JS: replace HTTP::RequestBody with ClientRequest.getADataNode

Esben Sparre Andreasen · Esben Sparre Andreasen · commit 4e4597a24d1f · 2018-10-10T12:12:54.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll b/javascript/ql/src/semmle/javascript/frameworks/ClientRequests.qll
@@ -106,7 +106,7 @@ private class RequestUrlRequest extends CustomClientRequest {
   }
 
   override DataFlow::Node getADataNode() {
-    none()
+    result = getArgument(1)
   }
 
 }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll b/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll
@@ -132,11 +132,6 @@ module HTTP {
     result = "http" or result = "https"
   }
 
-  /**
-   * An expression whose value is sent as (part of) the body of an HTTP request (POST, PUT).
-   */
-  abstract class RequestBody extends DataFlow::Node {}
-  
   /**
    * An expression whose value is sent as (part of) the body of an HTTP response.
    */
diff --git a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
@@ -775,7 +775,7 @@ module NodeJSLib {
     }
 
     override DataFlow::Node getADataNode() {
-      none()
+      result = getAMethodCall("write").getArgument(0)
     }
 
   }
@@ -811,18 +811,6 @@ module NodeJSLib {
       result = "http.request data parameter"
     }
   }
-  
-  /**
-   * An argument to client request.write () method, can be used to write body to a HTTP or HTTPS POST/PUT request, 
-   * or request option (like headers, cookies, even url) 
-   */
-  class HttpRequestWriteArgument extends HTTP::RequestBody, DataFlow::Node {
-    HttpRequestWriteArgument () {
-      exists(CustomClientRequest req |
-        this = req.getAMethodCall("write").getArgument(0) or
-        this = req.getArgument(0))
-    }
-  }
 
  /**
    * A data flow node that is registered as a callback for an HTTP or HTTPS request made by a Node.js process, for example the function `handler` in `http.request(url).on(message, handler)`.
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Request.qll b/javascript/ql/src/semmle/javascript/frameworks/Request.qll
@@ -44,13 +44,5 @@ module Request {
     }
 
   }
-  
-  // using 'request' library to make http 'POST' and 'PUT' requests with message body. 
-  private class RequestPostBody extends HTTP::RequestBody {
-      RequestPostBody () {
-          this = DataFlow::moduleMember("request", "post").getACall().getArgument(1) or
-          this = DataFlow::moduleImport("request").getAnInvocation().getArgument(0)
-      }
-  }
 
 }
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/FileAccessToHttp.qll b/javascript/ql/src/semmle/javascript/security/dataflow/FileAccessToHttp.qll
@@ -62,10 +62,15 @@ module FileAccessToHttpDataFlow {
     }
   }
 
-  /** Sink is any parameter or argument that evaluates to a parameter ot a function or call that sets Http Body on a request */ 
-  private class HttpRequestBodyAsSink extends Sink {
-    HttpRequestBodyAsSink () {
-      this instanceof HTTP::RequestBody
+  /**
+   * The URL or data of a client request, viewed as a sink.
+   */
+  private class ClientRequestUrlOrDataAsSink extends Sink {
+    ClientRequestUrlOrDataAsSink () {
+      exists (ClientRequest req |
+        this = req.getUrl() or
+        this = req.getADataNode()
+      )
     }
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ private class RequestUrlRequest extends CustomClientRequest {`
`106`	`106`	`}`
`107`	`107`
`108`	`108`	`override DataFlow::Node getADataNode() {`
`109`		`- none()`
	`109`	`+ result = getArgument(1)`
`110`	`110`	`}`
`111`	`111`
`112`	`112`	`}`
Original file line number	Diff line number	Diff line change
`@@ -775,7 +775,7 @@ module NodeJSLib {`
`775`	`775`	`}`
`776`	`776`
`777`	`777`	`override DataFlow::Node getADataNode() {`
`778`		`- none()`
	`778`	`+ result = getAMethodCall("write").getArgument(0)`
`779`	`779`	`}`
`780`	`780`
`781`	`781`	`}`
`@@ -811,18 +811,6 @@ module NodeJSLib {`
`811`	`811`	`result = "http.request data parameter"`
`812`	`812`	`}`
`813`	`813`	`}`
`814`		`-`
`815`		`- /**`
`816`		`- * An argument to client request.write () method, can be used to write body to a HTTP or HTTPS POST/PUT request,`
`817`		`- * or request option (like headers, cookies, even url)`
`818`		`- */`
`819`		`- class HttpRequestWriteArgument extends HTTP::RequestBody, DataFlow::Node {`
`820`		`- HttpRequestWriteArgument () {`
`821`		`- exists(CustomClientRequest req \|`
`822`		`- this = req.getAMethodCall("write").getArgument(0) or`
`823`		`- this = req.getArgument(0))`
`824`		`- }`
`825`		`- }`
`826`	`814`
`827`	`815`	`/**`
`828`	`816`	* A data flow node that is registered as a callback for an HTTP or HTTPS request made by a Node.js process, for example the function `handler` in `http.request(url).on(message, handler)`.
Original file line number	Diff line number	Diff line change
`@@ -44,13 +44,5 @@ module Request {`
`44`	`44`	`}`
`45`	`45`
`46`	`46`	`}`
`47`		`-`
`48`		`- // using 'request' library to make http 'POST' and 'PUT' requests with message body.`
`49`		`- private class RequestPostBody extends HTTP::RequestBody {`
`50`		`- RequestPostBody () {`
`51`		`- this = DataFlow::moduleMember("request", "post").getACall().getArgument(1) or`
`52`		`- this = DataFlow::moduleImport("request").getAnInvocation().getArgument(0)`
`53`		`- }`
`54`		`- }`
`55`	`47`
`56`	`48`	`}`
Original file line number	Diff line number	Diff line change
`@@ -62,10 +62,15 @@ module FileAccessToHttpDataFlow {`
`62`	`62`	`}`
`63`	`63`	`}`
`64`	`64`
`65`		`- /** Sink is any parameter or argument that evaluates to a parameter ot a function or call that sets Http Body on a request */`
`66`		`- private class HttpRequestBodyAsSink extends Sink {`
`67`		`- HttpRequestBodyAsSink () {`
`68`		`- this instanceof HTTP::RequestBody`
	`65`	`+ /**`
	`66`	`+ * The URL or data of a client request, viewed as a sink.`
	`67`	`+ */`
	`68`	`+ private class ClientRequestUrlOrDataAsSink extends Sink {`
	`69`	`+ ClientRequestUrlOrDataAsSink () {`
	`70`	`+ exists (ClientRequest req \|`
	`71`	`+ this = req.getUrl() or`
	`72`	`+ this = req.getADataNode()`
	`73`	`+ )`
`69`	`74`	`}`
`70`	`75`	`}`
`71`	`76`	`}`