JS: Expose argumentPassing as DataFlow::argumentPassingStep

asgerf · asgerf · commit 3ccdaa94adef · 2020-02-04T15:06:45.000Z
diff --git a/javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql b/javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql
@@ -180,8 +180,8 @@ predicate dynamicPropReadStep(Node base, Node key, SourceNode output) {
     keyParam.flowsTo(innerKey) and
     innerOutput.flowsTo(callee.getAReturnedExpr().flow()) and
     call.getACallee() = callee and
-    argumentPassing(call, base, callee, baseParam) and
-    argumentPassing(call, key, callee, keyParam) and
+    argumentPassingStep(call, base, callee, baseParam) and
+    argumentPassingStep(call, key, callee, keyParam) and
     output = call
   )
 }
@@ -198,12 +198,12 @@ predicate isEnumeratedPropName(Node node) {
   |
     node = pred.getASuccessor()
     or
-    argumentPassing(_, pred, _, node)
+    argumentPassingStep(_, pred, _, node)
     or
     // Handle one level of callbacks
     exists(FunctionNode function, ParameterNode callback, int i |
       pred = callback.getAnInvocation().getArgument(i) and
-      argumentPassing(_, function, _, callback) and
+      argumentPassingStep(_, function, _, callback) and
       node = function.getParameter(i)
     )
   )
@@ -223,7 +223,7 @@ predicate isPotentiallyObjectPrototype(SourceNode node) {
   exists(Node use |
     isPotentiallyObjectPrototype(use.getALocalSource())
   |
-    argumentPassing(_, use, _, node)
+    argumentPassingStep(_, use, _, node)
   )
 }
 
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -20,6 +20,7 @@
 
 import javascript
 private import internal.CallGraphs
+private import internal.FlowSteps as FlowSteps
 
 module DataFlow {
   cached
@@ -1470,6 +1471,8 @@ module DataFlow {
     )
   }
 
+  predicate argumentPassingStep = FlowSteps::argumentPassing/4;
+
   /**
    * Gets the data flow node representing the source of definition `def`, taking
    * flow through IIFE calls into account.

Original file line number	Diff line number	Diff line change
`@@ -180,8 +180,8 @@ predicate dynamicPropReadStep(Node base, Node key, SourceNode output) {`
`180`	`180`	`keyParam.flowsTo(innerKey) and`
`181`	`181`	`innerOutput.flowsTo(callee.getAReturnedExpr().flow()) and`
`182`	`182`	`call.getACallee() = callee and`
`183`		`- argumentPassing(call, base, callee, baseParam) and`
`184`		`- argumentPassing(call, key, callee, keyParam) and`
	`183`	`+ argumentPassingStep(call, base, callee, baseParam) and`
	`184`	`+ argumentPassingStep(call, key, callee, keyParam) and`
`185`	`185`	`output = call`
`186`	`186`	`)`
`187`	`187`	`}`
`@@ -198,12 +198,12 @@ predicate isEnumeratedPropName(Node node) {`
`198`	`198`	`\|`
`199`	`199`	`node = pred.getASuccessor()`
`200`	`200`	`or`
`201`		`- argumentPassing(_, pred, _, node)`
	`201`	`+ argumentPassingStep(_, pred, _, node)`
`202`	`202`	`or`
`203`	`203`	`// Handle one level of callbacks`
`204`	`204`	`exists(FunctionNode function, ParameterNode callback, int i \|`
`205`	`205`	`pred = callback.getAnInvocation().getArgument(i) and`
`206`		`- argumentPassing(_, function, _, callback) and`
	`206`	`+ argumentPassingStep(_, function, _, callback) and`
`207`	`207`	`node = function.getParameter(i)`
`208`	`208`	`)`
`209`	`209`	`)`
`@@ -223,7 +223,7 @@ predicate isPotentiallyObjectPrototype(SourceNode node) {`
`223`	`223`	`exists(Node use \|`
`224`	`224`	`isPotentiallyObjectPrototype(use.getALocalSource())`
`225`	`225`	`\|`
`226`		`- argumentPassing(_, use, _, node)`
	`226`	`+ argumentPassingStep(_, use, _, node)`
`227`	`227`	`)`
`228`	`228`	`}`
`229`	`229`
Original file line number	Diff line number	Diff line change
`@@ -20,6 +20,7 @@`
`20`	`20`
`21`	`21`	`import javascript`
`22`	`22`	`private import internal.CallGraphs`
	`23`	`+private import internal.FlowSteps as FlowSteps`
`23`	`24`
`24`	`25`	`module DataFlow {`
`25`	`26`	`cached`
`@@ -1470,6 +1471,8 @@ module DataFlow {`
`1470`	`1471`	`)`
`1471`	`1472`	`}`
`1472`	`1473`
	`1474`	`+ predicate argumentPassingStep = FlowSteps::argumentPassing/4;`
	`1475`	`+`
`1473`	`1476`	`/**`
`1474`	`1477`	* Gets the data flow node representing the source of definition `def`, taking
`1475`	`1478`	`* flow through IIFE calls into account.`