hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added support for superagent.agent().

Browse Source
This commit is contained in:
Napalys
2025-03-19 17:51:56 +01:00
parent cdf4f5395f
commit 539e2ef558
3 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll
View File

@@ -527,17 +527,26 @@ module ClientRequest {
DataFlow::Node url;
SuperAgentUrlRequest() {
exists(string moduleName, DataFlow::SourceNode callee | this = callee.getACall() |
exists(string moduleName, DataFlow::SourceNode callee |
moduleName = "superagent" and
(
this = callee.getACall() and
// Handle method calls like superagent.get(url)
callee = DataFlow::moduleMember(moduleName, getSuperagentRequestMethodName()) and
url = this.getArgument(0)
or
this = callee.getACall() and
// Handle direct calls like superagent('GET', url)
callee = DataFlow::moduleImport(moduleName) and
this.getArgument(0).mayHaveStringValue(getSuperagentRequestMethodName()) and
url = this.getArgument(1)
or
// Handle agent calls like superagent.agent().get(url)
exists(DataFlow::SourceNode agent |
agent = DataFlow::moduleMember(moduleName, "agent").getACall() and
this = agent.getAMethodCall(httpMethodName()) and
url = this.getArgument(0)
)
)
)
}

4
javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected
View File

@@ -93,6 +93,7 @@ test_ClientRequest
| tst.js:312:12:312:36 | fetchPo ... o/bar') |
| tst.js:319:5:319:26 | superag ... ', url) |
| tst.js:320:5:320:23 | superagent.del(url) |
| tst.js:321:5:321:32 | superag ... st(url) |
test_getADataNode
| axiosTest.js:12:5:17:6 | axios({ ... \\n }) | axiosTest.js:15:18:15:55 | { 'Cont ... json' } |
| axiosTest.js:12:5:17:6 | axios({ ... \\n }) | axiosTest.js:16:15:16:35 | {x: 'te ... 'test'} |
@@ -134,6 +135,7 @@ test_getADataNode
| tst.js:249:1:251:2 | form.su ... e();\\n}) | tst.js:247:24:247:68 | request ... o.png') |
| tst.js:257:1:262:2 | form.su ... rs()\\n}) | tst.js:255:25:255:35 | 'new_value' |
| tst.js:286:20:286:55 | new Web ... :8080') | tst.js:288:21:288:35 | 'Hello Server!' |
| tst.js:321:5:321:32 | superag ... st(url) | tst.js:321:39:321:42 | data |
test_getHost
| tst.js:87:5:87:39 | http.ge ... host}) | tst.js:87:34:87:37 | host |
| tst.js:89:5:89:23 | axios({host: host}) | tst.js:89:18:89:21 | host |
@@ -244,6 +246,7 @@ test_getUrl
| tst.js:312:12:312:36 | fetchPo ... o/bar') | tst.js:312:26:312:35 | '/foo/bar' |
| tst.js:319:5:319:26 | superag ... ', url) | tst.js:319:23:319:25 | url |
| tst.js:320:5:320:23 | superagent.del(url) | tst.js:320:20:320:22 | url |
| tst.js:321:5:321:32 | superag ... st(url) | tst.js:321:29:321:31 | url |
test_getAResponseDataNode
| axiosTest.js:4:5:7:6 | axios({ ... \\n }) | axiosTest.js:4:5:7:6 | axios({ ... \\n }) | json | true |
| axiosTest.js:12:5:17:6 | axios({ ... \\n }) | axiosTest.js:12:5:17:6 | axios({ ... \\n }) | json | true |
@@ -320,3 +323,4 @@ test_getAResponseDataNode
| tst.js:312:12:312:36 | fetchPo ... o/bar') | tst.js:312:12:312:36 | fetchPo ... o/bar') | fetch.response | true |
| tst.js:319:5:319:26 | superag ... ', url) | tst.js:319:5:319:26 | superag ... ', url) | stream | true |
| tst.js:320:5:320:23 | superagent.del(url) | tst.js:320:5:320:23 | superagent.del(url) | stream | true |
| tst.js:321:5:321:32 | superag ... st(url) | tst.js:321:5:321:32 | superag ... st(url) | stream | true |

2
javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
View File

@@ -318,5 +318,5 @@ function usePolyfill() {
function useSuperagent(url){
superagent('GET', url);
superagent.del(url);
superagent.agent().post(url).send(data); // Not flagged
superagent.agent().post(url).send(data);
}