Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
condition: node => {
// eval.(ctx, script, ...)
if (node.arguments.length < 2)
return false;
if (node.callee.type === Syntax.MemberExpression && INVOCATION_FUNC_NAME_RE.test(node.callee.property.name)) {
const obj = node.callee.object;
// obj.eval.(), obj[eval].(),
if (obj.type === Syntax.MemberExpression && (obj.property.value || obj.property.name) === 'eval')
return true;
// eval.()
if (obj.name === 'eval')
return true;
}
return false;
},
condition: node => {
if (node.callee.type === Syntax.MemberExpression && INVOCATION_FUNC_NAME_RE.test(node.callee.property.name)) {
// postMessage.(ctx, script, ...)
if (node.arguments.length < 2 && node.callee.property.name !== 'bind')
return false;
const obj = node.callee.object;
// obj.postMessage.(), obj[postMessage].(),
if (obj.type === Syntax.MemberExpression && (obj.property.value || obj.property.name) === 'postMessage')
return true;
// postMessage.()
if (obj.name === 'postMessage')
return true;
}
return false;
},
condition: node => {
// super.prop = value
if (node.left.type === Syntax.MemberExpression && node.left.object.type === Syntax.Super)
return false;
return node.operator === '=' &&
node.left.type === Syntax.MemberExpression && !node.left.computed &&
node.left.property.type === Syntax.Identifier &&
shouldInstrumentProperty(node.left.property.name);
},
condition: (node, parent) => {
if (node.name !== 'postMessage' || !parent)
return false;
// Skip: window.postMessage, postMessage.call
if (parent.type === Syntax.MemberExpression)
return false;
// Skip: class X { postMessage () {} }
if (parent.type === Syntax.MethodDefinition)
return false;
// Skip: class postMessage { x () {} }
if (parent.type === Syntax.ClassDeclaration)
return false;
// Skip: function postMessage () { ... }
if ((parent.type === Syntax.FunctionExpression || parent.type === Syntax.FunctionDeclaration) &&
parent.id === node)
return false;
// Skip: function (postMessage) { ... } || function func(postMessage) { ... } || postMessage => { ... }
// Skip: const location = value;
if (parent.type === Syntax.VariableDeclarator && parent.id === node)
return false;
// Skip: location = value || function x (location = value) { ... }
if ((parent.type === Syntax.AssignmentExpression || parent.type === Syntax.AssignmentPattern) &&
parent.left === node)
return false;
// Skip: function location() {}
if ((parent.type === Syntax.FunctionExpression || parent.type === Syntax.FunctionDeclaration) &&
parent.id === node)
return false;
// Skip: object.location || location.field
if (parent.type === Syntax.MemberExpression)
return false;
// Skip: { location: value }
if (parent.type === Syntax.Property && parent.key === node)
return false;
// Skip: location++ || location-- || ++location || --location
if (parent.type === Syntax.UpdateExpression && (parent.operator === '++' || parent.operator === '--'))
return false;
// Skip: function (location) { ... } || function func(location) { ... } || location => { ... }
if ((parent.type === Syntax.FunctionExpression || parent.type === Syntax.FunctionDeclaration ||
parent.type === Syntax.ArrowFunctionExpression) && parent.params.indexOf(node) !== -1)
return false;
// Skip already transformed: __get$Loc(location)
condition: (node, parent) => {
if (!parent)
return false;
// Skip: window.postMessage.field
if (parent.type === Syntax.MemberExpression && (parent.property === node || parent.object === node))
return false;
// Skip: window.postMessage()
if (parent.type === Syntax.CallExpression && parent.callee === node)
return false;
// Skip: window.postMessage = 1, window["postMessage"] = 1
if (parent.type === Syntax.AssignmentExpression && parent.left === node)
return false;
// Skip already transformed: __get$PostMessage(window.postMessage), __get$PostMessage(window["postMessage"])
if (parent.type === Syntax.CallExpression && parent.callee.type === Syntax.Identifier &&
parent.callee.name === INSTRUCTION.getPostMessage)
return false;
// window.postMessage
condition: node => {
if (!node.arguments.length)
return false;
const callee = node.callee;
// eval()
if (callee.type === Syntax.Identifier && callee.name === 'eval')
return true;
// obj.eval(), obj['eval'](),
return callee.type === Syntax.MemberExpression &&
(callee.property.type === Syntax.Identifier && callee.property.name ||
callee.property.type === Syntax.Literal && callee.property.value) === 'eval';
},
export function createGetPostMessageMethCall (node: Expression): CallExpression {
const parentObject = node.type === Syntax.MemberExpression ? node.object as Expression : null;
return {
type: Syntax.CallExpression,
callee: {
type: Syntax.Identifier,
name: INSTRUCTION.getPostMessage
},
arguments: parentObject ? [parentObject] : [
{
type: Syntax.Literal,
value: null
},
node
]
condition: node => node.left.type === Syntax.MemberExpression,