JS: Fix lurking cartesian product in Express

asger-semmle · asger-semmle · commit 8fe2319a2397 · 2019-05-15T18:07:24.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Express.qll b/javascript/ql/src/semmle/javascript/frameworks/Express.qll
@@ -415,9 +415,6 @@ module Express {
           )
         )
         or
-        kind = "body" and
-        this.asExpr() = rh.getARequestBodyAccess()
-        or
         exists(string propName |
           // `req.url` or `req.originalUrl`
           kind = "url" and
@@ -432,6 +429,9 @@ module Express {
         this.(DataFlow::PropRef).accesses(request, "cookies")
       )
       or
+      kind = "body" and
+      this.asExpr() = rh.getARequestBodyAccess()
+      or
       exists(RequestHeaderAccess access | this = access |
         rh = access.getRouteHandler() and
         kind = "header"

Original file line number	Diff line number	Diff line change
`@@ -415,9 +415,6 @@ module Express {`
`415`	`415`	`)`
`416`	`416`	`)`
`417`	`417`	`or`
`418`		`- kind = "body" and`
`419`		`- this.asExpr() = rh.getARequestBodyAccess()`
`420`		`- or`
`421`	`418`	`exists(string propName \|`
`422`	`419`	// `req.url` or `req.originalUrl`
`423`	`420`	`kind = "url" and`
`@@ -432,6 +429,9 @@ module Express {`
`432`	`429`	`this.(DataFlow::PropRef).accesses(request, "cookies")`
`433`	`430`	`)`
`434`	`431`	`or`
	`432`	`+ kind = "body" and`
	`433`	`+ this.asExpr() = rh.getARequestBodyAccess()`
	`434`	`+ or`
`435`	`435`	`exists(RequestHeaderAccess access \| this = access \|`
`436`	`436`	`rh = access.getRouteHandler() and`
`437`	`437`	`kind = "header"`