hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Recognize legacy @now/node type aliases

Browse Source 
Extends the Vercel serverless handler detection to also match the
deprecated Zeit-era @now/node package with NowRequest/NowResponse
types. Per-review feedback from asgerf, these aliases still appear
in real-world code.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
murderteeth
2026-04-13 17:31:29 +00:00
parent dfe05599d3
commit cff07342f5
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/lib/semmle/javascript/frameworks/VercelNode.qll
View File

@@ -32,8 +32,8 @@ module VercelNode {
this = any(Module m).getAnExportedValue("default").getAFunctionValue() and
req = this.getParameter(0) and
res = this.getParameter(1) and
req.hasUnderlyingType("@vercel/node", "VercelRequest") and
res.hasUnderlyingType("@vercel/node", "VercelResponse")
req.hasUnderlyingType(["@vercel/node", "@now/node"], ["NowRequest", "VercelRequest"]) and
res.hasUnderlyingType(["@vercel/node", "@now/node"], ["NowResponse", "VercelResponse"])
}
/** Gets the parameter that contains the request object. */

7
javascript/ql/test/library-tests/frameworks/vercel/src/now.ts Normal file
View File

@@ -0,0 +1,7 @@
import type { NowRequest, NowResponse } from "@now/node";
// Legacy Zeit-era aliases. The model should treat these identically to
// the modern @vercel/node NowRequest -> VercelRequest, NowResponse -> VercelResponse.
export default function handler(req: NowRequest, res: NowResponse) {
res.send(req.query.name);
}

5
javascript/ql/test/library-tests/frameworks/vercel/tests.expected
View File

@@ -1,8 +1,11 @@
test_RouteHandler
| src/now.ts:5:16:7:1 | functio ... ame);\\n} |
| src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
test_RequestSource
| src/now.ts:5:33:5:35 | req | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
| src/vercel.ts:9:33:9:35 | req | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
test_ResponseSource
| src/now.ts:5:50:5:52 | res | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
| src/vercel.ts:9:53:9:55 | res | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
| src/vercel.ts:23:3:23:17 | res.status(200) | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
test_HeaderDefinition
@@ -10,6 +13,7 @@ test_HeaderDefinition
test_RedirectInvocation
| src/vercel.ts:26:3:26:39 | res.red ... string) | src/vercel.ts:26:16:26:38 | req.que ... string | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
test_RequestInputAccess
| src/now.ts:6:12:6:20 | req.query | parameter | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
| src/vercel.ts:11:13:11:21 | req.query | parameter | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
| src/vercel.ts:12:13:12:20 | req.body | body | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
| src/vercel.ts:13:13:13:23 | req.cookies | cookie | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
@@ -18,5 +22,6 @@ test_RequestInputAccess
| src/vercel.ts:16:15:16:33 | req.headers.referer | header | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
| src/vercel.ts:26:16:26:24 | req.query | parameter | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
test_ResponseSendArgument
| src/now.ts:6:12:6:25 | req.query.name | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
| src/vercel.ts:22:12:22:12 | q | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
| src/vercel.ts:23:24:23:24 | b | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |