add support for the json5 library

erik-krogh · erik-krogh · commit 0bfff1eb7e99 · 2021-07-12T10:51:42.000+02:00
diff --git a/javascript/change-notes/2021-06-24-json.md b/javascript/change-notes/2021-06-24-json.md
@@ -1,4 +1,5 @@
 lgtm,codescanning
 * The dataflow libraries now model dataflow through more JSON utility libraries.
   Affected packages are
-    [json2csv](https://npmjs.com/package/json2csv)
+    [json2csv](https://npmjs.com/package/json2csv),
+    [json5](https://npmjs.com/package/json5)
diff --git a/javascript/ql/src/semmle/javascript/JsonParsers.qll b/javascript/ql/src/semmle/javascript/JsonParsers.qll
@@ -26,6 +26,7 @@ private class PlainJsonParserCall extends JsonParserCall {
   PlainJsonParserCall() {
     exists(DataFlow::SourceNode callee | this = callee.getACall() |
       callee = DataFlow::globalVarRef("JSON").getAPropertyRead("parse") or
+      callee = DataFlow::moduleMember(["json3", "json5"], "parse") or
       callee = DataFlow::moduleImport("parse-json") or
       callee = DataFlow::moduleImport("json-parse-better-errors") or
       callee = DataFlow::moduleImport("json-safe-parse") or
diff --git a/javascript/ql/src/semmle/javascript/JsonStringifiers.qll b/javascript/ql/src/semmle/javascript/JsonStringifiers.qll
@@ -11,7 +11,7 @@ class JsonStringifyCall extends DataFlow::CallNode {
   JsonStringifyCall() {
     exists(DataFlow::SourceNode callee | this = callee.getACall() |
       callee = DataFlow::globalVarRef("JSON").getAPropertyRead("stringify") or
-      callee = DataFlow::moduleMember("json3", "stringify") or
+      callee = DataFlow::moduleMember(["json3", "json5"], "stringify") or
       callee =
         DataFlow::moduleImport([
             "json-stringify-safe", "json-stable-stringify", "stringify-object",
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -91,6 +91,7 @@ typeInferenceMismatch
 | json-stringify.js:2:16:2:23 | source() | json-stringify.js:17:8:17:39 | require ... source) |
 | json-stringify.js:2:16:2:23 | source() | json-stringify.js:18:8:18:40 | require ... source) |
 | json-stringify.js:2:16:2:23 | source() | json-stringify.js:21:8:21:46 | new jso ... source) |
+| json-stringify.js:2:16:2:23 | source() | json-stringify.js:24:8:24:43 | json5.s ... ource)) |
 | json-stringify.js:3:15:3:22 | source() | json-stringify.js:8:8:8:31 | jsonStr ... (taint) |
 | nested-props.js:4:13:4:20 | source() | nested-props.js:5:10:5:14 | obj.x |
 | nested-props.js:9:18:9:25 | source() | nested-props.js:10:10:10:16 | obj.x.y |
diff --git a/javascript/ql/test/library-tests/TaintTracking/json-stringify.js b/javascript/ql/test/library-tests/TaintTracking/json-stringify.js
@@ -19,4 +19,7 @@ function foo() {
   
   const json2csv = require('json2csv');
   sink(new json2csv.Parser(opts).parse(source)); // NOT OK
+
+  const json5 = require('json5');
+  sink(json5.stringify(json5.parse(source))); // NOT OK
 }

Original file line number	Diff line number	Diff line change
`@@ -19,4 +19,7 @@ function foo() {`
`19`	`19`
`20`	`20`	`const json2csv = require('json2csv');`
`21`	`21`	`sink(new json2csv.Parser(opts).parse(source)); // NOT OK`
	`22`	`+`
	`23`	`+ const json5 = require('json5');`
	`24`	`+ sink(json5.stringify(json5.parse(source))); // NOT OK`
`22`	`25`	`}`