Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3566

2026-05-05 05:35:13 +02:00 · 2020-05-27 12:12:08 +00:00
parent 3ae4e90902 fd05314b2c
commit d05a61c745
67 changed files with 1305 additions and 258 deletions
--- a/javascript/ql/test/library-tests/DataFlow/argumentPassing.expected
+++ b/javascript/ql/test/library-tests/DataFlow/argumentPassing.expected
@@ -0,0 +1,10 @@
+| arguments.js:11:5:11:14 | f(1, 2, 3) | arguments.js:11:7:11:7 | 1 | arguments.js:2:5:10:5 | functio ... ;\\n    } | arguments.js:2:16:2:16 | x |
+| arguments.js:11:5:11:14 | f(1, 2, 3) | arguments.js:11:7:11:7 | 1 | arguments.js:2:5:10:5 | functio ... ;\\n    } | arguments.js:4:28:4:39 | arguments[0] |
+| arguments.js:11:5:11:14 | f(1, 2, 3) | arguments.js:11:10:11:10 | 2 | arguments.js:2:5:10:5 | functio ... ;\\n    } | arguments.js:5:25:5:36 | arguments[1] |
+| arguments.js:11:5:11:14 | f(1, 2, 3) | arguments.js:11:13:11:13 | 3 | arguments.js:2:5:10:5 | functio ... ;\\n    } | arguments.js:7:24:7:30 | args[2] |
+| sources.js:3:1:5:6 | (functi ... \\n})(23) | sources.js:5:4:5:5 | 23 | sources.js:3:2:5:1 | functio ... x+19;\\n} | sources.js:3:11:3:11 | x |
+| tst.js:16:1:20:9 | (functi ... ("arg") | tst.js:20:4:20:8 | "arg" | tst.js:16:2:20:1 | functio ... n "";\\n} | tst.js:16:13:16:13 | a |
+| tst.js:35:1:35:7 | g(true) | tst.js:35:3:35:6 | true | tst.js:32:1:34:1 | functio ... ables\\n} | tst.js:32:12:32:12 | b |
+| tst.js:44:1:44:5 | o.m() | tst.js:44:1:44:1 | o | tst.js:39:4:41:3 | () {\\n    this;\\n  } | tst.js:39:4:39:3 | this |
+| tst.js:87:1:96:2 | (functi ... r: 0\\n}) | tst.js:92:4:96:1 | {\\n  p:  ...  r: 0\\n} | tst.js:87:2:92:1 | functio ...  + z;\\n} | tst.js:87:11:87:24 | { p: x, ...o } |
+| tst.js:98:1:103:17 | (functi ... 3, 0 ]) | tst.js:103:4:103:16 | [ 19, 23, 0 ] | tst.js:98:2:103:1 | functio ...  + z;\\n} | tst.js:98:11:98:24 | [ x, ...rest ] |
--- a/javascript/ql/test/library-tests/DataFlow/argumentPassing.ql
+++ b/javascript/ql/test/library-tests/DataFlow/argumentPassing.ql
@@ -0,0 +1,6 @@
+import javascript
+import semmle.javascript.dataflow.internal.FlowSteps as FlowSteps
+
+from DataFlow::Node invk, DataFlow::Node arg, Function f, DataFlow::SourceNode parm
+where FlowSteps::argumentPassing(invk, arg, f, parm)
+select invk, arg, f, parm
--- a/javascript/ql/test/library-tests/DataFlow/arguments.js
+++ b/javascript/ql/test/library-tests/DataFlow/arguments.js
@@ -0,0 +1,12 @@
+(function() {
+    function f(x) {
+        let firstArg = x;
+        let alsoFirstArg = arguments[0];
+        let secondArg = arguments[1];
+        let args = arguments;
+        let thirdArg = args[2];
+        arguments = {};
+        let notFirstArg = arguments[0];
+    }
+    f(1, 2, 3);
+})();
--- a/javascript/ql/test/library-tests/DataFlow/enclosingExpr.expected
+++ b/javascript/ql/test/library-tests/DataFlow/enclosingExpr.expected
@@ -1,3 +1,42 @@
+| arguments.js:1:1:12:2 | (functi ...  3);\\n}) | arguments.js:1:1:12:2 | (functi ...  3);\\n}) |
+| arguments.js:1:1:12:4 | (functi ... );\\n})() | arguments.js:1:1:12:4 | (functi ... );\\n})() |
+| arguments.js:1:2:12:1 | functio ... , 3);\\n} | arguments.js:1:2:12:1 | functio ... , 3);\\n} |
+| arguments.js:2:14:2:14 | f | arguments.js:2:14:2:14 | f |
+| arguments.js:2:16:2:16 | x | arguments.js:2:16:2:16 | x |
+| arguments.js:3:13:3:20 | firstArg | arguments.js:3:13:3:20 | firstArg |
+| arguments.js:3:13:3:24 | firstArg = x | arguments.js:3:13:3:24 | firstArg = x |
+| arguments.js:3:24:3:24 | x | arguments.js:3:24:3:24 | x |
+| arguments.js:4:13:4:24 | alsoFirstArg | arguments.js:4:13:4:24 | alsoFirstArg |
+| arguments.js:4:13:4:39 | alsoFir ... ents[0] | arguments.js:4:13:4:39 | alsoFir ... ents[0] |
+| arguments.js:4:28:4:36 | arguments | arguments.js:4:28:4:36 | arguments |
+| arguments.js:4:28:4:39 | arguments[0] | arguments.js:4:28:4:39 | arguments[0] |
+| arguments.js:4:38:4:38 | 0 | arguments.js:4:38:4:38 | 0 |
+| arguments.js:5:13:5:21 | secondArg | arguments.js:5:13:5:21 | secondArg |
+| arguments.js:5:13:5:36 | secondA ... ents[1] | arguments.js:5:13:5:36 | secondA ... ents[1] |
+| arguments.js:5:25:5:33 | arguments | arguments.js:5:25:5:33 | arguments |
+| arguments.js:5:25:5:36 | arguments[1] | arguments.js:5:25:5:36 | arguments[1] |
+| arguments.js:5:35:5:35 | 1 | arguments.js:5:35:5:35 | 1 |
+| arguments.js:6:13:6:16 | args | arguments.js:6:13:6:16 | args |
+| arguments.js:6:13:6:28 | args = arguments | arguments.js:6:13:6:28 | args = arguments |
+| arguments.js:6:20:6:28 | arguments | arguments.js:6:20:6:28 | arguments |
+| arguments.js:7:13:7:20 | thirdArg | arguments.js:7:13:7:20 | thirdArg |
+| arguments.js:7:13:7:30 | thirdArg = args[2] | arguments.js:7:13:7:30 | thirdArg = args[2] |
+| arguments.js:7:24:7:27 | args | arguments.js:7:24:7:27 | args |
+| arguments.js:7:24:7:30 | args[2] | arguments.js:7:24:7:30 | args[2] |
+| arguments.js:7:29:7:29 | 2 | arguments.js:7:29:7:29 | 2 |
+| arguments.js:8:9:8:17 | arguments | arguments.js:8:9:8:17 | arguments |
+| arguments.js:8:9:8:22 | arguments = {} | arguments.js:8:9:8:22 | arguments = {} |
+| arguments.js:8:21:8:22 | {} | arguments.js:8:21:8:22 | {} |
+| arguments.js:9:13:9:23 | notFirstArg | arguments.js:9:13:9:23 | notFirstArg |
+| arguments.js:9:13:9:38 | notFirs ... ents[0] | arguments.js:9:13:9:38 | notFirs ... ents[0] |
+| arguments.js:9:27:9:35 | arguments | arguments.js:9:27:9:35 | arguments |
+| arguments.js:9:27:9:38 | arguments[0] | arguments.js:9:27:9:38 | arguments[0] |
+| arguments.js:9:37:9:37 | 0 | arguments.js:9:37:9:37 | 0 |
+| arguments.js:11:5:11:5 | f | arguments.js:11:5:11:5 | f |
+| arguments.js:11:5:11:14 | f(1, 2, 3) | arguments.js:11:5:11:14 | f(1, 2, 3) |
+| arguments.js:11:7:11:7 | 1 | arguments.js:11:7:11:7 | 1 |
+| arguments.js:11:10:11:10 | 2 | arguments.js:11:10:11:10 | 2 |
+| arguments.js:11:13:11:13 | 3 | arguments.js:11:13:11:13 | 3 |
 | eval.js:1:10:1:10 | k | eval.js:1:10:1:10 | k |
 | eval.js:2:7:2:7 | x | eval.js:2:7:2:7 | x |
 | eval.js:2:7:2:12 | x = 42 | eval.js:2:7:2:12 | x = 42 |
--- a/javascript/ql/test/library-tests/DataFlow/flowStep.expected
+++ b/javascript/ql/test/library-tests/DataFlow/flowStep.expected
@@ -1,3 +1,16 @@
+| arguments.js:1:2:12:1 | functio ... , 3);\\n} | arguments.js:1:1:12:2 | (functi ...  3);\\n}) |
+| arguments.js:2:5:2:5 | arguments | arguments.js:4:28:4:36 | arguments |
+| arguments.js:2:5:2:5 | arguments | arguments.js:5:25:5:33 | arguments |
+| arguments.js:2:5:2:5 | arguments | arguments.js:6:20:6:28 | arguments |
+| arguments.js:2:5:10:5 | functio ... ;\\n    } | arguments.js:2:14:2:14 | f |
+| arguments.js:2:14:2:14 | f | arguments.js:11:5:11:5 | f |
+| arguments.js:2:16:2:16 | x | arguments.js:2:16:2:16 | x |
+| arguments.js:2:16:2:16 | x | arguments.js:3:24:3:24 | x |
+| arguments.js:6:13:6:28 | args | arguments.js:7:24:7:27 | args |
+| arguments.js:6:20:6:28 | arguments | arguments.js:6:13:6:28 | args |
+| arguments.js:8:9:8:22 | arguments | arguments.js:9:27:9:35 | arguments |
+| arguments.js:8:21:8:22 | {} | arguments.js:8:9:8:22 | arguments |
+| arguments.js:8:21:8:22 | {} | arguments.js:8:9:8:22 | arguments = {} |
 | eval.js:2:7:2:12 | x | eval.js:4:3:4:3 | x |
 | eval.js:2:11:2:12 | 42 | eval.js:2:7:2:12 | x |
 | sources.js:1:6:1:6 | x | sources.js:1:6:1:6 | x |
--- a/javascript/ql/test/library-tests/DataFlow/getIntValue.expected
+++ b/javascript/ql/test/library-tests/DataFlow/getIntValue.expected
@@ -1,3 +1,10 @@
+| arguments.js:4:38:4:38 | 0 | 0 |
+| arguments.js:5:35:5:35 | 1 | 1 |
+| arguments.js:7:29:7:29 | 2 | 2 |
+| arguments.js:9:37:9:37 | 0 | 0 |
+| arguments.js:11:7:11:7 | 1 | 1 |
+| arguments.js:11:10:11:10 | 2 | 2 |
+| arguments.js:11:13:11:13 | 3 | 3 |
 | eval.js:2:11:2:12 | 42 | 42 |
 | sources.js:4:12:4:13 | 19 | 19 |
 | sources.js:5:4:5:5 | 23 | 23 |
--- a/javascript/ql/test/library-tests/DataFlow/incomplete.expected
+++ b/javascript/ql/test/library-tests/DataFlow/incomplete.expected
@@ -1,3 +1,13 @@
+| arguments.js:1:1:12:4 | exceptional return of (functi ... );\\n})() | call |
+| arguments.js:1:2:12:1 | exceptional return of anonymous function | call |
+| arguments.js:2:5:10:5 | exceptional return of function f | call |
+| arguments.js:2:16:2:16 | x | call |
+| arguments.js:4:28:4:39 | arguments[0] | heap |
+| arguments.js:5:25:5:36 | arguments[1] | heap |
+| arguments.js:7:24:7:30 | args[2] | heap |
+| arguments.js:9:27:9:38 | arguments[0] | heap |
+| arguments.js:11:5:11:14 | exceptional return of f(1, 2, 3) | call |
+| arguments.js:11:5:11:14 | f(1, 2, 3) | call |
 | eval.js:1:1:5:1 | exceptional return of function k | call |
 | eval.js:2:7:2:12 | x | eval |
 | eval.js:3:3:3:6 | eval | global |
--- a/javascript/ql/test/library-tests/DataFlow/parameters.expected
+++ b/javascript/ql/test/library-tests/DataFlow/parameters.expected
@@ -1,3 +1,4 @@
+| arguments.js:2:16:2:16 | x |
 | sources.js:1:6:1:6 | x |
 | sources.js:3:11:3:11 | x |
 | sources.js:9:14:9:18 | array |
--- a/javascript/ql/test/library-tests/DataFlow/sources.expected
+++ b/javascript/ql/test/library-tests/DataFlow/sources.expected
@@ -1,3 +1,16 @@
+| arguments.js:1:1:1:0 | this |
+| arguments.js:1:1:12:4 | (functi ... );\\n})() |
+| arguments.js:1:2:1:1 | this |
+| arguments.js:1:2:12:1 | functio ... , 3);\\n} |
+| arguments.js:2:5:2:4 | this |
+| arguments.js:2:5:10:5 | functio ... ;\\n    } |
+| arguments.js:2:16:2:16 | x |
+| arguments.js:4:28:4:39 | arguments[0] |
+| arguments.js:5:25:5:36 | arguments[1] |
+| arguments.js:7:24:7:30 | args[2] |
+| arguments.js:8:21:8:22 | {} |
+| arguments.js:9:27:9:38 | arguments[0] |
+| arguments.js:11:5:11:14 | f(1, 2, 3) |
 | eval.js:1:1:1:0 | this |
 | eval.js:1:1:1:0 | this |
 | eval.js:1:1:5:1 | functio ... eval`\\n} |
--- a/javascript/ql/test/library-tests/NodeJS/Require.expected
+++ b/javascript/ql/test/library-tests/NodeJS/Require.expected
@@ -11,6 +11,8 @@
 | d.js:7:1:7:14 | require('foo') |
 | e.js:5:1:5:18 | require("process") |
 | f.js:2:1:2:7 | r("fs") |
+| g.js:1:1:1:96 | (proces ... https") |
+| g.js:1:43:1:61 | require("electron") |
 | index.js:1:12:1:26 | require('path') |
 | index.js:2:1:2:41 | require ... b.js")) |
 | mjs-files/require-from-js.js:1:12:1:36 | require ... on-me') |
--- a/javascript/ql/test/library-tests/NodeJS/g.js
+++ b/javascript/ql/test/library-tests/NodeJS/g.js
@@ -0,0 +1 @@
+(process && "renderer" === process.type ? require("electron").remote.require : require)("https");
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -31,6 +31,7 @@ typeInferenceMismatch
 | callbacks.js:44:17:44:24 | source() | callbacks.js:41:10:41:10 | x |
 | callbacks.js:50:18:50:25 | source() | callbacks.js:30:29:30:29 | y |
 | callbacks.js:51:18:51:25 | source() | callbacks.js:30:29:30:29 | y |
+| capture-flow.js:9:11:9:18 | source() | capture-flow.js:14:10:14:16 | outer() |
 | captured-sanitizer.js:25:3:25:10 | source() | captured-sanitizer.js:15:10:15:10 | x |
 | closure.js:6:15:6:22 | source() | closure.js:8:8:8:31 | string. ... (taint) |
 | closure.js:6:15:6:22 | source() | closure.js:9:8:9:25 | string.trim(taint) |
--- a/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected
@@ -22,6 +22,7 @@
 | callbacks.js:44:17:44:24 | source() | callbacks.js:41:10:41:10 | x |
 | callbacks.js:50:18:50:25 | source() | callbacks.js:30:29:30:29 | y |
 | callbacks.js:51:18:51:25 | source() | callbacks.js:30:29:30:29 | y |
+| capture-flow.js:9:11:9:18 | source() | capture-flow.js:14:10:14:16 | outer() |
 | captured-sanitizer.js:25:3:25:10 | source() | captured-sanitizer.js:15:10:15:10 | x |
 | constructor-calls.js:4:18:4:25 | source() | constructor-calls.js:18:8:18:14 | c.taint |
 | constructor-calls.js:4:18:4:25 | source() | constructor-calls.js:22:8:22:19 | c_safe.taint |
--- a/javascript/ql/test/library-tests/TaintTracking/capture-flow.js
+++ b/javascript/ql/test/library-tests/TaintTracking/capture-flow.js
@@ -0,0 +1,19 @@
+import 'dummy';
+
+function outerMost() {
+    function outer() {
+        var captured;
+        function f(x) {
+            captured = x;
+        }
+        f(source());
+
+        return captured;
+    }
+
+    sink(outer()); // NOT OK
+
+    return outer();
+}
+
+sink(outerMost()); // NOT OK - but missed
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderAccess.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_HeaderAccess(HTTP::RequestHeaderAccess access, string res) {
+  res = access.getAHeaderName()
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_HeaderDefinition(HTTP::HeaderDefinition hd, Fastify::RouteHandler rh) {
+  rh = hd.getRouteHandler()
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_defines.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_defines.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_HeaderDefinition_defines(HTTP::HeaderDefinition hd, string name, string value) {
+  hd.defines(name, value) and hd.getRouteHandler() instanceof Fastify::RouteHandler
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_getAHeaderName.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/HeaderDefinition_getAHeaderName.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_HeaderDefinition_getAHeaderName(HTTP::HeaderDefinition hd, string res) {
+  hd.getRouteHandler() instanceof Fastify::RouteHandler and res = hd.getAHeaderName()
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/RedirectInvocation.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RedirectInvocation.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_RedirectInvocation(HTTP::RedirectInvocation invk, Fastify::RouteHandler rh) {
+  invk.getRouteHandler() = rh
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/RequestInputAccess.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RequestInputAccess.qll
@@ -0,0 +1,11 @@
+import javascript
+
+query predicate test_RequestInputAccess(
+  HTTP::RequestInputAccess ria, string res, Fastify::RouteHandler rh, boolean isUserControlledObject
+) {
+  ria.getRouteHandler() = rh and
+  res = ria.getKind() and
+  if ria.isUserControlledObject()
+  then isUserControlledObject = true
+  else isUserControlledObject = false
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/ResponseSendArgument.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/ResponseSendArgument.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_ResponseSendArgument(HTTP::ResponseSendArgument arg, Fastify::RouteHandler rh) {
+  arg.getRouteHandler() = rh
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler.qll
@@ -0,0 +1,3 @@
+import javascript
+
+query predicate test_RouteHandler(Fastify::RouteHandler rh, Expr res) { res = rh.getServer() }
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getARequestExpr.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getARequestExpr.qll
@@ -0,0 +1,5 @@
+import semmle.javascript.frameworks.Express
+
+query predicate test_RouteHandler_getARequestExpr(Fastify::RouteHandler rh, HTTP::RequestExpr res) {
+  res = rh.getARequestExpr()
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getAResponseHeader.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteHandler_getAResponseHeader.qll
@@ -0,0 +1,7 @@
+import semmle.javascript.frameworks.Express
+
+query predicate test_RouteHandler_getAResponseHeader(
+  Fastify::RouteHandler rh, string name, HTTP::HeaderDefinition res
+) {
+  res = rh.getAResponseHeader(name)
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup.qll
@@ -0,0 +1,3 @@
+import javascript
+
+query predicate test_RouteSetup(Fastify::RouteSetup rs) { any() }
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getARouteHandler.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getARouteHandler.qll
@@ -0,0 +1,5 @@
+import javascript
+
+query predicate test_RouteSetup_getARouteHandler(Fastify::RouteSetup r, DataFlow::SourceNode res) {
+  res = r.getARouteHandler()
+}
--- a/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getServer.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/RouteSetup_getServer.qll
@@ -0,0 +1,3 @@
+import javascript
+
+query predicate test_RouteSetup_getServer(Fastify::RouteSetup rs, Expr res) { res = rs.getServer() }
--- a/javascript/ql/test/library-tests/frameworks/fastify/ServerDefinition.qll
+++ b/javascript/ql/test/library-tests/frameworks/fastify/ServerDefinition.qll
@@ -0,0 +1,3 @@
+import javascript
+
+query predicate test_ServerDefinition(Fastify::ServerDefinition s) { any() }
--- a/javascript/ql/test/library-tests/frameworks/fastify/src/fastify.js
+++ b/javascript/ql/test/library-tests/frameworks/fastify/src/fastify.js
@@ -0,0 +1,92 @@
+var fastify = require("fastify")();
+
+fastify.get(
+  "/",
+  /* handler */ async (request, reply) => {
+    return { hello: "world" }; // response
+  }
+);
+
+fastify.route({
+  method: "GET",
+  url: "/",
+  onRequest: /* handler */ (request, reply, done) => {},
+  preParsing: /* handler */ (request, reply, done) => {},
+  preValidation: /* handler */ (request, reply, done) => {},
+  preHandler: /* handler */ (request, reply, done) => {},
+  preSerialization: /* handler */ (request, reply, payload, done) => {},
+  onSend: /* handler */ (request, reply, payload, done) => {},
+  onResponse: /* handler */ (request, reply, done) => {},
+  handler: /* handler */ (request, reply) => {}
+});
+
+fastify.get(
+  "/",
+  opts,
+  /* handler */ (request, reply) => {
+    reply.send({ hello: "world" }); // response
+  }
+);
+
+fastify.post(
+  "/:params",
+  options,
+  /* handler */ function(request, reply) {
+    // request properties
+    request.query.name; // the parsed querystring
+    request.body; // the body
+    request.params.name; // the params matching the URL
+    request.headers.name; // the headers
+
+    // reply properties
+    reply.header("name", "value"); // Sets a response header.
+    reply.headers({ name: "value" }); // Sets all the keys of the object as a response headers.
+    reply.redirect(code, url); // Redirect to the specified url, the status code is optional (default to 302).
+    reply.send(payload); // Sends the payload to the user, could be a plain text, a buffer, JSON, stream
+  }
+);
+fastify.listen(3000);
+
+var fastifyWithObjects1 = require("fastify")();
+fastifyWithObjects1.register(require("fastify-xml-body-parser"));
+fastifyWithObjects1.post(
+  "/:params",
+  /* handler */ function(request, reply) {
+    request.query;
+    request.body;
+    request.params;
+  }
+);
+
+var fastifyWithObjects2 = require("fastify")();
+fastifyWithObjects2.register(require("fastify-formbody"));
+fastifyWithObjects2.post(
+  "/:params",
+  /* handler */ function(request, reply) {
+    request.query;
+    request.body;
+    request.params;
+  }
+);
+
+var fastifyWithObjects3 = require("fastify")();
+fastifyWithObjects3.register(require("fastify-qs"));
+fastifyWithObjects3.post(
+  "/:params",
+  /* handler */ function(request, reply) {
+    request.query;
+    request.body;
+    request.params;
+  }
+);
+
+var fastifyWithObjects4 = require("fastify")();
+fastifyWithObjects4.use(require("body-parser").urlencoded({ extended: true }));
+fastifyWithObjects4.post(
+  "/:params",
+  /* handler */ function(request, reply) {
+    request.query;
+    request.body;
+    request.params;
+  }
+);
--- a/javascript/ql/test/library-tests/frameworks/fastify/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/fastify/tests.expected
@@ -0,0 +1,125 @@
+test_RouteSetup
+| src/fastify.js:3:1:8:1 | fastify ... e\\n  }\\n) |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) |
+| src/fastify.js:23:1:29:1 | fastify ... e\\n  }\\n) |
+| src/fastify.js:31:1:47:1 | fastify ... m\\n  }\\n) |
+| src/fastify.js:52:1:59:1 | fastify ... ;\\n  }\\n) |
+| src/fastify.js:63:1:70:1 | fastify ... ;\\n  }\\n) |
+| src/fastify.js:74:1:81:1 | fastify ... ;\\n  }\\n) |
+| src/fastify.js:85:1:92:1 | fastify ... ;\\n  }\\n) |
+test_RequestInputAccess
+| src/fastify.js:36:5:36:17 | request.query | parameter | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | false |
+| src/fastify.js:37:5:37:16 | request.body | body | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | false |
+| src/fastify.js:38:5:38:18 | request.params | parameter | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | false |
+| src/fastify.js:39:5:39:24 | request.headers.name | header | src/fastify.js:34:17:46:3 | functio ... eam\\n  } | false |
+| src/fastify.js:55:5:55:17 | request.query | parameter | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | false |
+| src/fastify.js:56:5:56:16 | request.body | body | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | true |
+| src/fastify.js:57:5:57:18 | request.params | parameter | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | false |
+| src/fastify.js:66:5:66:17 | request.query | parameter | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | false |
+| src/fastify.js:67:5:67:16 | request.body | body | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | true |
+| src/fastify.js:68:5:68:18 | request.params | parameter | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | false |
+| src/fastify.js:77:5:77:17 | request.query | parameter | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | true |
+| src/fastify.js:78:5:78:16 | request.body | body | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | false |
+| src/fastify.js:79:5:79:18 | request.params | parameter | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | true |
+| src/fastify.js:88:5:88:17 | request.query | parameter | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | false |
+| src/fastify.js:89:5:89:16 | request.body | body | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | true |
+| src/fastify.js:90:5:90:18 | request.params | parameter | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | false |
+test_RouteHandler_getAResponseHeader
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | name | src/fastify.js:42:5:42:33 | reply.h ... value") |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | name | src/fastify.js:43:5:43:36 | reply.h ... lue" }) |
+test_HeaderDefinition_defines
+| src/fastify.js:42:5:42:33 | reply.h ... value") | name | value |
+| src/fastify.js:43:5:43:36 | reply.h ... lue" }) | name | value |
+test_HeaderDefinition
+| src/fastify.js:42:5:42:33 | reply.h ... value") | src/fastify.js:34:17:46:3 | functio ... eam\\n  } |
+| src/fastify.js:43:5:43:36 | reply.h ... lue" }) | src/fastify.js:34:17:46:3 | functio ... eam\\n  } |
+test_RouteSetup_getServer
+| src/fastify.js:3:1:8:1 | fastify ... e\\n  }\\n) | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:23:1:29:1 | fastify ... e\\n  }\\n) | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:31:1:47:1 | fastify ... m\\n  }\\n) | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:52:1:59:1 | fastify ... ;\\n  }\\n) | src/fastify.js:50:27:50:46 | require("fastify")() |
+| src/fastify.js:63:1:70:1 | fastify ... ;\\n  }\\n) | src/fastify.js:61:27:61:46 | require("fastify")() |
+| src/fastify.js:74:1:81:1 | fastify ... ;\\n  }\\n) | src/fastify.js:72:27:72:46 | require("fastify")() |
+| src/fastify.js:85:1:92:1 | fastify ... ;\\n  }\\n) | src/fastify.js:83:27:83:46 | require("fastify")() |
+test_HeaderDefinition_getAHeaderName
+| src/fastify.js:42:5:42:33 | reply.h ... value") | name |
+| src/fastify.js:43:5:43:36 | reply.h ... lue" }) | name |
+test_ServerDefinition
+| src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:50:27:50:46 | require("fastify")() |
+| src/fastify.js:61:27:61:46 | require("fastify")() |
+| src/fastify.js:72:27:72:46 | require("fastify")() |
+| src/fastify.js:83:27:83:46 | require("fastify")() |
+test_HeaderAccess
+| src/fastify.js:39:5:39:24 | request.headers.name | name |
+test_RouteSetup_getARouteHandler
+| src/fastify.js:3:1:8:1 | fastify ... e\\n  }\\n) | src/fastify.js:5:17:7:3 | async ( ... nse\\n  } |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:13:28:13:55 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:14:29:14:56 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:15:32:15:59 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:16:29:16:56 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:17:35:17:71 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:18:25:18:61 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:19:29:19:56 | (reques ... ) => {} |
+| src/fastify.js:10:1:21:2 | fastify ... > {}\\n}) | src/fastify.js:20:26:20:47 | (reques ... ) => {} |
+| src/fastify.js:23:1:29:1 | fastify ... e\\n  }\\n) | src/fastify.js:26:17:28:3 | (reques ... nse\\n  } |
+| src/fastify.js:31:1:47:1 | fastify ... m\\n  }\\n) | src/fastify.js:34:17:46:3 | functio ... eam\\n  } |
+| src/fastify.js:52:1:59:1 | fastify ... ;\\n  }\\n) | src/fastify.js:54:17:58:3 | functio ... ms;\\n  } |
+| src/fastify.js:63:1:70:1 | fastify ... ;\\n  }\\n) | src/fastify.js:65:17:69:3 | functio ... ms;\\n  } |
+| src/fastify.js:74:1:81:1 | fastify ... ;\\n  }\\n) | src/fastify.js:76:17:80:3 | functio ... ms;\\n  } |
+| src/fastify.js:85:1:92:1 | fastify ... ;\\n  }\\n) | src/fastify.js:87:17:91:3 | functio ... ms;\\n  } |
+test_RouteHandler
+| src/fastify.js:5:17:7:3 | async ( ... nse\\n  } | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:13:28:13:55 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:14:29:14:56 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:15:32:15:59 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:16:29:16:56 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:17:35:17:71 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:18:25:18:61 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:19:29:19:56 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:20:26:20:47 | (reques ... ) => {} | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:26:17:28:3 | (reques ... nse\\n  } | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:1:15:1:34 | require("fastify")() |
+| src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:50:27:50:46 | require("fastify")() |
+| src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:61:27:61:46 | require("fastify")() |
+| src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:72:27:72:46 | require("fastify")() |
+| src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:83:27:83:46 | require("fastify")() |
+test_RouteHandler_getARequestExpr
+| src/fastify.js:5:17:7:3 | async ( ... nse\\n  } | src/fastify.js:5:24:5:30 | request |
+| src/fastify.js:13:28:13:55 | (reques ... ) => {} | src/fastify.js:13:29:13:35 | request |
+| src/fastify.js:14:29:14:56 | (reques ... ) => {} | src/fastify.js:14:30:14:36 | request |
+| src/fastify.js:15:32:15:59 | (reques ... ) => {} | src/fastify.js:15:33:15:39 | request |
+| src/fastify.js:16:29:16:56 | (reques ... ) => {} | src/fastify.js:16:30:16:36 | request |
+| src/fastify.js:17:35:17:71 | (reques ... ) => {} | src/fastify.js:17:36:17:42 | request |
+| src/fastify.js:18:25:18:61 | (reques ... ) => {} | src/fastify.js:18:26:18:32 | request |
+| src/fastify.js:19:29:19:56 | (reques ... ) => {} | src/fastify.js:19:30:19:36 | request |
+| src/fastify.js:20:26:20:47 | (reques ... ) => {} | src/fastify.js:20:27:20:33 | request |
+| src/fastify.js:26:17:28:3 | (reques ... nse\\n  } | src/fastify.js:26:18:26:24 | request |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:34:26:34:32 | request |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:36:5:36:11 | request |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:37:5:37:11 | request |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:38:5:38:11 | request |
+| src/fastify.js:34:17:46:3 | functio ... eam\\n  } | src/fastify.js:39:5:39:11 | request |
+| src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:54:26:54:32 | request |
+| src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:55:5:55:11 | request |
+| src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:56:5:56:11 | request |
+| src/fastify.js:54:17:58:3 | functio ... ms;\\n  } | src/fastify.js:57:5:57:11 | request |
+| src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:65:26:65:32 | request |
+| src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:66:5:66:11 | request |
+| src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:67:5:67:11 | request |
+| src/fastify.js:65:17:69:3 | functio ... ms;\\n  } | src/fastify.js:68:5:68:11 | request |
+| src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:76:26:76:32 | request |
+| src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:77:5:77:11 | request |
+| src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:78:5:78:11 | request |
+| src/fastify.js:76:17:80:3 | functio ... ms;\\n  } | src/fastify.js:79:5:79:11 | request |
+| src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:87:26:87:32 | request |
+| src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:88:5:88:11 | request |
+| src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:89:5:89:11 | request |
+| src/fastify.js:87:17:91:3 | functio ... ms;\\n  } | src/fastify.js:90:5:90:11 | request |
+test_ResponseSendArgument
+| src/fastify.js:6:12:6:29 | { hello: "world" } | src/fastify.js:5:17:7:3 | async ( ... nse\\n  } |
+| src/fastify.js:27:16:27:33 | { hello: "world" } | src/fastify.js:26:17:28:3 | (reques ... nse\\n  } |
+| src/fastify.js:45:16:45:22 | payload | src/fastify.js:34:17:46:3 | functio ... eam\\n  } |
+test_RedirectInvocation
+| src/fastify.js:44:5:44:29 | reply.r ... e, url) | src/fastify.js:34:17:46:3 | functio ... eam\\n  } |
--- a/javascript/ql/test/library-tests/frameworks/fastify/tests.ql
+++ b/javascript/ql/test/library-tests/frameworks/fastify/tests.ql
@@ -0,0 +1,14 @@
+import RouteSetup
+import RequestInputAccess
+import RouteHandler_getAResponseHeader
+import HeaderDefinition_defines
+import HeaderDefinition
+import RouteSetup_getServer
+import HeaderDefinition_getAHeaderName
+import ServerDefinition
+import HeaderAccess
+import RouteSetup_getARouteHandler
+import RouteHandler
+import RouteHandler_getARequestExpr
+import ResponseSendArgument
+import RedirectInvocation
				`@@ -0,0 +1 @@`
				`(process && "renderer" === process.type ? require("electron").remote.require : require)("https");`