JS: implement getADataNode for SuperAgentUrlRequest

Esben Sparre Andreasen · Esben Sparre Andreasen · commit 3c07b4faf107 · 2018-10-16T08:51:32.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
@@ -239,7 +239,10 @@ private class SuperAgentUrlRequest extends CustomClientRequest {
   }
 
   override DataFlow::Node getADataNode() {
-    none()
+    exists (string name |
+      name = "set" or name = "send" or name = "query" |
+      result = this.getAChainedMethodCall(name).getAnArgument()
+    )
   }
 
 }
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest.expected
@@ -22,3 +22,8 @@
 | tst.js:59:5:59:52 | axios({ ... sData}) |
 | tst.js:61:5:61:60 | window. ... yData}) |
 | tst.js:63:5:63:68 | got(url ... yData}) |
+| tst.js:65:5:65:23 | superagent.get(url) |
+| tst.js:66:5:66:23 | superagent.get(url) |
+| tst.js:67:5:67:24 | superagent.post(url) |
+| tst.js:68:5:68:23 | superagent.get(url) |
+| tst.js:69:5:69:23 | superagent.get(url) |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getADataNode.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getADataNode.expected
@@ -7,3 +7,11 @@
 | tst.js:61:5:61:60 | window. ... yData}) | tst.js:61:51:61:58 | bodyData |
 | tst.js:63:5:63:68 | got(url ... yData}) | tst.js:63:24:63:33 | headerData |
 | tst.js:63:5:63:68 | got(url ... yData}) | tst.js:63:42:63:49 | bodyData |
+| tst.js:65:5:65:23 | superagent.get(url) | tst.js:65:31:65:34 | data |
+| tst.js:66:5:66:23 | superagent.get(url) | tst.js:66:29:66:31 | 'x' |
+| tst.js:66:5:66:23 | superagent.get(url) | tst.js:66:34:66:43 | headerData |
+| tst.js:67:5:67:24 | superagent.post(url) | tst.js:67:31:67:38 | bodyData |
+| tst.js:68:5:68:23 | superagent.get(url) | tst.js:68:29:68:31 | 'x' |
+| tst.js:68:5:68:23 | superagent.get(url) | tst.js:68:34:68:43 | headerData |
+| tst.js:68:5:68:23 | superagent.get(url) | tst.js:68:52:68:60 | queryData |
+| tst.js:69:5:69:23 | superagent.get(url) | tst.js:69:48:69:56 | queryData |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getUrl.expected b/javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequest_getUrl.expected
@@ -26,3 +26,8 @@
 | tst.js:59:5:59:52 | axios({ ... sData}) | tst.js:59:11:59:51 | {header ... msData} |
 | tst.js:61:5:61:60 | window. ... yData}) | tst.js:61:18:61:20 | url |
 | tst.js:63:5:63:68 | got(url ... yData}) | tst.js:63:9:63:11 | url |
+| tst.js:65:5:65:23 | superagent.get(url) | tst.js:65:20:65:22 | url |
+| tst.js:66:5:66:23 | superagent.get(url) | tst.js:66:20:66:22 | url |
+| tst.js:67:5:67:24 | superagent.post(url) | tst.js:67:21:67:23 | url |
+| tst.js:68:5:68:23 | superagent.get(url) | tst.js:68:20:68:22 | url |
+| tst.js:69:5:69:23 | superagent.get(url) | tst.js:69:20:69:22 | url |
diff --git a/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js b/javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js
@@ -62,4 +62,10 @@ import {ClientRequest, net} from 'electron';
 
     got(url, {headers: headerData, body: bodyData, quer: queryData});
 
+    superagent.get(url).query(data);
+    superagent.get(url).set('x', headerData)
+    superagent.post(url).send(bodyData);
+    superagent.get(url).set('x', headerData).query(queryData);
+    superagent.get(url).unknown(nonData).query(queryData);
+
 });

Original file line number	Diff line number	Diff line change
`@@ -239,7 +239,10 @@ private class SuperAgentUrlRequest extends CustomClientRequest {`
`239`	`239`	`}`
`240`	`240`
`241`	`241`	`override DataFlow::Node getADataNode() {`
`242`		`- none()`
	`242`	`+ exists (string name \|`
	`243`	`+ name = "set" or name = "send" or name = "query" \|`
	`244`	`+ result = this.getAChainedMethodCall(name).getAnArgument()`
	`245`	`+ )`
`243`	`246`	`}`
`244`	`247`
`245`	`248`	`}`