hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Move React steps into React library

Browse Source
This commit is contained in:
Asger Feldthaus
2020-03-30 15:45:07 +01:00
parent 6324c4f22a
commit e847043307
2 changed files with 43 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll
View File

@@ -582,49 +582,6 @@ module TaintTracking {
}
}
/**
* A taint propagating data flow edge for assignments of the form `c1.state.p = v`,
* where `c1` is an instance of React component `C`; in this case, we consider
* taint to flow from `v` to any read of `c2.state.p`, where `c2`
* also is an instance of `C`.
*/
private class ReactComponentStateTaintStep extends SharedTaintStep {
override predicate viewComponentStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(ReactComponent c, DataFlow::PropRead prn, DataFlow::PropWrite pwn |
(
c.getACandidateStateSource().flowsTo(pwn.getBase()) or
c.getADirectStateAccess().flowsTo(pwn.getBase())
) and
(
c.getAPreviousStateSource().flowsTo(prn.getBase()) or
c.getADirectStateAccess().flowsTo(prn.getBase())
)
|
prn.getPropertyName() = pwn.getPropertyName() and
succ = prn and
pred = pwn.getRhs()
)
}
}
/**
* A taint propagating data flow edge for assignments of the form `c1.props.p = v`,
* where `c1` is an instance of React component `C`; in this case, we consider
* taint to flow from `v` to any read of `c2.props.p`, where `c2`
* also is an instance of `C`.
*/
private class ReactComponentPropsTaintStep extends SharedTaintStep {
override predicate viewComponentStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(ReactComponent c, string name, DataFlow::PropRead prn |
prn = c.getAPropRead(name) or
prn = c.getAPreviousPropsSource().getAPropertyRead(name)
|
pred = c.getACandidatePropsValue(name) and
succ = prn
)
}
}
/**
* A taint propagating data flow edge arising from string concatenations.
*

43
javascript/ql/src/semmle/javascript/frameworks/React.qll
View File

@@ -795,3 +795,46 @@ private class HigherOrderComponentStep extends PreCallGraphStep {
)
}
}
/**
* A taint propagating data flow edge for assignments of the form `c1.state.p = v`,
* where `c1` is an instance of React component `C`; in this case, we consider
* taint to flow from `v` to any read of `c2.state.p`, where `c2`
* also is an instance of `C`.
*/
private class StateTaintStep extends TaintTracking::SharedTaintStep {
override predicate viewComponentStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(ReactComponent c, DataFlow::PropRead prn, DataFlow::PropWrite pwn |
(
c.getACandidateStateSource().flowsTo(pwn.getBase()) or
c.getADirectStateAccess().flowsTo(pwn.getBase())
) and
(
c.getAPreviousStateSource().flowsTo(prn.getBase()) or
c.getADirectStateAccess().flowsTo(prn.getBase())
)
|
prn.getPropertyName() = pwn.getPropertyName() and
succ = prn and
pred = pwn.getRhs()
)
}
}
/**
* A taint propagating data flow edge for assignments of the form `c1.props.p = v`,
* where `c1` is an instance of React component `C`; in this case, we consider
* taint to flow from `v` to any read of `c2.props.p`, where `c2`
* also is an instance of `C`.
*/
private class PropsTaintStep extends TaintTracking::SharedTaintStep {
override predicate viewComponentStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(ReactComponent c, string name, DataFlow::PropRead prn |
prn = c.getAPropRead(name) or
prn = c.getAPreviousPropsSource().getAPropertyRead(name)
|
pred = c.getACandidatePropsValue(name) and
succ = prn
)
}
}