hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Recognise references to the process global.

Browse Source
This commit is contained in:
Max Schaefer
2019-06-06 11:48:18 +01:00
parent 58285c08dd
commit 16c33b54b6
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
View File

@@ -8,19 +8,23 @@ import semmle.javascript.security.SensitiveActions
module NodeJSLib {
/**
* Gets a reference to the 'process' object.
* An access to the global `process` variable in a Node.js module, interpreted as
* an import of the `process` module.
*/
DataFlow::SourceNode process() {
result = DataFlow::globalVarRef("process") or
result = DataFlow::moduleImport("process")
private class ImplicitProcessImport extends DataFlow::ModuleImportNode::Range {
ImplicitProcessImport() {
this = DataFlow::globalVarRef("process") and
getTopLevel() instanceof NodeModule
}
override string getPath() { result = "process" }
}
/**
* Gets a reference to a member of the 'process' object.
* Gets a reference to the 'process' object.
*/
private DataFlow::SourceNode processMember(string member) {
result = process().getAPropertyRead(member) or
result = DataFlow::moduleMember("process", member)
DataFlow::SourceNode process() {
result = DataFlow::moduleImport("process")
}
/**
@@ -363,7 +367,7 @@ module NodeJSLib {
ProcessTermination() {
this = DataFlow::moduleImport("exit").getAnInvocation()
or
this = processMember("exit").getACall()
this = DataFlow::moduleMember("process", "exit").getACall()
}
}