Module Refinements

INTERNAL: This is an internal library; its interface may change without notice.

Provides classes for working with variable refinements.

Variable refinements are expressions that appear in a guard node (such as an if condition) and can be used to refine the information derived about a variable by the flow analysis. Each refinement only refines a single variable, and only certain simple constructs are considered (primarily typeof expressions and comparisons).

To perform the refinement, the expression is evaluated to a RefinementValue, which is a more fine-grained version of AbstractValue that distinguishes individual constants value. This evaluation takes place in a context that restricts the value of the refined variable to a single candidate value, which is one of the AbstractValues that the flow analysis infers for it.

If the expression evaluates to a refinement value that represents true, then the candidate value passes the refinement. Hence, it can be propagated across a condition guard with outcome true.

Conversely, if it evaluates to false, the candidate value can be propagated across a condition guard with outcome false.

Note that, like all abstract values, refinement values are overapproximations, so the refinement can evaluate to both true and false for the same candidate value.

Import path

semmle.javascript.dataflow.Refinements

Imports

javascript

Provides classes for working with JavaScript programs, as well as JSON, YAML and HTML.

Classes

Refinement

A refinement candidate that references at most one variable, and hence can be used to refine the abstract values inferred for that variable.

RefinementCandidate

An expression that has the right syntactic structure to be used to refine the abstract values inferred for a variable.

RefinementContext

A context in which a refinement expression is analyzed.

RefinementValue

An abstract value of a refinement expression.

SingletonRefinementValue

A refinement value that represents exactly one concrete value.

VarRefinementContext

A refinement context specifying that some variable is assumed to have one particular abstract value.

Datatypes

TRefinementContext

A context in which a refinement expression is analyzed.