Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2104cf5

Browse files
author
Esben Sparre Andreasen
committed
JS: add models of URL requests
1 parent af3f855 commit 2104cf5

5 files changed

Lines changed: 187 additions & 0 deletions

File tree

‎javascript/ql/src/javascript.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ import semmle.javascript.frameworks.Request
7171
import semmle.javascript.frameworks.SQL
7272
import semmle.javascript.frameworks.StringFormatters
7373
import semmle.javascript.frameworks.UriLibraries
74+
import semmle.javascript.frameworks.UrlRequests
7475
import semmle.javascript.frameworks.XmlParsers
7576
import semmle.javascript.frameworks.xUnit
7677
import semmle.javascript.linters.ESLint

‎javascript/ql/src/semmle/javascript/frameworks/UrlRequests.qll‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
/**
2+
* Provides classes for modelling URL requests.
3+
*
4+
* Subclass `UrlRequest` to refine the behavior of the analysis on existing URL requests.
5+
* Subclass `CustomUrlRequest` to introduce new kinds of URL requests.
6+
*/
7+
8+
import javascript
9+
10+
/**
11+
* A call that performs a request to a URL.
12+
*/
13+
class CustomUrlRequest extends DataFlow::CallNode {
14+
15+
/**
16+
* Gets the URL of the request.
17+
*/
18+
abstract DataFlow::Node getUrl();
19+
}
20+
21+
/**
22+
* A call that performs a request to a URL.
23+
*/
24+
class UrlRequest extends DataFlow::CallNode {
25+
26+
CustomUrlRequest custom;
27+
28+
UrlRequest() {
29+
this = custom
30+
}
31+
32+
/**
33+
* Gets the URL of the request.
34+
*/
35+
DataFlow::Node getUrl() {
36+
result = custom.getUrl()
37+
}
38+
}
39+
40+
/**
41+
* A simple model of common URL request libraries.
42+
*/
43+
private class DefaultUrlRequest extends CustomUrlRequest {
44+
45+
DataFlow::Node url;
46+
47+
DefaultUrlRequest() {
48+
exists (string moduleName, DataFlow::SourceNode callee, string httpMethodName, string urlName |
49+
httpMethodName = any(HTTP::RequestMethodName m).toLowerCase() and
50+
(urlName = "url" or urlName = "uri") and // slightly over-approximate, in the name of simplicity
51+
this = callee.getACall() |
52+
(
53+
(
54+
moduleName = "request" or
55+
moduleName = "request-promise" or
56+
moduleName = "request-promise-any" or
57+
moduleName = "request-promise-native"
58+
) and
59+
(
60+
callee = DataFlow::moduleImport(moduleName) or
61+
callee = DataFlow::moduleMember(moduleName, httpMethodName)
62+
) and
63+
(
64+
url = getArgument(0) or
65+
url = getOptionArgument(0, urlName)
66+
)
67+
)
68+
or
69+
(
70+
moduleName = "superagent" and
71+
callee = DataFlow::moduleMember(moduleName, httpMethodName) and
72+
url = getArgument(0)
73+
)
74+
or
75+
(
76+
(moduleName = "http" or moduleName = "https") and
77+
callee = DataFlow::moduleMember(moduleName, httpMethodName) and
78+
url = getArgument(0)
79+
)
80+
or
81+
(
82+
moduleName = "axios" and
83+
(
84+
callee = DataFlow::moduleImport(moduleName) or
85+
callee = DataFlow::moduleMember(moduleName, httpMethodName) or
86+
callee = DataFlow::moduleMember(moduleName, "request")
87+
) and
88+
(
89+
url = getArgument(0) or
90+
url = getOptionArgument([0..2], urlName) // slightly over-approximate, in the name of simplicity
91+
)
92+
)
93+
or
94+
(
95+
moduleName = "got" and
96+
(
97+
callee = DataFlow::moduleImport(moduleName) or
98+
callee = DataFlow::moduleMember(moduleName, "stream")
99+
) and
100+
(
101+
url = getArgument(0) and not exists (getOptionArgument(1, "baseUrl"))
102+
)
103+
)
104+
or
105+
(
106+
(
107+
moduleName = "node-fetch" or
108+
moduleName = "cross-fetch" or
109+
moduleName = "isomorphic-fetch"
110+
) and
111+
callee = DataFlow::moduleImport(moduleName) and
112+
url = getArgument(0)
113+
)
114+
)
115+
or
116+
(
117+
this = DataFlow::globalVarRef("fetch").getACall() and
118+
url = getArgument(0)
119+
)
120+
121+
}
122+
123+
override DataFlow::Node getUrl() {
124+
result = url
125+
}
126+
127+
}

‎javascript/ql/test/library-tests/frameworks/UrlRequests/UrlRequest.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
| tst.js:11:5:11:16 | request(url) | tst.js:11:13:11:15 | url |
2+
| tst.js:13:5:13:20 | request.get(url) | tst.js:13:17:13:19 | url |
3+
| tst.js:15:5:15:23 | request.delete(url) | tst.js:15:20:15:22 | url |
4+
| tst.js:17:5:17:25 | request ... url }) | tst.js:17:13:17:24 | { url: url } |
5+
| tst.js:17:5:17:25 | request ... url }) | tst.js:17:20:17:22 | url |
6+
| tst.js:19:5:19:23 | requestPromise(url) | tst.js:19:20:19:22 | url |
7+
| tst.js:21:5:21:23 | superagent.get(url) | tst.js:21:20:21:22 | url |
8+
| tst.js:23:5:23:17 | http.get(url) | tst.js:23:14:23:16 | url |
9+
| tst.js:25:5:25:14 | axios(url) | tst.js:25:11:25:13 | url |
10+
| tst.js:27:5:27:18 | axios.get(url) | tst.js:27:15:27:17 | url |
11+
| tst.js:29:5:29:23 | axios({ url: url }) | tst.js:29:11:29:22 | { url: url } |
12+
| tst.js:29:5:29:23 | axios({ url: url }) | tst.js:29:18:29:20 | url |
13+
| tst.js:31:5:31:12 | got(url) | tst.js:31:9:31:11 | url |
14+
| tst.js:33:5:33:19 | got.stream(url) | tst.js:33:16:33:18 | url |
15+
| tst.js:35:5:35:21 | window.fetch(url) | tst.js:35:18:35:20 | url |
16+
| tst.js:37:5:37:18 | nodeFetch(url) | tst.js:37:15:37:17 | url |

‎javascript/ql/test/library-tests/frameworks/UrlRequests/UrlRequest.ql‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import javascript
2+
3+
from UrlRequest r
4+
select r, r.getUrl()

‎javascript/ql/test/library-tests/frameworks/UrlRequests/tst.js‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
import request from 'request';
2+
import requestPromise from 'request-promise';
3+
import superagent from 'superagent';
4+
import http from 'http';
5+
import express from 'express';
6+
import axios from 'axios';
7+
import got from 'got';
8+
import nodeFetch from 'node-fetch';
9+
10+
(function() {
11+
request(url);
12+
13+
request.get(url);
14+
15+
request.delete(url);
16+
17+
request({ url: url });
18+
19+
requestPromise(url);
20+
21+
superagent.get(url);
22+
23+
http.get(url);
24+
25+
axios(url);
26+
27+
axios.get(url);
28+
29+
axios({ url: url });
30+
31+
got(url);
32+
33+
got.stream(url);
34+
35+
window.fetch(url);
36+
37+
nodeFetch(url);
38+
39+
});

0 commit comments

Comments
 (0)