Merge pull request #22401 from MathiasVP/javascript-another-shallow-copy-library

JS: Model the `merge-descriptors` library as a shallow extender

Author: asgerf

javascript/ql/lib/semmle/javascript/Extend.qll

@@ -146,6 +146,17 @@ private class ExtendCallShallow extends ExtendCall {
   override predicate isDeep() { none() }
 }
 
+/** A shallow extend call of form `mergeDescriptors(dst, src)`. */
+private class MergeDescriptorsCall extends ExtendCall {
+  MergeDescriptorsCall() { this = DataFlow::moduleImport("merge-descriptors").getACall() }
+
+  override DataFlow::Node getASourceOperand() { result = this.getArgument(1) }
+
+  override DataFlow::Node getDestinationOperand() { result = this.getArgument(0) }
+
+  override predicate isDeep() { none() }
+}
+
 /**
  * A shallow extend call of form `extend(src1, src2, ...)`.
  */

javascript/ql/test/library-tests/Extend/ExtendCalls.expected

@@ -29,17 +29,18 @@
 | tst.js:64:1:64:48 | checkSh ... arg())) | OK |
 | tst.js:65:1:65:54 | checkSh ... arg())) | OK |
 | tst.js:66:1:66:45 | checkSh ... arg())) | OK |
-| tst.js:67:1:67:52 | checkSh ... arg())) | OK |
-| tst.js:68:1:68:53 | checkSh ... arg())) | OK |
+| tst.js:67:1:67:57 | checkSh ... arg())) | OK |
+| tst.js:68:1:68:52 | checkSh ... arg())) | OK |
 | tst.js:69:1:69:53 | checkSh ... arg())) | OK |
-| tst.js:70:1:70:55 | checkSh ... arg())) | OK |
-| tst.js:71:1:71:52 | checkSh ... arg())) | OK |
-| tst.js:72:1:72:51 | checkSh ... arg())) | OK |
+| tst.js:70:1:70:53 | checkSh ... arg())) | OK |
+| tst.js:71:1:71:55 | checkSh ... arg())) | OK |
+| tst.js:72:1:72:52 | checkSh ... arg())) | OK |
 | tst.js:73:1:73:51 | checkSh ... arg())) | OK |
-| tst.js:74:1:74:53 | checkSh ... arg())) | OK |
+| tst.js:74:1:74:51 | checkSh ... arg())) | OK |
 | tst.js:75:1:75:53 | checkSh ... arg())) | OK |
-| tst.js:79:1:79:45 | checkSh ... arg())) | OK |
-| tst.js:80:1:80:55 | checkSh ... arg())) | OK |
-| tst.js:81:1:81:51 | checkSh ... arg())) | OK |
-| tst.js:85:1:85:44 | checkDe ... arg())) | OK |
-| tst.js:86:1:86:61 | checkDe ... arg())) | OK |
+| tst.js:76:1:76:53 | checkSh ... arg())) | OK |
+| tst.js:80:1:80:45 | checkSh ... arg())) | OK |
+| tst.js:81:1:81:55 | checkSh ... arg())) | OK |
+| tst.js:82:1:82:51 | checkSh ... arg())) | OK |
+| tst.js:86:1:86:44 | checkDe ... arg())) | OK |
+| tst.js:87:1:87:61 | checkDe ... arg())) | OK |

javascript/ql/test/library-tests/Extend/package.json

@@ -17,6 +17,7 @@
 		"lodash.mergewith": "^4.6.1",
 		"merge": "^1.2.0",
 		"merge-deep": "^3.0.2",
+		"merge-descriptors": "^1.0.3",
 		"merge-options": "^1.0.1",
 		"mixin-deep": "^2.0.0",
 		"mixin-object": "^3.0.0",

javascript/ql/test/library-tests/Extend/tst.js

@@ -64,6 +64,7 @@ checkShallow(Object.assign(base(), arg()));
 checkShallow(require("defaults")(base(), arg()));
 checkShallow(require("extend-shallow")(base(), arg()));
 checkShallow(require("merge")(base(), arg()));
+checkShallow(require("merge-descriptors")(base(), arg()));
 checkShallow(require("mixin-object")(base(), arg()));
 checkShallow(require("object-assign")(base(), arg()));
 checkShallow(require("object.assign")(base(), arg()));