hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 20:25:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Fix false negative in Mongo model

Browse Source
This commit is contained in:
Asger Feldthaus
2021-10-07 12:18:02 +02:00
parent 3dd5d4d7b4
commit 16fa066636
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll
View File

@@ -29,8 +29,9 @@ private module MongoDB {
private API::Node getAMongoClient() {
result = API::moduleImport("mongodb").getMember("MongoClient")
or
result = getAMongoDbCallback().getParameter(1) and
not result.getAnImmediateUse().(DataFlow::ParameterNode).getName() = "db" // mongodb v2 provides a `Db` here
// The callback parameter is either a MongoClient or Db depending on the mongodb package version,
// but we just model it as both.
result = getAMongoDbCallback().getParameter(1)
}
/** Gets an API-graph node that refers to a `connect` callback. */
@@ -44,8 +45,9 @@ private module MongoDB {
private API::Node getAMongoDb() {
result = getAMongoClient().getMember("db").getReturn()
or
result = getAMongoDbCallback().getParameter(1) and
not result.getAnImmediateUse().(DataFlow::ParameterNode).getName() = "client" // mongodb v3 provides a `Mongoclient` here
// The callback parameter is either a MongoClient or Db depending on the mongodb package version,
// but we just model it as both.
result = getAMongoDbCallback().getParameter(1)
}
/** Gets a data flow node referring to a MongoDB collection. */