support module.createRequire

erik-krogh · erik-krogh · commit 1e65ed222814 · 2020-08-18T14:43:03.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/NodeJS.qll b/javascript/ql/src/semmle/javascript/NodeJS.qll
@@ -162,6 +162,8 @@ private predicate isRequire(DataFlow::Node nd) {
   not nd.getFile().getExtension() = "mjs"
   or
   isRequire(nd.getAPredecessor())
+  or
+  nd = DataFlow::moduleMember("module", "createRequire").getACall()
 }
 
 /**
diff --git a/javascript/ql/test/library-tests/NodeJS/Require.expected b/javascript/ql/test/library-tests/NodeJS/Require.expected
@@ -15,6 +15,7 @@
 | g.js:1:43:1:61 | require("electron") |
 | index.js:1:12:1:26 | require('path') |
 | index.js:2:1:2:41 | require ... b.js")) |
+| mjs-files/createRequire.mjs:4:26:4:49 | require ... erver') |
 | mjs-files/require-from-js.js:1:12:1:36 | require ... on-me') |
 | mjs-files/require-from-js.js:2:12:2:39 | require ... me.js') |
 | mjs-files/require-from-js.js:3:12:3:40 | require ... e.mjs') |
diff --git a/javascript/ql/test/library-tests/NodeJS/mjs-files/createRequire.mjs b/javascript/ql/test/library-tests/NodeJS/mjs-files/createRequire.mjs
@@ -0,0 +1,4 @@
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { ApolloServer } = require('apollo-server');

Original file line number	Diff line number	Diff line change
`@@ -162,6 +162,8 @@ private predicate isRequire(DataFlow::Node nd) {`
`162`	`162`	`not nd.getFile().getExtension() = "mjs"`
`163`	`163`	`or`
`164`	`164`	`isRequire(nd.getAPredecessor())`
	`165`	`+ or`
	`166`	`+ nd = DataFlow::moduleMember("module", "createRequire").getACall()`
`165`	`167`	`}`
`166`	`168`
`167`	`169`	`/**`