus-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-string-concat-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-template-sql-expression-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-new-function-sequence-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-imported-bar-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-import-equivalence-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-small-pattern-fallbacks + rule + path + source + pattern)) + (lambda () + (scan-javascript-imported-member-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-resolved-call-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-jsx-simple-element-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-jsx-style-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-jsx-attribute-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-this-props-destructure-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-function-props-source-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-react-create-element-spread-pattern-with-bindings rule path source pattern initial-bindings)) + (lambda () + (scan-javascript-record-pattern + rule + path + source + pattern))) (and (symbolic-python-like-language? language) (scan-python-pattern-fallbacks rule path source pattern initial-bindings)) --- a/src/.jerbuild-hashes +++ b/src/.jerbuild-hashes @@ -18,6 +18,9 @@ ("src/semgrep/engine/js-decorator-scan.ss" . "193758AD2E444FD6") + ("src/semgrep/engine/jsts-positive-dispatch.ss" + . + "DABB3C66BB249070") ("src/semgrep/engine/ts-type-scan.ss" . "B36BAF07D19F4419") ("src/semgrep/output/text.ss" . "BE476CB84B807FBA") ("src/semgrep/rule.ss" . "E12C108153C181FA") @@ -48,7 +51,7 @@ ("src/semgrep/output/json.ss" . "293881CFA2ADB7BC") ("src/semgrep/lang.ss" . "6982E07679D20836") ("src/semgrep/parse/parse-target.ss" . "97AA8FFEB12736DA") - ("src/semgrep/scan.ss" . "A0AD8A558C4FAF6") + ("src/semgrep/scan.ss" . "2944369B60608DF1") ("src/semgrep/engine/generic-scan.ss" . "F69D0ACD0DD62610") ("src/semgrep/engine/js-constructor-scan.ss" . new file mode 100644 --- /dev/null +++ b/src/semgrep/engine/jsts-positive-dispatch.ss @@ -0,0 +1,104 @@ +(export scan-jsts-positive-dispatch) + +(import (except (jerboa prelude) meta atom?) + (semgrep lang)) + +(def (javascript-like-language? language) + (or (string=? language "javascript") + (string=? language "js") + (string=? language "jsx") + (string=? language "typescript") + (string=? language "ts") + (string=? language "tsx"))) + +(def (typescript-like-language? language) + (or (string=? language "typescript") + (string=? language "ts") + (string=? language "tsx"))) + +(def (scan-jsts-positive-dispatch + language + ts-decorated-field + ts-decorated-async + js-vardef-assign + json-key-value + ts-object-type + ts-req-param-assignment + ts-mongo-where + ts-import-equals + js-dependencies-field + js-constructor-typed-param + js-arrow-assignment + js-arrow-object-param + js-member-ellipsis-plus + js-string-concat + js-template-sql-expression + js-new-function-sequence + js-imported-bar-call + js-import-equivalence + js-small-pattern-fallbacks + js-imported-member-call + js-resolved-call + js-jsx-simple-element + js-jsx-style + js-jsx-attribute + js-this-props-destructure + js-function-props-source + js-react-create-element-spread + js-record) + (or (and (typescript-like-language? language) + (ts-decorated-field)) + (and (typescript-like-language? language) + (ts-decorated-async)) + (and (javascript-like-language? language) + (js-vardef-assign)) + (and (string=? language "json") + (json-key-value)) + (and (typescript-like-language? language) + (ts-object-type)) + (and (typescript-like-language? language) + (ts-req-param-assignment)) + (and (typescript-like-language? language) + (ts-mongo-where)) + (and (typescript-like-language? language) + (ts-import-equals)) + (and (javascript-like-language? language) + (js-dependencies-field)) + (and (javascript-like-language? language) + (js-constructor-typed-param)) + (and (javascript-like-language? language) + (js-arrow-assignment)) + (and (javascript-like-language? language) + (js-arrow-object-param)) + (and (javascript-like-language? language) + (js-member-ellipsis-plus)) + (and (javascript-like-language? language) + (js-string-concat)) + (and (javascript-like-language? language) + (js-template-sql-expression)) + (and (javascript-like-language? language) + (js-new-function-sequence)) + (and (javascript-like-language? language) + (js-imported-bar-call)) + (and (javascript-like-language? language) + (js-import-equivalence)) + (and (javascript-like-language? language) + (js-small-pattern-fallbacks)) + (and (javascript-like-language? language) + (js-imported-member-call)) + (and (javascript-like-language? language) + (js-resolved-call)) + (and (javascript-like-language? language) + (js-jsx-simple-element)) + (and (javascript-like-language? language) + (js-jsx-style)) + (and (javascript-like-language? language) + (js-jsx-attribute)) + (and (javascript-like-language? language) + (js-this-props-destructure)) + (and (javascript-like-language? language) + (js-function-props-source)) + (and (javascript-like-language? language) + (js-react-create-element-spread)) + (and (javascript-like-language? language) + (js-record)))) --- a/src/semgrep/scan.ss +++ b/src/semgrep/scan.ss @@ -24,6 +24,7 @@ (semgrep engine js-eval-scan) (semgrep engine js-vardef-scan) (semgrep engine js-decorator-scan) + (semgrep engine jsts-positive-dispatch) (semgrep engine markup-scan) (semgrep engine positive-dispatch) (semgrep engine py-constant-scan) @@ -14631,179 +14632,181 @@ source pattern)) (def (scan-pattern pattern) - (or (and (typescript-like-language? language) - (scan-typescript-decorated-field-pattern - rule - path - source - pattern)) - (and (typescript-like-language? language) - (scan-typescript-decorated-async-pattern - rule - path - source - pattern)) - (and (javascript-like-language? language) - (scan-javascript-vardef-assign-pattern - rule - path - source - pattern)) + (or (scan-jsts-positive-dispatch + language + (lambda () + (scan-typescript-decorated-field-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-decorated-async-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-vardef-assign-pattern + rule + path + source + pattern)) + (lambda () + (scan-json-key-value-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-object-type-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-req-param-assignment-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-mongo-where-pattern + rule + path + source + pattern)) + (lambda () + (scan-typescript-import-equals-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-dependencies-field-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-constructor-typed-param-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-arrow-assignment-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-arrow-object-param-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-member-ellipsis-plus-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-string-concat-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-template-sql-expression-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-new-function-sequence-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-imported-bar-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-import-equivalence-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-small-pattern-fallbacks + rule + path + source + pattern)) + (lambda () + (scan-javascript-imported-member-call-pattern + rule + path + source + pattern)) + (lambda () + (scan-javascript-resolved-call-pattern + rule + path + source