Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a03e6a8

Browse files
erik-krogherik-krogh
committed
deprecate the HTTP flowsTo predicates to avoid confusion with SourceNode::flowsTo 
1 parent b38ad13 commit a03e6a8

8 files changed

Lines changed: 23 additions & 18 deletions

File tree

‎javascript/ql/lib/semmle/javascript/frameworks/Connect.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ module Connect {
6666
getMethodName() = "use" and
6767
(
6868
// app.use(fun)
69-
server.flowsTo(getReceiver())
69+
server.ref().flowsToExpr(getReceiver())
7070
or
7171
// app.use(...).use(fun)
7272
this.getReceiver().(RouteSetup).getServer() = server

‎javascript/ql/lib/semmle/javascript/frameworks/Express.qll‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ module Express {
4343
/**
4444
* Holds if `e` may refer to the given `router` object.
4545
*/
46-
private predicate isRouter(Expr e, RouterDefinition router) { router.flowsTo(e) }
46+
private predicate isRouter(Expr e, RouterDefinition router) { router.ref().flowsToExpr(e) } // TODO: DataFlow::Node
4747

4848
/**
4949
* Holds if `e` may refer to a router object.
@@ -853,21 +853,24 @@ module Express {
853853
DataFlow::SourceNode ref() { result = this.ref(DataFlow::TypeTracker::end()) }
854854

855855
/**
856+
* DEPRECATED: Use `ref().flowsToExpr()` instead.
856857
* Holds if `sink` may refer to this router.
857858
*/
858-
predicate flowsTo(Expr sink) { this.ref().flowsToExpr(sink) }
859+
deprecated predicate flowsTo(Expr sink) { this.ref().flowsToExpr(sink) }
859860

860861
/**
861862
* Gets a `RouteSetup` that was used for setting up a route on this router.
862863
*/
863-
private RouteSetup getARouteSetup() { this.flowsTo(result.getReceiver()) }
864+
private RouteSetup getARouteSetup() { this.ref().flowsToExpr(result.getReceiver()) }
864865

865866
/**
866867
* Gets a sub-router registered on this router.
867868
*
868869
* Example: `router2` for `router1.use(router2)` or `router1.use("/route2", router2)`
869870
*/
870-
RouterDefinition getASubRouter() { result.flowsTo(this.getARouteSetup().getAnArgument()) }
871+
RouterDefinition getASubRouter() {
872+
result.ref().flowsToExpr(this.getARouteSetup().getAnArgument())
873+
}
871874

872875
/**
873876
* Gets a route handler registered on this router.

‎javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,10 +272,14 @@ module HTTP {
272272
exists(DataFlow::TypeTracker t2 | result = this.ref(t2).track(t2, t))
273273
}
274274

275+
/** Gets a data flow node referring to this server. */
276+
DataFlow::SourceNode ref() { result = this.ref(DataFlow::TypeTracker::end()) }
277+
275278
/**
279+
* DEPRECATED: Use `ref().flowsToExpr()` instead.
276280
* Holds if `sink` may refer to this server definition.
277281
*/
278-
predicate flowsTo(Expr sink) { this.ref(DataFlow::TypeTracker::end()).flowsToExpr(sink) }
282+
deprecated predicate flowsTo(Expr sink) { this.ref().flowsToExpr(sink) }
279283
}
280284

281285
/**

‎javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ module Hapi {
189189
Expr handler;
190190

191191
RouteSetup() {
192-
server.flowsTo(getReceiver()) and
192+
server.ref().flowsToExpr(getReceiver()) and
193193
(
194194
// server.route({ handler: fun })
195195
getMethodName() = "route" and

‎javascript/ql/lib/semmle/javascript/frameworks/Koa.qll‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,6 @@ module Koa {
118118
*/
119119
RouteHandler getRouteHandler() { result = rh }
120120

121-
predicate flowsTo(DataFlow::Node nd) { this.ref().flowsTo(nd) }
122-
123121
private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
124122
t.start() and
125123
result = this
@@ -258,7 +256,7 @@ module Koa {
258256
class ContextExpr extends Expr {
259257
ContextSource src;
260258

261-
ContextExpr() { src.flowsTo(DataFlow::valueNode(this)) }
259+
ContextExpr() { src.ref().flowsTo(DataFlow::valueNode(this)) }
262260

263261
/**
264262
* Gets the route handler that provides this response.
@@ -390,7 +388,7 @@ module Koa {
390388

391389
RouteSetup() {
392390
// app.use(fun)
393-
server.flowsTo(this.getReceiver()) and
391+
server.ref().flowsToExpr(this.getReceiver()) and
394392
this.getMethodName() = "use"
395393
}
396394

‎javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -221,10 +221,10 @@ module NodeJSLib {
221221
Expr handler;
222222

223223
RouteSetup() {
224-
server.flowsTo(this) and
224+
server.ref().flowsToExpr(this) and
225225
handler = this.getLastArgument()
226226
or
227-
server.flowsTo(this.getReceiver()) and
227+
server.ref().flowsToExpr(this.getReceiver()) and
228228
this.(MethodCallExpr).getMethodName().regexpMatch("on(ce)?") and
229229
this.getArgument(0).getStringValue() = "request" and
230230
handler = this.getArgument(1)

‎javascript/ql/lib/semmle/javascript/frameworks/Restify.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ module Restify {
144144
RouteSetup() {
145145
// server.get('/', fun)
146146
// server.head('/', fun)
147-
server.flowsTo(getReceiver()) and
147+
server.ref().flowsToExpr(getReceiver()) and
148148
getMethodName() = any(HTTP::RequestMethodName m).toLowerCase()
149149
}
150150

‎javascript/ql/lib/semmle/javascript/security/dataflow/TemplateObjectInjectionCustomizations.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,8 @@ module TemplateObjectInjection {
7676
predicate usesVulnerableTemplateEngine(Express::RouterDefinition router) {
7777
// option 1: `app.set("view engine", "theEngine")`.
7878
// Express will load the engine automatically.
79-
exists(MethodCallExpr call |
80-
router.flowsTo(call.getReceiver()) and
79+
exists(DataFlow::MethodCallNode call |
80+
router.ref().getAMethodCall() = call and
8181
call.getMethodName() = "set" and
8282
call.getArgument(0).getStringValue() = "view engine" and
8383
call.getArgument(1).getStringValue() = getAVulnerableTemplateEngine()
@@ -91,11 +91,11 @@ module TemplateObjectInjection {
9191
DataFlow::MethodCallNode viewEngineCall
9292
|
9393
// `app.engine("name", engine)
94-
router.flowsTo(registerCall.getReceiver().asExpr()) and
94+
router.ref().getAMethodCall() = registerCall and
9595
registerCall.getMethodName() = ["engine", "register"] and
9696
engine = registerCall.getArgument(1).getALocalSource() and
9797
// app.set("view engine", "name")
98-
router.flowsTo(viewEngineCall.getReceiver().asExpr()) and
98+
router.ref().getAMethodCall() = viewEngineCall and
9999
viewEngineCall.getMethodName() = "set" and
100100
viewEngineCall.getArgument(0).getStringValue() = "view engine" and
101101
// The name set by the `app.engine("name")` call matches `app.set("view engine", "name")`.

0 commit comments

Comments
 (0)