diff --git a/javascript/ql/lib/semmle/javascript/frameworks/VercelNode.qll b/javascript/ql/lib/semmle/javascript/frameworks/VercelNode.qll index 233f103825c..e31d40dcf9a 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/VercelNode.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/VercelNode.qll @@ -32,8 +32,8 @@ module VercelNode { this = any(Module m).getAnExportedValue("default").getAFunctionValue() and req = this.getParameter(0) and res = this.getParameter(1) and - req.hasUnderlyingType("@vercel/node", "VercelRequest") and - res.hasUnderlyingType("@vercel/node", "VercelResponse") + req.hasUnderlyingType(["@vercel/node", "@now/node"], ["NowRequest", "VercelRequest"]) and + res.hasUnderlyingType(["@vercel/node", "@now/node"], ["NowResponse", "VercelResponse"]) } /** Gets the parameter that contains the request object. */ diff --git a/javascript/ql/test/library-tests/frameworks/vercel/src/now.ts b/javascript/ql/test/library-tests/frameworks/vercel/src/now.ts new file mode 100644 index 00000000000..a8ac7020408 --- /dev/null +++ b/javascript/ql/test/library-tests/frameworks/vercel/src/now.ts @@ -0,0 +1,7 @@ +import type { NowRequest, NowResponse } from "@now/node"; + +// Legacy Zeit-era aliases. The model should treat these identically to +// the modern @vercel/node NowRequest -> VercelRequest, NowResponse -> VercelResponse. +export default function handler(req: NowRequest, res: NowResponse) { + res.send(req.query.name); +} diff --git a/javascript/ql/test/library-tests/frameworks/vercel/tests.expected b/javascript/ql/test/library-tests/frameworks/vercel/tests.expected index 886ba9c5997..a2929999f23 100644 --- a/javascript/ql/test/library-tests/frameworks/vercel/tests.expected +++ b/javascript/ql/test/library-tests/frameworks/vercel/tests.expected @@ -1,8 +1,11 @@ test_RouteHandler +| src/now.ts:5:16:7:1 | functio ... ame);\\n} | | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | test_RequestSource +| src/now.ts:5:33:5:35 | req | src/now.ts:5:16:7:1 | functio ... ame);\\n} | | src/vercel.ts:9:33:9:35 | req | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | test_ResponseSource +| src/now.ts:5:50:5:52 | res | src/now.ts:5:16:7:1 | functio ... ame);\\n} | | src/vercel.ts:9:53:9:55 | res | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | | src/vercel.ts:23:3:23:17 | res.status(200) | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | test_HeaderDefinition @@ -10,6 +13,7 @@ test_HeaderDefinition test_RedirectInvocation | src/vercel.ts:26:3:26:39 | res.red ... string) | src/vercel.ts:26:16:26:38 | req.que ... string | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | test_RequestInputAccess +| src/now.ts:6:12:6:20 | req.query | parameter | src/now.ts:5:16:7:1 | functio ... ame);\\n} | | src/vercel.ts:11:13:11:21 | req.query | parameter | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | | src/vercel.ts:12:13:12:20 | req.body | body | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | | src/vercel.ts:13:13:13:23 | req.cookies | cookie | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | @@ -18,5 +22,6 @@ test_RequestInputAccess | src/vercel.ts:16:15:16:33 | req.headers.referer | header | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | | src/vercel.ts:26:16:26:24 | req.query | parameter | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | test_ResponseSendArgument +| src/now.ts:6:12:6:25 | req.query.name | src/now.ts:5:16:7:1 | functio ... ame);\\n} | | src/vercel.ts:22:12:22:12 | q | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} | | src/vercel.ts:23:24:23:24 | b | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |