CodeQL JavaScript 遍历语法树

ASTNode.getAChild与ASTNode.getChild
#string-manipulations.js

document.write(document.location.href.charCodeAt(0)); // OK
document.write(document.location); // NOT OK
document.write(document.location.href); // NOT OK
document.write(document.location.href.valueOf()); // NOT OK
document.write(document.location.href.sup()); // NOT OK
document.write(document.location.href.toUpperCase()); // NOT OK
document.write(document.location.href.trimLeft()); // NOT OK
document.write(String.fromCharCode(document.location.href)); // NOT OK
document.write(String(document.location.href)); // NOT OK
document.write(escape(document.location.href)); // OK (for now)
document.write(escape(escape(escape(document.location.href)))); // OK (for now)

import javascript
from ASTNode node
where node.getFile().getBaseName() = "string-manipulations.js"
select node, node.getAChild()

getAChild等价于i不受限制的getChild

import javascript
from ASTNode node, int i
where node.getFile().getBaseName() = "string-manipulations.js"
select node, node.getChild(i)