diff --git a/javascript/ql/src/LanguageFeatures/InvalidPrototype.ql b/javascript/ql/src/LanguageFeatures/InvalidPrototype.ql index 8770d8dc2713..cc1b5861916a 100644 --- a/javascript/ql/src/LanguageFeatures/InvalidPrototype.ql +++ b/javascript/ql/src/LanguageFeatures/InvalidPrototype.ql @@ -21,7 +21,11 @@ private import semmle.javascript.dataflow.InferredTypes */ predicate isProto(DataFlow::AnalyzedNode e) { // `o.__proto__ = e`, `{ __proto__: e }`, ... - e = any(DataFlow::PropWrite pwn | pwn.getPropertyName() = "__proto__").getRhs() + e = + any(DataFlow::PropWrite pwn | + pwn.getPropertyName() = "__proto__" and + not pwn.getWriteNode().(Property).isComputed() + ).getRhs() or // Object.create(e) e = DataFlow::globalVarRef("Object").getAMemberCall("create").getArgument(0) diff --git a/javascript/ql/src/change-notes/2026-10-15-invalid-prototype-computed-property.md b/javascript/ql/src/change-notes/2026-10-15-invalid-prototype-computed-property.md new file mode 100644 index 000000000000..56c16ede5106 --- /dev/null +++ b/javascript/ql/src/change-notes/2026-10-15-invalid-prototype-computed-property.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The `js/invalid-prototype-value` query no longer reports computed `__proto__` properties in object literals. diff --git a/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/InvalidPrototype.expected b/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/InvalidPrototype.expected index a1c3430e8958..c696da0d083d 100644 --- a/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/InvalidPrototype.expected +++ b/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/InvalidPrototype.expected @@ -2,3 +2,5 @@ | tst.js:8:27:8:28 | 42 | Values of type number cannot be used as prototypes. | | tst.js:9:15:9:18 | true | Values of type boolean cannot be used as prototypes. | | tst.js:10:1:10:10 | "function" | Values of type string cannot be used as prototypes. | +| tst.js:15:25:15:26 | 42 | Values of type number cannot be used as prototypes. | +| tst.js:17:19:17:20 | 42 | Values of type number cannot be used as prototypes. | diff --git a/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/tst.js index 5c12a3b7d853..bae1a60843c1 100644 --- a/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/tst.js +++ b/javascript/ql/test/query-tests/LanguageFeatures/InvalidPrototype/tst.js @@ -9,3 +9,9 @@ Object.setPrototypeOf(o2, 42); // $ Alert Object.create(true); // $ Alert "function".isPrototypeOf(o2); // $ Alert +var o3 = { ["__proto__"]: 42 }; +var o4 = { ["__proto__"]: null }; + +var o5 = { "__proto__": 42 }; // $ Alert +var o6 = {}; +o6["__proto__"] = 42; // $ Alert