JS: Cache together

asgerf · asgerf · commit bc4c17864829 · 2021-03-16T13:28:12.000Z
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll b/javascript/ql/src/semmle/javascript/security/dataflow/RemoteFlowSources.qll
@@ -7,20 +7,35 @@ import semmle.javascript.frameworks.HTTP
 import semmle.javascript.security.dataflow.DOM
 private import semmle.javascript.internal.CachedStages
 
-/** A data flow source of remote user input. */
 cached
-abstract class RemoteFlowSource extends DataFlow::Node {
-  /** Gets a human-readable string that describes the type of this remote flow source. */
+private module Cached {
+  /** A data flow source of remote user input. */
   cached
-  abstract string getSourceType();
+  abstract class RemoteFlowSource extends DataFlow::Node {
+    /** Gets a human-readable string that describes the type of this remote flow source. */
+    cached
+    abstract string getSourceType();
+
+    /**
+     * Holds if this can be a user-controlled object, such as a JSON object parsed from user-controlled data.
+     */
+    cached
+    predicate isUserControlledObject() { none() }
+  }
 
   /**
-   * Holds if this can be a user-controlled object, such as a JSON object parsed from user-controlled data.
+   * A source of remote input in a web browser environment.
    */
   cached
-  predicate isUserControlledObject() { none() }
+  abstract class ClientSideRemoteFlowSource extends RemoteFlowSource {
+    /** Gets a string indicating what part of the browser environment this was derived from. */
+    cached
+    abstract ClientSideRemoteFlowKind getKind();
+  }
 }
 
+import Cached
+
 /**
  * A type of remote flow source that is specific to the browser environment.
  */
@@ -64,14 +79,6 @@ class ClientSideRemoteFlowKind extends string {
   predicate isWindowName() { this = "name" }
 }
 
-/**
- * A source of remote input in a web browser environment.
- */
-abstract class ClientSideRemoteFlowSource extends RemoteFlowSource {
-  /** Gets a string indicating what part of the browser environment this was derived from. */
-  abstract ClientSideRemoteFlowKind getKind();
-}
-
 /**
  * A specification of a remote flow source in a JSON file included in the database.
  *
