hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4311 from erik-krogh/indirect-fix

Browse Source 
JS: improve join-order for HTTP::isDecoratedCall
This commit is contained in:
Erik Krogh Kristensen
2020-09-22 14:35:50 +02:00
committed by GitHub
parent 9a306866c5 32b0f1b480
commit 717ea2369c
1 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
View File

@@ -237,17 +237,39 @@ module HTTP {
* Holds if `call` decorates the function `pred`.
* This means that `call` returns a function that forwards its arguments to `pred`.
* Only holds when the decorator looks like it is decorating a route-handler.
*
* Below is a code example relating `call`, `decoratee`, `outer`, `inner`.
* ```
* function outer(method) {
* return function inner(req, res) {
* return method.call(this, req, res);
* };
* }
* var route = outer(function decoratee(req, res) { // <- call
* res.end("foo");
* });
* ```
*/
private predicate isDecoratedCall(DataFlow::CallNode call, DataFlow::FunctionNode decoratee) {
// indirect route-handler `result` is given to function `outer`, which returns function `inner` which calls the function `pred`.
exists(int i, Function outer, Function inner |
exists(int i, DataFlow::FunctionNode outer, HTTP::RouteHandlerCandidate inner |
decoratee = call.getArgument(i).getALocalSource() and
outer = call.getACallee() and
inner = outer.getAReturnedExpr() and
isAForwardingRouteHandlerCall(DataFlow::parameterNode(outer.getParameter(i)), inner.flow())
outer.getFunction() = call.getACallee() and
returnsRouteHandler(outer, inner) and
isAForwardingRouteHandlerCall(outer.getParameter(i), inner)
)
}
/**
* Holds if `fun` returns the route-handler-candidate `routeHandler`.
*/
pragma[noinline]
private predicate returnsRouteHandler(
DataFlow::FunctionNode fun, HTTP::RouteHandlerCandidate routeHandler
) {
routeHandler = fun.getAReturn().getALocalSource()
}
/**
* Holds if `f` looks like a route-handler and a call to `callee` inside `f` forwards all of the parameters from `f` to that call.
*/