mirror of
https://github.com/github/codeql.git
synced 2026-04-26 09:15:12 +02:00
JS: Model fs.promises.readFile as file source
You could argue that proper modeling be done in the same way as `NodeJSFileSystemAccessRead` is done for the callback based `fs` API (in NodeJSLib.qll). However, that work is straying from the core goals I'm working towards right now, so I'll argue that "perfect is the enemy of good", and leave this as is for now.
This commit is contained in:
@@ -0,0 +1,8 @@
|
||||
extensions:
|
||||
# Make sure that the extensible model predicates have at least one definition
|
||||
# to avoid errors about undefined extensionals.
|
||||
- addsTo:
|
||||
pack: codeql/javascript-all
|
||||
extensible: sourceModel
|
||||
data:
|
||||
- ['fs', 'Member[promises].Member[readFile].ReturnValue.Member[then].Argument[0].Parameter[0]', 'file']
|
||||
@@ -69,8 +69,8 @@ const fileContent = fs.readFileSync('file.txt', 'utf8'); // $ threat-source=file
|
||||
SINK(fileContent); // $ hasFlow
|
||||
|
||||
// Accessing file contents using fs.promises
|
||||
fs.promises.readFile('file.txt', 'utf8').then((data) => { // $ MISSING: threat-source=file
|
||||
SINK(data); // $ MISSING: hasFlow
|
||||
fs.promises.readFile('file.txt', 'utf8').then((data) => { // $ threat-source=file
|
||||
SINK(data); // $ hasFlow
|
||||
});
|
||||
|
||||
// Accessing file contents using fs.createReadStream
|
||||
|
||||
Reference in New Issue
Block a user