hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: model mongoose Model on createConnection.<model/models>

Browse Source
This commit is contained in:
Esben Sparre Andreasen
2020-03-14 12:51:18 +01:00
parent 730396df12
commit dc27a8f52c
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
View File

@@ -218,7 +218,13 @@ private module Mongoose {
*/
private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
(
result = getAMongooseInstance().getAMemberCall("model") or
result = getAMongooseInstance().getAMemberCall("model")
or
exists(DataFlow::SourceNode conn | conn = createConnection() |
result = conn.getAMemberCall("model") or
result = conn.getAPropertyRead("models").getAPropertyRead()
)
or
result.hasUnderlyingType("mongoose", "Model")
) and
t.start()