Merge pull request #94 from snyk/feat/lazy-class

feat: allow lazy || wrapper classes
snyk · Jul 11, 2019 · b8fde78 · b8fde78
2 parents 626c3b7 + f58306c
commit b8fde78
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/lib/ast.js b/lib/ast.js
@@ -96,6 +96,10 @@ function inspectNode(node, path, cb, expectingAnonymousDeclaration) {
       inspectNode(node.right, path.concat(unpackName(node.left)), cb, true);
       break;
     }
+    case 'LogicalExpression':
+      inspectNode(node.left, path, cb);
+      inspectNode(node.right, path, cb);
+      break;
     case 'UnaryExpression':
       inspectNode(node.argument, path, cb);
       break;

diff --git a/test/method-detection.test.js b/test/method-detection.test.js
@@ -107,6 +107,21 @@ if (console.both) {
   t.end();
 });
 
+test('test lazy class declaration', function (t) {
+  const contents = `
+var Class = Class || (function (Object) {
+  function foo() {}
+});
+`;
+  const methods = ['Class.foo'];
+  const found = ast.findAllVulnerableFunctionsInScript(
+    contents, methods,
+  );
+  t.same(sorted(Object.keys(found)), sorted(methods));
+  t.equal(found[methods[0]].start.line, 3, 'foo');
+  t.end();
+});
+
 test('test st method detection', function (t) {
   const content = fs.readFileSync(__dirname + '/fixtures/st/node_modules/st.js');
   const methods = ['Mount.prototype.getPath'];