JS: Support Argument[this] token

asgerf · asgerf · commit 95122b2b6ca3 · 2022-03-23T18:06:12.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll
@@ -133,6 +133,10 @@ bindingset[token]
 API::Node getExtraSuccessorFromInvoke(API::InvokeNode node, AccessPathToken token) {
   token.getName() = "Instance" and
   result = node.getInstance()
+  or
+  token.getName() = "Argument" and
+  token.getAnArgument() = "this" and
+  result.getARhs() = node.(DataFlow::CallNode).getReceiver()
 }
 
 /**
diff --git a/javascript/ql/test/library-tests/frameworks/data/test.expected b/javascript/ql/test/library-tests/frameworks/data/test.expected
@@ -33,6 +33,8 @@ taintFlow
 | test.js:95:17:95:24 | source() | test.js:95:17:95:24 | source() |
 | test.js:96:17:96:24 | source() | test.js:96:17:96:24 | source() |
 | test.js:97:17:97:24 | source() | test.js:97:17:97:24 | source() |
+| test.js:102:16:102:34 | testlib.getSource() | test.js:103:8:103:13 | source |
+| test.js:102:16:102:34 | testlib.getSource() | test.js:104:8:104:24 | source.continue() |
 isSink
 | test.js:54:18:54:25 | source() | test-sink |
 | test.js:55:22:55:29 | source() | test-sink |
diff --git a/javascript/ql/test/library-tests/frameworks/data/test.js b/javascript/ql/test/library-tests/frameworks/data/test.js
@@ -97,3 +97,10 @@ function testSinks() {
   testlib.sink3(source()); // NOT OK
   testlib.sink4(source()); // OK
 }
+
+function testFlowThroughReceiver() {
+  let source = testlib.getSource();
+  sink(source); // NOT OK
+  sink(source.continue()); // NOT OK
+  sink(source.blah()); // OK
+}
diff --git a/javascript/ql/test/library-tests/frameworks/data/test.ql b/javascript/ql/test/library-tests/frameworks/data/test.ql
@@ -12,7 +12,8 @@ class Steps extends ModelInput::SummaryModelCsv {
         "testlib;;Member[taintIntoCallbackThis];Argument[0];Argument[1..2].Parameter[this];taint",
         "testlib;;Member[preserveArgZeroAndTwo];Argument[0,2];ReturnValue;taint",
         "testlib;;Member[preserveAllButFirstArgument];Argument[1..];ReturnValue;taint",
-        "testlib;;Member[preserveAllIfCall].Call;Argument[0..];ReturnValue;taint"
+        "testlib;;Member[preserveAllIfCall].Call;Argument[0..];ReturnValue;taint",
+        "testlib;;Member[getSource].ReturnValue.Member[continue];Argument[this];ReturnValue;taint",
       ]
   }
 }
@@ -36,11 +37,19 @@ class Sinks extends ModelInput::SinkModelCsv {
   }
 }
 
+class Sources extends ModelInput::SourceModelCsv {
+  override predicate row(string row) {
+    row = "testlib;;Member[getSource].ReturnValue;test-source"
+  }
+}
+
 class BasicTaintTracking extends TaintTracking::Configuration {
   BasicTaintTracking() { this = "BasicTaintTracking" }
 
   override predicate isSource(DataFlow::Node source) {
     source.(DataFlow::CallNode).getCalleeName() = "source"
+    or
+    source = ModelOutput::getASourceNode("test-source").getAnImmediateUse()
   }
 
   override predicate isSink(DataFlow::Node sink) {

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,8 @@ class Steps extends ModelInput::SummaryModelCsv {`
`12`	`12`	`"testlib;;Member[taintIntoCallbackThis];Argument[0];Argument[1..2].Parameter[this];taint",`
`13`	`13`	`"testlib;;Member[preserveArgZeroAndTwo];Argument[0,2];ReturnValue;taint",`
`14`	`14`	`"testlib;;Member[preserveAllButFirstArgument];Argument[1..];ReturnValue;taint",`
`15`		`- "testlib;;Member[preserveAllIfCall].Call;Argument[0..];ReturnValue;taint"`
	`15`	`+ "testlib;;Member[preserveAllIfCall].Call;Argument[0..];ReturnValue;taint",`
	`16`	`+ "testlib;;Member[getSource].ReturnValue.Member[continue];Argument[this];ReturnValue;taint",`
`16`	`17`	`]`
`17`	`18`	`}`
`18`	`19`	`}`
`@@ -36,11 +37,19 @@ class Sinks extends ModelInput::SinkModelCsv {`
`36`	`37`	`}`
`37`	`38`	`}`
`38`	`39`
	`40`	`+class Sources extends ModelInput::SourceModelCsv {`
	`41`	`+ override predicate row(string row) {`
	`42`	`+ row = "testlib;;Member[getSource].ReturnValue;test-source"`
	`43`	`+ }`
	`44`	`+}`
	`45`	`+`
`39`	`46`	`class BasicTaintTracking extends TaintTracking::Configuration {`
`40`	`47`	`BasicTaintTracking() { this = "BasicTaintTracking" }`
`41`	`48`
`42`	`49`	`override predicate isSource(DataFlow::Node source) {`
`43`	`50`	`source.(DataFlow::CallNode).getCalleeName() = "source"`
	`51`	`+ or`
	`52`	`+ source = ModelOutput::getASourceNode("test-source").getAnImmediateUse()`
`44`	`53`	`}`
`45`	`54`
`46`	`55`	`override predicate isSink(DataFlow::Node sink) {`