hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

add remote flow source for busboy

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2021-02-08 21:45:08 +01:00
parent e2fbf8a68c
commit a03f4ed3cd
4 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
javascript/ql/src/javascript.qll
View File

@@ -85,10 +85,11 @@ import semmle.javascript.frameworks.Electron
import semmle.javascript.frameworks.EventEmitter
import semmle.javascript.frameworks.Files
import semmle.javascript.frameworks.Firebase
import semmle.javascript.frameworks.Immutable
import semmle.javascript.frameworks.FormParsers
import semmle.javascript.frameworks.jQuery
import semmle.javascript.frameworks.JWT
import semmle.javascript.frameworks.Handlebars
import semmle.javascript.frameworks.Immutable
import semmle.javascript.frameworks.LazyCache
import semmle.javascript.frameworks.LodashUnderscore
import semmle.javascript.frameworks.Logging

30
javascript/ql/src/semmle/javascript/frameworks/FormParsers.qll Normal file
View File

@@ -0,0 +1,30 @@
/**
* Provides classes for modelling the server-side form/file parsing libraries.
*/
import javascript
/**
* Classes and predicate modelling the `Busboy` library.
*/
module Busboy {
/**
* A `Busboy` instance that has request data flowing into it.
*/
private DataFlow::NewNode busboy() {
result = DataFlow::moduleImport("busboy").getAnInstantiation() and
exists(MethodCallExpr pipe |
pipe.calls(any(HTTP::RequestExpr req), "pipe") and
result.flowsToExpr(pipe.getArgument(0))
)
}
/**
* A source of remote flow from the `Busboy` library.
*/
class BusBoyRemoteFlow extends RemoteFlowSource {
BusBoyRemoteFlow() { this = busboy().getAMemberCall("on").getABoundCallbackParameter(1, _) }
override string getSourceType() { result = "Busbuy parsed user value" }
}
}