Added step through yargs/yargs constructor and chained methods.

javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll

@@ -87,11 +87,18 @@ private class ArgsParseStep extends TaintTracking::SharedTaintStep {
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     exists(DataFlow::CallNode call |
       call = DataFlow::moduleMember("args", "parse").getACall() or
-      call = DataFlow::moduleImport(["yargs-parser", "minimist", "subarg"]).getACall()
+      call =
+        DataFlow::moduleImport(["yargs-parser", "minimist", "subarg", "yargs/yargs", "yargs"])
+            .getACall()
     |
       succ = call and
       pred = call.getArgument(0)
     )
+    or
+    exists(DataFlow::MethodCallNode methodCall | methodCall = yargs() |
+      pred = methodCall.getReceiver() and
+      succ = methodCall
+    )
   }
 }
 
@@ -115,7 +122,9 @@ private API::Node commander() {
  * Either directly imported as a module, or through some chained method call.
  */
 private DataFlow::SourceNode yargs() {
-  result = DataFlow::moduleImport("yargs")
+  result = DataFlow::moduleImport(["yargs", "yargs/yargs"])
+  or
+  result = DataFlow::moduleImport(["yargs", "yargs/yargs"]).getACall()
   or
   // script used to generate list of chained methods: https://gist.github.com/erik-krogh/f8afe952c0577f4b563a993e613269ba
   exists(string method |

javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/CommandInjection.expected

@@ -21,6 +21,7 @@
 | child_process-test.js:75:29:75:31 | cmd | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:75:29:75:31 | cmd | This command line depends on a $@. | child_process-test.js:73:25:73:31 | req.url | user-provided value |
 | child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | child_process-test.js:83:19:83:36 | req.query.fileName | This command line depends on a $@. | child_process-test.js:83:19:83:36 | req.query.fileName | user-provided value |
 | child_process-test.js:94:11:94:35 | "ping " ... ms.host | child_process-test.js:94:21:94:30 | ctx.params | child_process-test.js:94:11:94:35 | "ping " ... ms.host | This command line depends on a $@. | child_process-test.js:94:21:94:30 | ctx.params | user-provided value |
+| command-line-libs.js:40:8:40:17 | parsed.cmd | command-line-libs.js:33:16:33:23 | req.body | command-line-libs.js:40:8:40:17 | parsed.cmd | This command line depends on a $@. | command-line-libs.js:33:16:33:23 | req.body | user-provided value |
 | exec-sh2.js:10:12:10:57 | cp.spaw ... ptions) | exec-sh2.js:14:25:14:31 | req.url | exec-sh2.js:10:40:10:46 | command | This command line depends on a $@. | exec-sh2.js:14:25:14:31 | req.url | user-provided value |
 | exec-sh.js:15:12:15:61 | cp.spaw ... ptions) | exec-sh.js:19:25:19:31 | req.url | exec-sh.js:15:44:15:50 | command | This command line depends on a $@. | exec-sh.js:19:25:19:31 | req.url | user-provided value |
 | execSeries.js:14:41:14:47 | command | execSeries.js:18:34:18:40 | req.url | execSeries.js:14:41:14:47 | command | This command line depends on a $@. | execSeries.js:18:34:18:40 | req.url | user-provided value |
@@ -116,6 +117,14 @@ edges
 | child_process-test.js:73:15:73:38 | url.par ... , true) | child_process-test.js:73:9:73:49 | cmd | provenance |  |
 | child_process-test.js:73:25:73:31 | req.url | child_process-test.js:73:15:73:38 | url.par ... , true) | provenance |  |
 | child_process-test.js:94:21:94:30 | ctx.params | child_process-test.js:94:11:94:35 | "ping " ... ms.host | provenance |  |
+| command-line-libs.js:33:9:33:34 | args | command-line-libs.js:34:24:34:27 | args | provenance |  |
+| command-line-libs.js:33:16:33:23 | req.body | command-line-libs.js:33:9:33:34 | args | provenance |  |
+| command-line-libs.js:34:9:38:12 | parsed | command-line-libs.js:40:8:40:13 | parsed | provenance |  |
+| command-line-libs.js:34:18:34:28 | yargs(args) | command-line-libs.js:34:18:38:4 | yargs(a ... ue\\n  }) | provenance |  |
+| command-line-libs.js:34:18:38:4 | yargs(a ... ue\\n  }) | command-line-libs.js:34:18:38:12 | yargs(a ... parse() | provenance |  |
+| command-line-libs.js:34:18:38:12 | yargs(a ... parse() | command-line-libs.js:34:9:38:12 | parsed | provenance |  |
+| command-line-libs.js:34:24:34:27 | args | command-line-libs.js:34:18:34:28 | yargs(args) | provenance |  |
+| command-line-libs.js:40:8:40:13 | parsed | command-line-libs.js:40:8:40:17 | parsed.cmd | provenance |  |
 | exec-sh2.js:9:17:9:23 | command | exec-sh2.js:10:40:10:46 | command | provenance |  |
 | exec-sh2.js:14:9:14:49 | cmd | exec-sh2.js:15:12:15:14 | cmd | provenance |  |
 | exec-sh2.js:14:15:14:38 | url.par ... , true) | exec-sh2.js:14:9:14:49 | cmd | provenance |  |
@@ -269,6 +278,15 @@ nodes
 | child_process-test.js:83:19:83:36 | req.query.fileName | semmle.label | req.query.fileName |
 | child_process-test.js:94:11:94:35 | "ping " ... ms.host | semmle.label | "ping " ... ms.host |
 | child_process-test.js:94:21:94:30 | ctx.params | semmle.label | ctx.params |
+| command-line-libs.js:33:9:33:34 | args | semmle.label | args |
+| command-line-libs.js:33:16:33:23 | req.body | semmle.label | req.body |
+| command-line-libs.js:34:9:38:12 | parsed | semmle.label | parsed |
+| command-line-libs.js:34:18:34:28 | yargs(args) | semmle.label | yargs(args) |
+| command-line-libs.js:34:18:38:4 | yargs(a ... ue\\n  }) | semmle.label | yargs(a ... ue\\n  }) |
+| command-line-libs.js:34:18:38:12 | yargs(a ... parse() | semmle.label | yargs(a ... parse() |
+| command-line-libs.js:34:24:34:27 | args | semmle.label | args |
+| command-line-libs.js:40:8:40:13 | parsed | semmle.label | parsed |
+| command-line-libs.js:40:8:40:17 | parsed.cmd | semmle.label | parsed.cmd |
 | exec-sh2.js:9:17:9:23 | command | semmle.label | command |
 | exec-sh2.js:10:40:10:46 | command | semmle.label | command |
 | exec-sh2.js:14:9:14:49 | cmd | semmle.label | cmd |

javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/command-line-libs.js

@@ -30,12 +30,12 @@ app.post('/commandLineArgs', (req, res) => {
 
 app.post('/yargs', (req, res) => {
   const yargs = require('yargs/yargs');
-  const args = req.body.args || []; // $ MISSING: Source
+  const args = req.body.args || []; // $ Source
   const parsed = yargs(args).option('cmd', {
     type: 'string',
     describe: 'Command to execute',
     demandOption: true
   }).parse();
 
-  exec(parsed.cmd); // $ MISSING: Alert
+  exec(parsed.cmd); // $ Alert
 });