Added experimental SockJS support

javascript/ql/src/experimental/SockJS/SockJS.qll

@@ -0,0 +1,48 @@
+/**
+ * Provides classes for working with [SockJS](http://sockjs.org).
+ */
+
+import javascript
+import DataFlow::PathGraph
+
+/**
+ * A model of the `SockJS` websocket data handler (https://sockjs.org).
+ */
+module SockJS {
+  class SourceFromSocketJS extends RemoteFlowSource {    
+    /**
+     * Access to user-controlled data object received from websocket 
+     * For example:
+     * ```
+     * server.on('connection', function(conn) {
+     *     conn.on('data', function(message) {
+     *       ...
+     *     });
+     *  }); 
+     * ```
+     */     
+    SourceFromSocketJS() {
+      exists(DataFlow::CallNode createServer,
+             DataFlow::CallNode connNode,
+             DataFlow::CallNode dataHandlerNode |
+        createServer = appCreation() and 
+        connNode = createServer.getAMethodCall("on") and
+        connNode.getArgument(0).getStringValue() = "connection" and                              
+        dataHandlerNode = connNode.getCallback(1).getParameter(0).getAMethodCall("on") and
+        dataHandlerNode.getArgument(0).getStringValue() = "data" and
+        this = dataHandlerNode.getCallback(1).getParameter(0)
+      )
+    }
+
+    override string getSourceType() { result = "input from SockJS WebSocket" }
+  }
+
+  /**
+   * Gets a new SockJS server.
+   */
+  private DataFlow::CallNode appCreation() {
+    result = DataFlow::moduleImport("sockjs").getAMemberCall("createServer")
+      or 
+    result = DataFlow::moduleMember("sockjs", "createServer")   
+  }
+}

javascript/ql/src/experimental/SockJS/examples/server.js

@@ -0,0 +1,16 @@
+const express = require('express');
+const http = require('http');
+const sockjs = require('sockjs');
+
+const app = express();
+const server = http.createServer(app);
+const sockjs_echo = sockjs.createServer({});
+sockjs_echo.on('connection', function(conn) {
+    conn.on('data', function(message) {
+        var data = JSON.parse(message);
+        conn.write(JSON.stringify(eval(data.test)));
+    });
+});
+
+sockjs_echo.installHandlers(server, {prefix:'/echo'});
+server.listen(9090, '127.0.0.1');