hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

JavaScript: Replace remaining uses of TrackedExpr with type tracking.

Browse Source
This commit is contained in:
Max Schaefer
2019-06-28 09:21:41 +01:00
parent 0d4ff2d7fe
commit ff62c56df1
3 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
javascript/ql/src/semmle/javascript/frameworks/Express.qll
View File

@@ -657,7 +657,7 @@ module Express {
/**
* An Express server application.
*/
private class Application extends HTTP::ServerDefinition, DataFlow::TrackedExpr {
private class Application extends HTTP::ServerDefinition {
Application() { this = appCreation().asExpr() }
/**
@@ -671,9 +671,23 @@ module Express {
/**
* An Express router.
*/
class RouterDefinition extends InvokeExpr, DataFlow::TrackedExpr {
class RouterDefinition extends InvokeExpr {
RouterDefinition() { this = routerCreation().asExpr() }
private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
t.start() and
result = DataFlow::exprNode(this)
or
exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
}
/**
* Holds if `sink` may refer to this router.
*/
predicate flowsTo(Expr sink) {
ref(DataFlow::TypeTracker::end()).flowsToExpr(sink)
}
/**
* Gets a `RouteSetup` that was used for setting up a route on this router.
*/

14
javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
View File

@@ -248,8 +248,20 @@ module HTTP {
/**
* A standard server definition.
*/
abstract class StandardServerDefinition extends ServerDefinition, DataFlow::TrackedExpr {
abstract class StandardServerDefinition extends ServerDefinition {
override RouteHandler getARouteHandler() { result.(StandardRouteHandler).getServer() = this }
private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
t.start() and
result = DataFlow::exprNode(this)
or
exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
}
/**
* Holds if `sink` may refer to this server definition.
*/
predicate flowsTo(Expr sink) { ref(DataFlow::TypeTracker::end()).flowsToExpr(sink) }
}
/**

3
javascript/ql/src/semmle/javascript/frameworks/Restify.qll
View File

@@ -9,8 +9,7 @@ module Restify {
/**
* An expression that creates a new Restify server.
*/
class ServerDefinition extends HTTP::Servers::StandardServerDefinition, CallExpr,
DataFlow::TrackedExpr {
class ServerDefinition extends HTTP::Servers::StandardServerDefinition, CallExpr {
ServerDefinition() {
// `server = restify.createServer()`
this = DataFlow::moduleMember("restify", "createServer").getACall().asExpr()