Merge pull request #20916 from asgerf/js/next-folders2

JS: Handle Next.js files named 'page' or 'route'

javascript/ql/lib/semmle/javascript/frameworks/Next.qll

@@ -13,18 +13,9 @@ module NextJS {
    */
   PackageJson getANextPackage() { result.getDependencies().getADependency("next", _) }
 
-  bindingset[base, name]
-  pragma[inline_late]
-  private Folder getOptionalFolder(Folder base, string name) {
-    result = base.getFolder(name)
-    or
-    not exists(base.getFolder(name)) and
-    result = base
-  }
-
   private Folder packageRoot() { result = getANextPackage().getFile().getParentContainer() }
 
-  private Folder srcRoot() { result = getOptionalFolder(packageRoot(), "src") }
+  private Folder srcRoot() { result = [packageRoot(), packageRoot().getFolder("src")] }
 
   private Folder appRoot() { result = srcRoot().getFolder("app") }
 
@@ -32,20 +23,30 @@ module NextJS {
 
   private Folder apiRoot() { result = [pagesRoot(), appRoot()].getFolder("api") }
 
+  private Folder appFolder() {
+    result = appRoot()
+    or
+    result = appFolder().getAFolder()
+  }
+
+  private Folder pagesFolder() {
+    result = pagesRoot()
+    or
+    result = pagesFolder().getAFolder()
+  }
+
   /**
    * Gets a "pages" folder in a `Next.js` application.
    * JavaScript files inside these folders are mapped to routes.
    */
-  Folder getAPagesFolder() {
-    result = pagesRoot()
-    or
-    result = getAPagesFolder().getAFolder()
-  }
+  deprecated predicate getAPagesFolder = pagesFolder/0;
 
   /**
-   * Gets a module corrosponding to a `Next.js` page.
+   * Gets a module corresponding to a `Next.js` page.
    */
-  Module getAPagesModule() { result.getFile().getParentContainer() = getAPagesFolder() }
+  Module getAPagesModule() {
+    result.getFile() = [pagesFolder().getAFile(), appFolder().getJavaScriptFile("page")]
+  }
 
   /**
    * Gets a module inside a "pages" folder where `fallback` from `getStaticPaths` is not set to false.
@@ -300,11 +301,17 @@ module NextJS {
   class NextAppRouteHandler extends DataFlow::FunctionNode, Http::Servers::StandardRouteHandler {
     NextAppRouteHandler() {
       exists(Module mod |
-        mod.getFile().getParentContainer() = apiFolder() or
-        mod.getFile().getStem() = "middleware"
+        (
+          mod.getFile().getParentContainer() = apiFolder()
+          or
+          mod.getFile().getStem() = "middleware"
+          or
+          mod.getFile().getStem() = "route" and mod.getFile().getParentContainer() = appFolder()
+        )
       |
         this =
-          mod.getAnExportedValue([any(Http::RequestMethodName m), "middleware"]).getAFunctionValue()
+          mod.getAnExportedValue([any(Http::RequestMethodName m), "middleware", "proxy"])
+              .getAFunctionValue()
       )
     }