hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #602 from esben-semmle/js/additional-route-handlers-from-context

Browse Source 
Approved by xiemaisi
This commit is contained in:
semmle-qlci
2018-12-03 14:31:10 +00:00
committed by GitHub
parent 43d14ce011 104eafec2f
commit b58c263fd0
13 changed files with 99 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/semmle/javascript/frameworks/ConnectExpressShared.qll
View File

@@ -32,9 +32,7 @@ module ConnectExpressShared {
*
* For example, this could be the function `function(req, res, next){...}`.
*/
class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate, DataFlow::FunctionNode {
override Function astNode;
class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate {
RouteHandlerCandidate() {
exists (string request, string response, string next, string error |

77
javascript/ql/src/semmle/javascript/frameworks/Hapi.qll
View File

@@ -194,26 +194,83 @@ module Hapi {
*/
class RouteSetup extends MethodCallExpr, HTTP::Servers::StandardRouteSetup {
ServerDefinition server;
string methodName;
Expr handler;
RouteSetup() {
server.flowsTo(getReceiver()) and
methodName = getMethodName() and
(methodName = "route" or methodName = "ext")
(
// server.route({ handler: fun })
getMethodName() = "route" and
hasOptionArgument(0, "handler", handler)
or
// server.ext('/', fun)
getMethodName() = "ext" and
handler = getArgument(1)
)
}
override DataFlow::SourceNode getARouteHandler() {
// server.route({ handler: fun })
methodName = "route" and
result.flowsToExpr(any(Expr e | hasOptionArgument(0, "handler", e)))
or
// server.ext('/', fun)
methodName = "ext" and
result.flowsToExpr(getArgument(1))
result.(DataFlow::SourceNode).flowsTo(handler.flow()) or
result.(DataFlow::TrackedNode).flowsTo(handler.flow())
}
Expr getRouteHandlerExpr() {
result = handler
}
override Expr getServer() {
result = server
}
}
/**
* A function that looks like a Hapi route handler.
*
* For example, this could be the function `function(request, h){...}`.
*/
class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate {
RouteHandlerCandidate() {
exists (string request, string responseToolkit |
(request = "request" or request = "req") and
responseToolkit = "h" and
// heuristic: parameter names match the Hapi documentation
astNode.getNumParameter() = 2 and
astNode.getParameter(0).getName() = request and
astNode.getParameter(1).getName() = responseToolkit |
not (
// heuristic: is not invoked (Hapi invokes this at a call site we cannot reason precisely about)
exists(DataFlow::InvokeNode cs | cs.getACallee() = astNode)
)
)
}
}
/**
* Tracking for `RouteHandlerCandidate`.
*/
private class TrackedRouteHandlerCandidate extends DataFlow::TrackedNode {
TrackedRouteHandlerCandidate() {
this instanceof RouteHandlerCandidate
}
}
/**
* A function that looks like a Hapi route handler and flows to a route setup.
*/
private class TrackedRouteHandlerCandidateWithSetup extends RouteHandler, HTTP::Servers::StandardRouteHandler, DataFlow::ValueNode {
override Function astNode;
TrackedRouteHandlerCandidateWithSetup() {
exists(TrackedRouteHandlerCandidate tracked |
tracked.flowsTo(any(RouteSetup s).getRouteHandlerExpr().flow()) and
this = tracked
)
}
}
}

4
javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
View File

@@ -597,9 +597,7 @@ module NodeJSLib {
*
* For example, this could be the function `function(req, res){...}`.
*/
class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate, DataFlow::FunctionNode {
override Function astNode;
class RouteHandlerCandidate extends HTTP::RouteHandlerCandidate {
RouteHandlerCandidate() {
exists (string request, string response |

17
javascript/ql/src/semmle/javascript/heuristics/AdditionalRouteHandlers.qll
View File

@@ -8,7 +8,7 @@ import javascript
private import semmle.javascript.frameworks.ConnectExpressShared
/**
* Adds `NodeJSLib::RouteHandlerCandidate` to the extent of `NodeJSLib::RouteHandler`.
* Add `NodeJSLib::RouteHandlerCandidate` to the extent of `NodeJSLib::RouteHandler`.
*/
private class PromotedNodeJSLibCandidate extends NodeJSLib::RouteHandler, HTTP::Servers::StandardRouteHandler {
@@ -19,7 +19,18 @@ private class PromotedNodeJSLibCandidate extends NodeJSLib::RouteHandler, HTTP::
}
/**
* Adds `ConnectExpressShared::RouteHandlerCandidate` to the extent of `Express::RouteHandler`.
* Add `Hapi::RouteHandlerCandidate` to the extent of `Hapi::RouteHandler`.
*/
private class PromotedHapiCandidate extends Hapi::RouteHandler, HTTP::Servers::StandardRouteHandler {
PromotedHapiCandidate() {
this instanceof Hapi::RouteHandlerCandidate
}
}
/**
* Add `ConnectExpressShared::RouteHandlerCandidate` to the extent of `Express::RouteHandler`.
*/
private class PromotedExpressCandidate extends Express::RouteHandler, HTTP::Servers::StandardRouteHandler {
@@ -34,7 +45,7 @@ private class PromotedExpressCandidate extends Express::RouteHandler, HTTP::Serv
}
/**
* Adds `ConnectExpressShared::RouteHandlerCandidate` to the extent of `Connect::RouteHandler`.
* Add `ConnectExpressShared::RouteHandlerCandidate` to the extent of `Connect::RouteHandler`.
*/
private class PromotedConnectCandidate extends Connect::RouteHandler, HTTP::Servers::StandardRouteHandler {

1
javascript/ql/test/library-tests/frameworks/HTTP-heuristics/RouteHandlerCandidate.expected
View File

@@ -15,6 +15,7 @@
| src/exported-middleware-attacher.js:2:13:2:32 | function(req, res){} |
| src/handler-in-property.js:5:14:5:33 | function(req, res){} |
| src/handler-in-property.js:12:18:12:37 | function(req, res){} |
| src/hapi.js:1:1:1:30 | functio ... t, h){} |
| src/iterated-handlers.js:4:2:4:22 | functio ... res){} |
| src/middleware-attacher-getter.js:4:17:4:36 | function(req, res){} |
| src/middleware-attacher-getter.js:19:19:19:38 | function(req, res){} |

1
javascript/ql/test/library-tests/frameworks/HTTP-heuristics/UnpromotedRouteHandlerCandidate.expected
View File

@@ -1,5 +1,6 @@
| src/bound-handler.js:4:1:4:28 | functio ... res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
| src/bound-handler.js:9:12:9:31 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
| src/hapi.js:1:1:1:30 | functio ... t, h){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
| src/iterated-handlers.js:4:2:4:22 | functio ... res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
| src/middleware-attacher-getter.js:29:32:29:51 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
| src/route-objects.js:7:19:7:38 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |

1
javascript/ql/test/library-tests/frameworks/HTTP-heuristics/src/hapi.js Normal file
View File

@@ -0,0 +1 @@
function handler(request, h){}

1
javascript/ql/test/library-tests/frameworks/hapi/RouteHandler.expected
View File

@@ -2,3 +2,4 @@
| src/hapi.js:13:14:15:5 | functio ... n\\n } | src/hapi.js:4:15:4:31 | new Hapi.Server() |
| src/hapi.js:17:30:18:1 | functio ... ndler\\n} | src/hapi.js:4:15:4:31 | new Hapi.Server() |
| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:4:15:4:31 | new Hapi.Server() |
| src/hapi.js:34:12:34:30 | function (req, h){} | src/hapi.js:4:15:4:31 | new Hapi.Server() |

1
javascript/ql/test/library-tests/frameworks/hapi/RouteSetup.expected
View File

@@ -2,3 +2,4 @@
| src/hapi.js:12:1:15:7 | server2 ... }}) |
| src/hapi.js:17:1:18:2 | server2 ... dler\\n}) |
| src/hapi.js:29:1:29:20 | server2.route(route) |
| src/hapi.js:36:1:36:38 | server2 ... ler()}) |

2
javascript/ql/test/library-tests/frameworks/hapi/RouteSetup_getARouteHandler.expected
View File

@@ -2,3 +2,5 @@
| src/hapi.js:12:1:15:7 | server2 ... }}) | src/hapi.js:13:14:15:5 | functio ... n\\n } |
| src/hapi.js:17:1:18:2 | server2 ... dler\\n}) | src/hapi.js:17:30:18:1 | functio ... ndler\\n} |
| src/hapi.js:29:1:29:20 | server2.route(route) | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
| src/hapi.js:36:1:36:38 | server2 ... ler()}) | src/hapi.js:34:12:34:30 | function (req, h){} |
| src/hapi.js:36:1:36:38 | server2 ... ler()}) | src/hapi.js:36:25:36:36 | getHandler() |

1
javascript/ql/test/library-tests/frameworks/hapi/RouteSetup_getServer.expected
View File

@@ -2,3 +2,4 @@
| src/hapi.js:12:1:15:7 | server2 ... }}) | src/hapi.js:4:15:4:31 | new Hapi.Server() |
| src/hapi.js:17:1:18:2 | server2 ... dler\\n}) | src/hapi.js:4:15:4:31 | new Hapi.Server() |
| src/hapi.js:29:1:29:20 | server2.route(route) | src/hapi.js:4:15:4:31 | new Hapi.Server() |
| src/hapi.js:36:1:36:38 | server2 ... ler()}) | src/hapi.js:4:15:4:31 | new Hapi.Server() |

5
javascript/ql/test/library-tests/frameworks/hapi/src/hapi.js
View File

@@ -29,3 +29,8 @@ var route = {handler: handler4};
server2.route(route);
server2.cache({ segment: 'countries', expiresIn: 60*60*1000 });
function getHandler() {
return function (req, h){}
}
server2.route({handler: getHandler()});