add step from getStaticProps to the component render function

erik-krogh · erik-krogh · commit d63fcaf7f117 · 2021-03-02T12:25:49.000+01:00
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Next.qll b/javascript/ql/src/semmle/javascript/frameworks/Next.qll
@@ -23,13 +23,18 @@ private module NextJS {
     result = getAPagesFolder().getAFolder()
   }
 
+  /**
+   * Gets a module corrosponding to a `Next.js` page.
+   */
+  Module getAPagesModule() { result.getFile().getParentContainer() = getAPagesFolder() }
+
   /**
    * Gets a module inside a "pages" folder where `fallback` from `getStaticPaths` is not set to false.
    * In such a module the `getStaticProps` method can be called with user-defined parameters.
    * If `fallback` is set to false, then only values defined by `getStaticPaths` are allowed.
    */
   Module getAModuleWithFallbackPaths() {
-    result.getFile().getParentContainer() = getAPagesFolder() and
+    result = getAPagesModule() and
     exists(DataFlow::FunctionNode staticPaths, Expr fallback |
       staticPaths = result.getAnExportedValue("getStaticPaths").getAFunctionValue() and
       fallback =
@@ -53,4 +58,21 @@ private module NextJS {
 
     override string getSourceType() { result = "Next request parameter" }
   }
+
+  /**
+   * A step modelling the flow from the server-computed `getStaticProps` to the server/client rendering of the page.
+   */
+  class NextJSStaticPropsStep extends DataFlow::AdditionalFlowStep, DataFlow::FunctionNode {
+    Module pageModule;
+
+    NextJSStaticPropsStep() {
+      pageModule = getAPagesModule() and
+      this = pageModule.getAnExportedValue("getStaticProps").getAFunctionValue()
+    }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      pred = this.getAReturn().getALocalSource().getAPropertyWrite("props").getRhs() and
+      succ = pageModule.getAnExportedValue("default").getAFunctionValue().getParameter(0)
+    }
+  }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Next/tests.expected b/javascript/ql/test/library-tests/frameworks/Next/tests.expected
@@ -1,3 +1,4 @@
 remoteFlow
 | pages/[my-fallback-id].jsx:9:40:9:45 | params |
 dataFlow
+| pages/[my-fallback-id].jsx:13:20:13:27 | source() | pages/[my-fallback-id].jsx:19:10:19:14 | taint |
