hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

change ResponseBody to a DataFlow::Node

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2022-03-30 13:09:54 +02:00
committed by erik-krogh
parent 19e808186d
commit 24b845589d
10 changed files with 16 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/lib/semmle/javascript/frameworks/Express.qll
View File

@@ -766,7 +766,7 @@ module Express {
private class ResponseSendArgument extends HTTP::ResponseSendArgument {
ResponseSource response;
ResponseSendArgument() { this = response.ref().getAMethodCall("send").getArgument(0).asExpr() }
ResponseSendArgument() { this = response.ref().getAMethodCall("send").getArgument(0) }
override RouteHandler getRouteHandler() { result = response.getRouteHandler() }
}
@@ -794,7 +794,7 @@ module Express {
TemplateObjectInput obj;
TemplateInput() {
obj.getALocalSource().(DataFlow::ObjectLiteralNode).hasPropertyWrite(_, this.flow())
obj.getALocalSource().(DataFlow::ObjectLiteralNode).hasPropertyWrite(_, this)
}
override RouteHandler getRouteHandler() { result = obj.getRouteHandler() }

4
javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll
View File

@@ -340,9 +340,9 @@ module Fastify {
RouteHandler rh;
ResponseSendArgument() {
this = rh.getAResponseSource().ref().getAMethodCall("send").getArgument(0).asExpr()
this = rh.getAResponseSource().ref().getAMethodCall("send").getArgument(0)
or
this = rh.(DataFlow::FunctionNode).getAReturn().asExpr()
this = rh.(DataFlow::FunctionNode).getAReturn()
}
override RouteHandler getRouteHandler() { result = rh }

2
javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll
View File

@@ -117,7 +117,7 @@ module HTTP {
/**
* An expression whose value is sent as (part of) the body of an HTTP response.
*/
abstract class ResponseBody extends Expr {
abstract class ResponseBody extends DataFlow::Node {
/**
* Gets the route handler that sends this expression.
*/

2
javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll
View File

@@ -270,7 +270,7 @@ module Hapi {
private class HandlerReturn extends HTTP::ResponseSendArgument {
RouteHandler handler;
HandlerReturn() { this = handler.(DataFlow::FunctionNode).getAReturn().asExpr() }
HandlerReturn() { this = handler.(DataFlow::FunctionNode).getAReturn() }
override RouteHandler getRouteHandler() { result = handler }
}

3
javascript/ql/lib/semmle/javascript/frameworks/Koa.qll
View File

@@ -412,8 +412,7 @@ module Koa {
ResponseSendArgument() {
exists(DataFlow::PropWrite pwn |
pwn.writes(DataFlow::valueNode(rh.getAResponseOrContextExpr()), "body",
DataFlow::valueNode(this))
pwn.writes(DataFlow::valueNode(rh.getAResponseOrContextExpr()), "body", this)
)
}

2
javascript/ql/lib/semmle/javascript/frameworks/Micro.qll
View File

@@ -104,7 +104,7 @@ private module Micro {
MicroSendArgument() {
send = moduleMember("micro", ["send", "sendError"]).getACall() and
this = send.getLastArgument().asExpr()
this = send.getLastArgument()
}
override HTTP::RouteHandler getRouteHandler() {

4
javascript/ql/lib/semmle/javascript/frameworks/Nest.qll
View File

@@ -349,10 +349,10 @@ module NestJS {
ReturnValueAsResponseSend() {
handler.isReturnValueReflected() and
this = handler.getAReturn().asExpr() and
this = handler.getAReturn() and
// Only returned strings are sinks
not exists(Type type |
type = getType() and
type = this.asExpr().getType() and
not isStringType(type.unfold())
)
}

6
javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
View File

@@ -363,9 +363,9 @@ module NodeJSLib {
HTTP::RouteHandler rh;
ResponseSendArgument() {
exists(MethodCallExpr mce, string m | m = "write" or m = "end" |
mce.calls(any(ResponseExpr e | e.getRouteHandler() = rh), m) and
this = mce.getArgument(0) and
exists(DataFlow::MethodCallNode mcn, string m | m = "write" or m = "end" |
mcn.calls(any(ResponseExpr e | e.getRouteHandler() = rh).flow(), m) and
this = mcn.getArgument(0) and
// don't mistake callback functions as data
not this.analyze().getAValue() instanceof AbstractFunction
)

6
javascript/ql/lib/semmle/javascript/security/dataflow/ReflectedXssCustomizations.qll
View File

@@ -24,10 +24,8 @@ module ReflectedXss {
* a content type that does not (case-insensitively) contain the string "html". This
* is to prevent us from flagging plain-text or JSON responses as vulnerable.
*/
class HttpResponseSink extends Sink, DataFlow::ValueNode {
override HTTP::ResponseSendArgument astNode;
HttpResponseSink() { not exists(getANonHtmlHeaderDefinition(astNode)) }
class HttpResponseSink extends Sink instanceof HTTP::ResponseSendArgument {
HttpResponseSink() { not exists(getANonHtmlHeaderDefinition(this)) }
}
/**

4
javascript/ql/lib/semmle/javascript/security/dataflow/StackTraceExposureCustomizations.qll
View File

@@ -32,7 +32,5 @@ module StackTraceExposure {
* An expression that can become part of an HTTP response body, viewed
* as a data flow sink for stack trace exposure vulnerabilities.
*/
class DefaultSink extends Sink, DataFlow::ValueNode {
override HTTP::ResponseBody astNode;
}
class DefaultSink extends Sink instanceof HTTP::ResponseBody { }
}