Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ce0175a

Browse files
erik-krogherik-krogh
committed
don't use astNode in StandardHeaderDefinition 
1 parent d4ccc75 commit ce0175a

8 files changed

Lines changed: 49 additions & 35 deletions

File tree

‎javascript/ql/lib/semmle/javascript/frameworks/Express.qll‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -674,12 +674,12 @@ module Express {
674674
/**
675675
* Holds if `e` is an HTTP request object.
676676
*/
677-
predicate isRequest(Expr e) { any(RouteHandler rh).getARequestExpr() = e }
677+
predicate isRequest(Expr e) { any(RouteHandler rh).getARequestExpr() = e } // TODO: DataFlow::Node
678678

679679
/**
680680
* Holds if `e` is an HTTP response object.
681681
*/
682-
predicate isResponse(Expr e) { any(RouteHandler rh).getAResponseExpr() = e }
682+
predicate isResponse(Expr e) { any(RouteHandler rh).getAResponseExpr() = e } // TODO: DataFlow::Node
683683

684684
/**
685685
* An access to the HTTP request body.
@@ -689,9 +689,11 @@ module Express {
689689
}
690690

691691
abstract private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
692-
HeaderDefinition() { isResponse(astNode.getReceiver()) }
692+
HeaderDefinition() { isResponse(this.getReceiver().asExpr()) }
693693

694-
override RouteHandler getRouteHandler() { astNode.getReceiver() = result.getAResponseExpr() }
694+
override RouteHandler getRouteHandler() {
695+
this.getReceiver().asExpr() = result.getAResponseExpr()
696+
}
695697
}
696698

697699
/**
@@ -713,8 +715,8 @@ module Express {
713715
*/
714716
private class SetOneHeader extends HeaderDefinition {
715717
SetOneHeader() {
716-
astNode.getMethodName() = any(string n | n = "set" or n = "header") and
717-
astNode.getNumArgument() = 2
718+
this.getMethodName() = any(string n | n = "set" or n = "header") and
719+
this.getNumArgument() = 2
718720
}
719721
}
720722

@@ -744,9 +746,9 @@ module Express {
744746

745747
override RouteHandler getRouteHandler() { result = response.getRouteHandler() }
746748

747-
override Expr getNameExpr() {
749+
override DataFlow::Node getNameNode() {
748750
exists(DataFlow::PropWrite write | this.getAHeaderSource().getAPropertyWrite() = write |
749-
result = write.getPropertyNameExpr()
751+
result = write.getPropertyNameExpr().flow()
750752
)
751753
}
752754
}
@@ -755,7 +757,7 @@ module Express {
755757
* An invocation of the `append` method on an HTTP response object.
756758
*/
757759
private class AppendHeader extends HeaderDefinition {
758-
AppendHeader() { astNode.getMethodName() = "append" }
760+
AppendHeader() { this.getMethodName() = "append" }
759761
}
760762

761763
/**

‎javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -401,9 +401,9 @@ module Fastify {
401401

402402
override RouteHandler getRouteHandler() { result = rh }
403403

404-
override Expr getNameExpr() {
404+
override DataFlow::Node getNameNode() {
405405
exists(DataFlow::PropWrite write | this.getAHeaderSource().getAPropertyWrite() = write |
406-
result = write.getPropertyNameExpr()
406+
result = write.getPropertyNameExpr().flow()
407407
)
408408
}
409409
}

‎javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -68,12 +68,16 @@ module HTTP {
6868
/**
6969
* Holds if the header with (lower-case) name `headerName` is set to the value of `headerValue`.
7070
*/
71-
abstract predicate definesExplicitly(string headerName, Expr headerValue);
71+
abstract predicate definesExplicitly(string headerName, Expr headerValue); // TODO: DataFlow::Node.
7272

7373
/**
74+
* DEPRECATED: Use `getNameNode()` instead.
7475
* Returns the expression used to compute the header name.
7576
*/
76-
abstract Expr getNameExpr();
77+
deprecated Expr getNameExpr() { result = this.getNameNode().asExpr() }
78+
79+
/** Returns the expression used to compute the header name. */
80+
abstract DataFlow::Node getNameNode();
7781
}
7882

7983
/**
@@ -201,13 +205,13 @@ module HTTP {
201205
* Gets an expression that contains a request object handled
202206
* by this handler.
203207
*/
204-
RequestExpr getARequestExpr() { result.getRouteHandler() = this }
208+
RequestExpr getARequestExpr() { result.getRouteHandler() = this } // TODO: DataFlow::Node
205209

206210
/**
207211
* Gets an expression that contains a response object provided
208212
* by this handler.
209213
*/
210-
ResponseExpr getAResponseExpr() { result.getRouteHandler() = this }
214+
ResponseExpr getAResponseExpr() { result.getRouteHandler() = this } // TODO: DataFlow::Node
211215
}
212216

213217
/**
@@ -238,6 +242,7 @@ module HTTP {
238242
* An expression that may contain a request object.
239243
*/
240244
abstract class RequestExpr extends Expr {
245+
// TODO: DataFlow::Node
241246
/**
242247
* Gets the route handler that handles this request.
243248
*/
@@ -248,6 +253,7 @@ module HTTP {
248253
* An expression that may contain a response object.
249254
*/
250255
abstract class ResponseExpr extends Expr {
256+
// TODO: DataFlow::Node
251257
/**
252258
* Gets the route handler that handles this request.
253259
*/
@@ -376,15 +382,14 @@ module HTTP {
376382
/**
377383
* A standard header definition.
378384
*/
379-
abstract class StandardHeaderDefinition extends ExplicitHeaderDefinition, DataFlow::ValueNode {
380-
override MethodCallExpr astNode;
381-
385+
abstract class StandardHeaderDefinition extends ExplicitHeaderDefinition,
386+
DataFlow::MethodCallNode {
382387
override predicate definesExplicitly(string headerName, Expr headerValue) {
383-
headerName = this.getNameExpr().getStringValue().toLowerCase() and
384-
headerValue = astNode.getArgument(1)
388+
headerName = this.getNameNode().getStringValue().toLowerCase() and
389+
headerValue = this.getArgument(1).asExpr()
385390
}
386391

387-
override Expr getNameExpr() { result = astNode.getArgument(0) }
392+
override DataFlow::Node getNameNode() { result = this.getArgument(0) }
388393
}
389394

390395
/**

‎javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,15 @@ module Hapi {
7474
override RouteHandler getRouteHandler() { result = rh }
7575
}
7676

77+
// TODO: DataFlow::Node
7778
/**
7879
* A Hapi response expression.
7980
*/
8081
class ResponseExpr extends HTTP::Servers::StandardResponseExpr {
8182
override ResponseSource src;
8283
}
8384

85+
// TODO: DataFlow::Node
8486
/**
8587
* An Hapi request expression.
8688
*/
@@ -175,7 +177,7 @@ module Hapi {
175177

176178
HeaderDefinition() {
177179
// request.response.header('Cache-Control', 'no-cache')
178-
astNode.calls(res, "header")
180+
this.calls(res.flow(), "header")
179181
}
180182

181183
override RouteHandler getRouteHandler() { result = res.getRouteHandler() }

‎javascript/ql/lib/semmle/javascript/frameworks/Koa.qll‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ module Koa {
2424

2525
HeaderDefinition() {
2626
// ctx.set('Cache-Control', 'no-cache');
27-
astNode.calls(rh.getAResponseOrContextExpr(), "set")
27+
this.calls(rh.getAResponseOrContextExpr().flow(), "set")
2828
or
2929
// ctx.response.header('Cache-Control', 'no-cache')
30-
astNode.calls(rh.getAResponseExpr(), "header")
30+
this.calls(rh.getAResponseExpr().flow(), "header")
3131
}
3232

3333
override RouteHandler getRouteHandler() { result = rh }
@@ -59,6 +59,7 @@ module Koa {
5959
* object of a route handler invocation.
6060
*/
6161
Expr getAResponseOrContextExpr() {
62+
// TODO: DataFlow::Node
6263
result = this.getAResponseExpr() or result = this.getAContextExpr()
6364
}
6465

‎javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ module NodeJSLib {
259259
abstract private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
260260
ResponseExpr r;
261261

262-
HeaderDefinition() { astNode.getReceiver() = r }
262+
HeaderDefinition() { this.getReceiver().asExpr() = r }
263263

264264
override HTTP::RouteHandler getRouteHandler() { result = r.getRouteHandler() }
265265
}
@@ -268,22 +268,22 @@ module NodeJSLib {
268268
* A call to the `setHeader` method of an HTTP response.
269269
*/
270270
private class SetHeader extends HeaderDefinition {
271-
SetHeader() { astNode.getMethodName() = "setHeader" }
271+
SetHeader() { this.getMethodName() = "setHeader" }
272272
}
273273

274274
/**
275275
* A call to the `writeHead` method of an HTTP response.
276276
*/
277277
private class WriteHead extends HeaderDefinition {
278278
WriteHead() {
279-
astNode.getMethodName() = "writeHead" and
280-
astNode.getNumArgument() >= 1
279+
this.getMethodName() = "writeHead" and
280+
this.getNumArgument() >= 1
281281
}
282282

283283
override predicate definesExplicitly(string headerName, Expr headerValue) {
284-
astNode.getNumArgument() > 1 and
284+
this.getNumArgument() > 1 and
285285
exists(DataFlow::SourceNode headers, string header |
286-
headers.flowsToExpr(astNode.getLastArgument()) and
286+
headers.flowsTo(this.getLastArgument()) and
287287
headers.hasPropertyWrite(header, DataFlow::valueNode(headerValue)) and
288288
headerName = header.toLowerCase()
289289
)

‎javascript/ql/lib/semmle/javascript/frameworks/Restify.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,13 +68,15 @@ module Restify {
6868
override RouteHandler getRouteHandler() { result = rh }
6969
}
7070

71+
// TODO: DataFlow::Node
7172
/**
7273
* A Node.js HTTP response provided by Restify.
7374
*/
7475
class ResponseExpr extends NodeJSLib::ResponseExpr {
7576
ResponseExpr() { src instanceof ResponseSource }
7677
}
7778

79+
// TODO: DataFlow::Node
7880
/**
7981
* A Node.js HTTP request provided by Restify.
8082
*/
@@ -128,11 +130,13 @@ module Restify {
128130
private class HeaderDefinition extends HTTP::Servers::StandardHeaderDefinition {
129131
HeaderDefinition() {
130132
// response.header('Cache-Control', 'no-cache')
131-
astNode.getReceiver() instanceof ResponseExpr and
132-
astNode.getMethodName() = "header"
133+
this.getReceiver().asExpr() instanceof ResponseExpr and
134+
this.getMethodName() = "header"
133135
}
134136

135-
override RouteHandler getRouteHandler() { astNode.getReceiver() = result.getAResponseExpr() }
137+
override RouteHandler getRouteHandler() {
138+
this.getReceiver().asExpr() = result.getAResponseExpr()
139+
}
136140
}
137141

138142
/**

‎javascript/ql/lib/semmle/javascript/security/dataflow/RemotePropertyInjectionCustomizations.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,11 @@ module RemotePropertyInjection {
5757
* header names as properties. This case is already handled by
5858
* `PropertyWriteSink`.
5959
*/
60-
class HeaderNameSink extends Sink, DataFlow::ValueNode {
60+
class HeaderNameSink extends Sink {
6161
HeaderNameSink() {
6262
exists(HTTP::ExplicitHeaderDefinition hd |
6363
not hd instanceof Express::SetMultipleHeaders and
64-
astNode = hd.getNameExpr()
64+
this = hd.getNameNode()
6565
)
6666
}
6767

0 commit comments

Comments
 (0)