hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: simplify sequelize model

Browse Source
This commit is contained in:
Asger Feldthaus
2020-05-18 09:34:17 +01:00
parent f52c827966
commit a18e0b37cf
1 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
javascript/ql/src/semmle/javascript/frameworks/SQL.qll
View File

@@ -315,25 +315,22 @@ private module MsSql {
* Provides classes modelling the `sequelize` package.
*/
private module Sequelize {
/** Gets an import of the `sequelize` module. */
DataFlow::SourceNode sequelize() { result = DataFlow::moduleImport("sequelize") }
/** Gets a node referring to an instance of the `Sequelize` class. */
private DataFlow::SourceNode newSequelize(DataFlow::TypeTracker t) {
private DataFlow::SourceNode sequelize(DataFlow::TypeTracker t) {
t.start() and
result = sequelize().getAnInstantiation()
result = DataFlow::moduleImport("sequelize").getAnInstantiation()
or
exists(DataFlow::TypeTracker t2 | result = newSequelize(t2).track(t2, t))
exists(DataFlow::TypeTracker t2 | result = sequelize(t2).track(t2, t))
}
/** Gets a node referring to an instance of the `Sequelize` class. */
DataFlow::SourceNode newSequelize() { result = newSequelize(DataFlow::TypeTracker::end()) }
DataFlow::SourceNode sequelize() { result = sequelize(DataFlow::TypeTracker::end()) }
/** A call to `Sequelize.query`. */
private class QueryCall extends DatabaseAccess, DataFlow::ValueNode {
override MethodCallExpr astNode;
QueryCall() { this = newSequelize().getAMethodCall("query") }
QueryCall() { this = sequelize().getAMethodCall("query") }
override DataFlow::Node getAQueryArgument() {
result = DataFlow::valueNode(astNode.getArgument(0))
@@ -354,7 +351,7 @@ private module Sequelize {
Credentials() {
exists(NewExpr ne, string prop |
ne = newSequelize().asExpr() and
ne = sequelize().asExpr() and
(
this = ne.getArgument(1) and prop = "username"
or