fix counting safe function call depth

rhysd · Oct 26, 2024 · 9e16139 · 9e16139
1 parent 50e7201
commit 9e16139
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/expr_insecure.go b/expr_insecure.go
@@ -305,6 +305,9 @@ func (u *UntrustedInputChecker) OnVisitNodeEnter(n ExprNode) {
 func (u *UntrustedInputChecker) OnVisitNodeLeave(n ExprNode) {
 	// Skip unsafe checks if we are inside of safe function call expression
 	if u.safeCalls > 0 {
+		if f, ok := n.(*FuncCallNode); ok && isSafeFuncCall(f) {
+			u.safeCalls--
+		}
 		return
 	}
 
@@ -323,11 +326,6 @@ func (u *UntrustedInputChecker) OnVisitNodeLeave(n ExprNode) {
 		u.onIndexAccess()
 	case *ArrayDerefNode:
 		u.onObjectFilter()
-	case *FuncCallNode:
-		if isSafeFuncCall(n) {
-			u.safeCalls--
-		}
-		u.end()
 	default:
 		u.end()
 	}

diff --git a/expr_insecure_test.go b/expr_insecure_test.go
@@ -82,6 +82,9 @@ func testRunTrustedInputsCheckerForNode(t *testing.T, c *UntrustedInputChecker,
 		}
 	})
 	c.OnVisitEnd()
+	if c.safeCalls != 0 {
+		t.Fatalf("%q safe calls counter is not zero: %d", input, c.safeCalls)
+	}
 }
 
 func TestExprInsecureDetectUntrustedValue(t *testing.T) {