hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #444 from esben-semmle/js/browser-based-client-requests

Browse Source 
JS: add models of $.ajax, $.getJSON and XMLHttpRequst
This commit is contained in:
Max Schaefer
2018-11-13 16:53:52 +00:00
committed by GitHub
parent cd874f7982 37b7b39ec6
commit 4fdfbb77cc
7 changed files with 71 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
View File

@@ -246,3 +246,14 @@ private class SuperAgentUrlRequest extends CustomClientRequest {
}
}
/**
* A model of a URL request made using the `XMLHttpRequest` browser class.
*/
private class XMLHttpRequest extends CustomClientRequest {
XMLHttpRequest() { this = DataFlow::globalVarRef("XMLHttpRequest").getAnInstantiation() }
override DataFlow::Node getUrl() { result = getAMethodCall("open").getArgument(1) }
override DataFlow::Node getADataNode() { result = getAMethodCall("send").getArgument(0) }
}

21
javascript/ql/src/semmle/javascript/frameworks/jQuery.qll
View File

@@ -340,3 +340,24 @@ private class JQueryChainedElement extends DOM::Element {
)
}
}
/**
* A model of a URL request made using the `jQuery.ajax` or `jQuery.getJSON`.
*/
private class JQueryClientRequest extends CustomClientRequest {
JQueryClientRequest() {
exists(string name |
name = "ajax" or
name = "getJSON"
|
this = jquery().getAMemberCall(name)
)
}
override DataFlow::Node getUrl() {
result = getArgument(0) or
result = getOptionArgument([0 .. 1], "url")
}
override DataFlow::Node getADataNode() { result = getOptionArgument([0 .. 1], "data") }
}