hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed false positives from strapi and rxjs/testing as well as when one passes function as second arg to pipe

Browse Source
This commit is contained in:
Napalys Klicius
2025-05-22 16:41:11 +02:00
parent e6ae8bbde4
commit b10a9481f3
7 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/lib/ext/rxjs.model.yml
View File

@@ -5,3 +5,4 @@ extensions:
data:
- ["NonNodeStream", "rxjs", "Fuzzy"]
- ["NonNodeStream", "rxjs/operators", "Fuzzy"]
- ["NonNodeStream", "rxjs/testing", "Fuzzy"]

6
javascript/ql/lib/ext/strapi.model.yml Normal file
View File

@@ -0,0 +1,6 @@
extensions:
- addsTo:
pack: codeql/javascript-all
extensible: typeModel
data:
- ["NonNodeStream", "@strapi/utils", "Fuzzy"]

2
javascript/ql/src/Quality/UnhandledStreamPipe.ql
View File

@@ -18,7 +18,7 @@ class PipeCall extends DataFlow::MethodCallNode {
PipeCall() {
this.getMethodName() = "pipe" and
this.getNumArgument() = [1, 2] and
not this.getArgument(0).asExpr() instanceof Function and
not this.getArgument([0, 1]).asExpr() instanceof Function and
not this.getArgument(0).asExpr() instanceof ObjectExpr and
not this.getArgument(0).getALocalSource() = getNonNodeJsStreamType()
}

2
javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/rxjsStreams.js
View File

@@ -13,6 +13,6 @@ function f(){
let testScheduler = new TestScheduler();
testScheduler.run(({x, y, z}) => {
const source = x('', {o: [a, b, c]});
z(source.pipe(null)).toBe(expected,y,); // $SPURIOUS:Alert
z(source.pipe(null)).toBe(expected,y,);
});
}

2
javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/strapi.js
View File

@@ -1,5 +1,5 @@
import { async } from '@strapi/utils';
const f = async () => {
const permissionsInDB = await async.pipe(strapi.db.query('x').findMany,map('y'))(); // $SPURIOUS:Alert
const permissionsInDB = await async.pipe(strapi.db.query('x').findMany,map('y'))();
}

3
javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/test.expected
View File

@@ -1,5 +1,3 @@
| rxjsStreams.js:16:7:16:23 | source.pipe(null) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| strapi.js:4:35:4:84 | async.p ... p('y')) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:4:5:4:28 | stream. ... nation) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:19:5:19:17 | s2.pipe(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:45:5:45:30 | stream2 ... ation2) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
@@ -13,4 +11,3 @@
| test.js:143:5:143:62 | stream. ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:175:17:175:40 | notStre ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:185:5:185:32 | copyStr ... nation) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:216:5:216:38 | notStre ... ()=>{}) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |

2
javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/test.js
View File

@@ -213,6 +213,6 @@ function test() {
}
{
const notStream = getNotAStream();
notStream.pipe(getStream(),()=>{}); // $SPURIOUS:Alert
notStream.pipe(getStream(),()=>{});
}
}