hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

also use new type-tracking in isUserControlledObject

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-07-01 11:32:51 +02:00
parent ed48efe5b4
commit 8227010463
1 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
javascript/ql/src/semmle/javascript/frameworks/Express.qll
View File

@@ -466,11 +466,14 @@ module Express {
/**
* Gets a reference to the "query" or "params" object from a request-object originating from route-handler `rh`.
*/
DataFlow::SourceNode getAQueryObjectReference(DataFlow::TypeTracker t, RouteHandler rh) {
t.startInProp(["params", "query"]) and
DataFlow::SourceNode getAQueryObjectReference(
DataFlow::TypeTracker t, RouteHandler rh, string prop
) {
prop = ["params", "query"] and
t.startInProp(prop) and
result = rh.getARequestSource()
or
exists(DataFlow::TypeTracker t2 | result = getAQueryObjectReference(t2, rh).track(t2, t))
exists(DataFlow::TypeTracker t2 | result = getAQueryObjectReference(t2, rh, prop).track(t2, t))
}
/**
@@ -482,7 +485,7 @@ module Express {
RequestInputAccess() {
kind = "parameter" and
this = getAQueryObjectReference(DataFlow::TypeTracker::end(), rh).getAPropertyRead()
this = getAQueryObjectReference(DataFlow::TypeTracker::end(), rh, _).getAPropertyRead()
or
exists(DataFlow::SourceNode request | request = rh.getARequestSource().ref() |
kind = "parameter" and
@@ -527,13 +530,11 @@ module Express {
kind = "parameter" and
exists(DataFlow::Node request | request = DataFlow::valueNode(rh.getARequestExpr()) |
this.(DataFlow::MethodCallNode).calls(request, "param")
or
exists(DataFlow::PropRead base |
// `req.query.name`
base.accesses(request, "query") and
this = base.getAPropertyReference(_)
)
)
or
// `req.query.name`
kind = "parameter" and
this = getAQueryObjectReference(DataFlow::TypeTracker::end(), rh, "query").getAPropertyRead()
}
}