hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: improve Koa model to account for aliases on the context object

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2019-03-21 15:03:09 +01:00
parent 0e01988622
commit 298dbe13c4
2 changed files with 64 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
javascript/ql/src/semmle/javascript/frameworks/Koa.qll
View File

@@ -24,7 +24,7 @@ module Koa {
HeaderDefinition() {
// ctx.set('Cache-Control', 'no-cache');
astNode.calls(rh.getAContextExpr(), "set")
astNode.calls(rh.getAResponseOrContextExpr(), "set")
or
// ctx.response.header('Cache-Control', 'no-cache')
astNode.calls(rh.getAResponseExpr(), "header")
@@ -58,6 +58,23 @@ module Koa {
* route handler.
*/
Expr getAContextExpr() { result.(ContextExpr).getRouteHandler() = this }
/**
* Gets an expression that contains the context or response
* object of a route handler invocation.
*/
Expr getAResponseOrContextExpr() {
result = getAResponseExpr() or result = getAContextExpr()
}
/**
* Gets an expression that contains the context or request
* object of a route handler invocation.
*/
Expr getARequestOrContextExpr() {
result = getARequestExpr() or result = getAContextExpr()
}
}
/**
@@ -159,35 +176,39 @@ module Koa {
string kind;
RequestInputAccess() {
exists(Expr request | request = rh.getARequestExpr() |
// `ctx.request.body`
kind = "body" and
this.asExpr().(PropAccess).accesses(request, "body")
or
kind = "parameter" and
this = getAQueryParameterAccess(rh)
or
kind = "parameter" and
this = getAQueryParameterAccess(rh)
or
exists(Expr e | rh.getARequestOrContextExpr() = e |
// `ctx.request.url`, `ctx.request.originalUrl`, or `ctx.request.href`
exists(string propName |
// `ctx.request.url`, `ctx.request.originalUrl`, or `ctx.request.href`
kind = "url" and
this.asExpr().(PropAccess).accesses(request, propName)
|
propName = "url" or
propName = "originalUrl" or
this.asExpr().(PropAccess).accesses(e, propName)
|
propName = "url"
or
propName = "originalUrl"
or
propName = "href"
)
)
or
exists(PropAccess cookies |
or
// `ctx.request.body`
e instanceof RequestExpr and
kind = "body" and
this.asExpr().(PropAccess).accesses(e, "body")
or
// `ctx.cookies.get(<name>)`
kind = "cookie" and
cookies.accesses(rh.getAContextExpr(), "cookies") and
this.asExpr().(MethodCallExpr).calls(cookies, "get")
)
or
exists(RequestHeaderAccess access | access = this |
rh = access.getRouteHandler() and
kind = "header"
exists(PropAccess cookies |
e instanceof ContextExpr and
kind = "cookie" and
cookies.accesses(e, "cookies") and
this.asExpr().(MethodCallExpr).calls(cookies, "get")
)
or
exists(RequestHeaderAccess access | access = this |
rh = access.getRouteHandler() and
kind = "header"
)
)
}
@@ -199,8 +220,8 @@ module Koa {
}
private DataFlow::Node getAQueryParameterAccess(RouteHandler rh) {
// `ctx.request.query.name`
result.asExpr().(PropAccess).getBase().(PropAccess).accesses(rh.getARequestExpr(), "query")
// `ctx.query.name` or `ctx.request.query.name`
result.asExpr().(PropAccess).getBase().(PropAccess).accesses(rh.getARequestOrContextExpr(), "query")
}
/**
@@ -210,10 +231,10 @@ module Koa {
RouteHandler rh;
RequestHeaderAccess() {
exists(Expr request | request = rh.getARequestExpr() |
exists(Expr e | e = rh.getARequestOrContextExpr() |
exists(string propName, PropAccess headers |
// `ctx.request.header.<name>`, `ctx.request.headers.<name>`
headers.accesses(request, propName) and
headers.accesses(e, propName) and
this.asExpr().(PropAccess).accesses(headers, _)
|
propName = "header" or
@@ -221,7 +242,7 @@ module Koa {
)
or
// `ctx.request.get(<name>)`
this.asExpr().(MethodCallExpr).calls(request, "get")
this.asExpr().(MethodCallExpr).calls(e, "get")
)
}
@@ -264,7 +285,7 @@ module Koa {
ResponseSendArgument() {
exists(DataFlow::PropWrite pwn |
pwn.writes(DataFlow::valueNode(rh.getAResponseExpr()), "body", DataFlow::valueNode(this))
pwn.writes(DataFlow::valueNode(rh.getAResponseOrContextExpr()), "body", DataFlow::valueNode(this))
)
}