Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f3fab58

Browse files
asgerfasgerf
committed
JS: Add Fuzzy token in identifying access path
1 parent 7c9e1ad commit f3fab58

5 files changed

Lines changed: 96 additions & 2 deletions

File tree

‎javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,14 @@ private API::Node getNodeFromPath(string type, AccessPath path, int n) {
454454
or
455455
// Apply a type step
456456
typeStep(getNodeFromPath(type, path, n), result)
457+
or
458+
// Apply a fuzzy step (without advancing 'n')
459+
path.getToken(n).getName() = "Fuzzy" and
460+
result = Specific::getAFuzzySuccessor(getNodeFromPath(type, path, n))
461+
or
462+
// Skip a fuzzy step (advance 'n' without changing the current node)
463+
path.getToken(n - 1).getName() = "Fuzzy" and
464+
result = getNodeFromPath(type, path, n - 1)
457465
}
458466

459467
/**
@@ -500,6 +508,14 @@ private API::Node getNodeFromSubPath(API::Node base, AccessPath subPath, int n)
500508
// will themselves find by following type-steps.
501509
n > 0 and
502510
n < subPath.getNumToken()
511+
or
512+
// Apply a fuzzy step (without advancing 'n')
513+
subPath.getToken(n).getName() = "Fuzzy" and
514+
result = Specific::getAFuzzySuccessor(getNodeFromSubPath(base, subPath, n))
515+
or
516+
// Skip a fuzzy step (advance 'n' without changing the current node)
517+
subPath.getToken(n - 1).getName() = "Fuzzy" and
518+
result = getNodeFromSubPath(base, subPath, n - 1)
503519
}
504520

505521
/**
@@ -561,7 +577,7 @@ private Specific::InvokeNode getInvocationFromPath(string type, AccessPath path)
561577
*/
562578
bindingset[name]
563579
private predicate isValidTokenNameInIdentifyingAccessPath(string name) {
564-
name = ["Argument", "Parameter", "ReturnValue", "WithArity", "TypeVar"]
580+
name = ["Argument", "Parameter", "ReturnValue", "WithArity", "TypeVar", "Fuzzy"]
565581
or
566582
Specific::isExtraValidTokenNameInIdentifyingAccessPath(name)
567583
}
@@ -572,7 +588,7 @@ private predicate isValidTokenNameInIdentifyingAccessPath(string name) {
572588
*/
573589
bindingset[name]
574590
private predicate isValidNoArgumentTokenInIdentifyingAccessPath(string name) {
575-
name = "ReturnValue"
591+
name = ["ReturnValue", "Fuzzy"]
576592
or
577593
Specific::isExtraValidNoArgumentTokenInIdentifyingAccessPath(name)
578594
}

‎javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,43 @@ API::Node getExtraSuccessorFromInvoke(API::InvokeNode node, AccessPathToken toke
192192
result.asSink() = node.(DataFlow::CallNode).getReceiver()
193193
}
194194

195+
/**
196+
* Holds if `name` is the name of a built-in method on Object, Array, or String.
197+
*/
198+
private predicate isCommonBuiltinMethodName(string name) {
199+
exists(JS::ExternalInstanceMemberDecl member |
200+
member.getBaseName() in ["Object", "Array", "String"] and
201+
name = member.getName()
202+
)
203+
}
204+
205+
/**
206+
* Holds if fuzzy evaluation should not traverse through `call`.
207+
*/
208+
private predicate blockFuzzyCall(DataFlow::CallNode call) {
209+
isCommonBuiltinMethodName(call.getCalleeName())
210+
}
211+
212+
pragma[inline]
213+
API::Node getAFuzzySuccessor(API::Node node) {
214+
result = node.getAMember() and
215+
// Block traversal into calls to built-ins like .toString() and .substring()
216+
// Since there is no API node representing the call itself, block flow into the callee node.
217+
not exists(DataFlow::CallNode call |
218+
node.asSource() = call.getCalleeNode() and
219+
blockFuzzyCall(call)
220+
)
221+
or
222+
result = node.getAParameter()
223+
or
224+
result = node.getReturn()
225+
or
226+
result = node.getPromised()
227+
or
228+
// include 'this' parameters but not 'this' arguments
229+
result = node.getReceiver() and result.asSource() instanceof DataFlow::ThisNode
230+
}
231+
195232
/**
196233
* Holds if `invoke` matches the JS-specific call site filter in `token`.
197234
*/

‎javascript/ql/test/library-tests/frameworks/data/test.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,14 @@ taintFlow
6666
| test.js:231:59:231:66 | source() | test.js:231:59:231:66 | source() |
6767
| test.js:232:59:232:66 | source() | test.js:232:59:232:66 | source() |
6868
| test.js:233:59:233:66 | source() | test.js:233:59:233:66 | source() |
69+
| test.js:237:21:237:28 | source() | test.js:237:21:237:28 | source() |
70+
| test.js:238:25:238:32 | source() | test.js:238:25:238:32 | source() |
71+
| test.js:239:27:239:34 | source() | test.js:239:27:239:34 | source() |
72+
| test.js:241:17:241:24 | source() | test.js:241:17:241:24 | source() |
73+
| test.js:244:33:244:40 | source() | test.js:244:33:244:40 | source() |
74+
| test.js:249:28:249:35 | source() | test.js:249:28:249:35 | source() |
75+
| test.js:252:15:252:22 | source() | test.js:252:15:252:22 | source() |
76+
| test.js:254:32:254:39 | source() | test.js:254:32:254:39 | source() |
6977
isSink
7078
| test.js:54:18:54:25 | source() | test-sink |
7179
| test.js:55:22:55:29 | source() | test-sink |
@@ -136,6 +144,14 @@ isSink
136144
| test.js:231:59:231:66 | source() | test-sink |
137145
| test.js:232:59:232:66 | source() | test-sink |
138146
| test.js:233:59:233:66 | source() | test-sink |
147+
| test.js:237:21:237:28 | source() | test-sink |
148+
| test.js:238:25:238:32 | source() | test-sink |
149+
| test.js:239:27:239:34 | source() | test-sink |
150+
| test.js:241:17:241:24 | source() | test-sink |
151+
| test.js:244:33:244:40 | source() | test-sink |
152+
| test.js:249:28:249:35 | source() | test-sink |
153+
| test.js:252:15:252:22 | source() | test-sink |
154+
| test.js:254:32:254:39 | source() | test-sink |
139155
syntaxErrors
140156
| Member[foo |
141157
| Member[foo] .Member[bar] |

‎javascript/ql/test/library-tests/frameworks/data/test.js‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,3 +232,27 @@ function typeVars() {
232232
testlib.typevar.left.x.getThis().getThis().right.mySink(source()); // NOT OK
233233
testlib.typevar.left.x.right.getThis().getThis().mySink(source()); // NOT OK
234234
}
235+
236+
function fuzzy() {
237+
testlib.fuzzyCall(source()); // NOT OK
238+
testlib.foo.fuzzyCall(source()); // NOT OK
239+
testlib.foo().fuzzyCall(source()); // NOT OK
240+
new testlib.Blah().foo.bar(async p => {
241+
p.fuzzyCall(source()); // NOT OK
242+
p.otherCall(source()); // OK
243+
p.fuzzyCall().laterMethod(source()); // OK
244+
(await p.promise).fuzzyCall(source()); // NOT OK
245+
});
246+
247+
const wrapped = _.partial(testlib.foo, [123]);
248+
wrapped().fuzzyCall(source()); // NOT OK [INCONSISTENCY] - API graphs do not currently propagate return values through partial invocation
249+
wrapped(p => p.fuzzyCall(source())); // NOT OK
250+
251+
const wrappedSink = _.partial(testlib.fuzzyCall);
252+
wrappedSink(source()); // NOT OK
253+
254+
_.partial(testlib.fuzzyCall, source()); // NOT OK
255+
256+
fuzzyCall(source()); // OK - does not come from 'testlib'
257+
require('blah').fuzzyCall(source()); // OK - does not come from 'testlib'
258+
}

‎javascript/ql/test/library-tests/frameworks/data/test.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ class Sinks extends ModelInput::SinkModelCsv {
5454
"testlib;Member[typevar].TypeVar[ABC].Member[mySink].Argument[0];test-sink",
5555
"testlib;Member[typevar].TypeVar[ABC].TypeVar[ABC].Member[mySink].Argument[1];test-sink",
5656
"testlib;Member[typevar].TypeVar[LeftRight].Member[mySink].Argument[0];test-sink",
57+
"testlib;Fuzzy.Member[fuzzyCall].Argument[0];test-sink"
5758
]
5859
}
5960
}

0 commit comments

Comments
 (0)