@@ -37,27 +37,25 @@ module Express {
3737 */
3838 private predicate isRouter ( Expr e , RouterDefinition router ) {
3939 router .flowsTo ( e )
40+ }
41+
42+ /**
43+ * Holds if `e` may refer to a router object.
44+ */
45+ private predicate isRouter ( Expr e ) {
46+ isRouter ( e , _)
4047 or
41- exists ( DataFlow:: MethodCallNode chain , DataFlow:: Node base , string name |
42- name = "route" or
43- name = routeSetupMethodName ( )
44- |
45- chain .calls ( base , name ) and
46- isRouter ( base .asExpr ( ) , router ) and
47- chain .flowsToExpr ( e )
48- )
48+ e .getType ( ) .hasUnderlyingType ( "express" , "Router" )
4949 }
5050
5151 /**
5252 * An expression that refers to a route.
5353 */
5454 class RouteExpr extends MethodCallExpr {
55- RouterDefinition router ;
56-
57- RouteExpr ( ) { isRouter ( this , router ) }
55+ RouteExpr ( ) { isRouter ( this ) }
5856
59- /** Gets the router from which this route was created. */
60- RouterDefinition getRouter ( ) { result = router }
57+ /** Gets the router from which this route was created, if it is known . */
58+ RouterDefinition getRouter ( ) { isRouter ( this , result ) }
6159 }
6260
6361 /**
@@ -77,18 +75,16 @@ module Express {
7775 * A call to an Express router method that sets up a route.
7876 */
7977 class RouteSetup extends HTTP:: Servers:: StandardRouteSetup , MethodCallExpr {
80- RouterDefinition router ;
81-
8278 RouteSetup ( ) {
83- isRouter ( getReceiver ( ) , router ) and
79+ isRouter ( getReceiver ( ) ) and
8480 getMethodName ( ) = routeSetupMethodName ( )
8581 }
8682
8783 /** Gets the path associated with the route. */
8884 string getPath ( ) { getArgument ( 0 ) .mayHaveStringValue ( result ) }
8985
9086 /** Gets the router on which handlers are being registered. */
91- RouterDefinition getRouter ( ) { result = router }
87+ RouterDefinition getRouter ( ) { isRouter ( getReceiver ( ) , result ) }
9288
9389 /** Holds if this is a call `use`, such as `app.use(handler)`. */
9490 predicate isUseCall ( ) { getMethodName ( ) = "use" }
@@ -340,14 +336,18 @@ module Express {
340336 )
341337 }
342338
339+ /** An Express response source. */
340+ abstract private class ResponseSource extends HTTP:: Servers:: ResponseSource {
341+ }
342+
343343 /**
344344 * An Express response source, that is, the response parameter of a
345345 * route handler, or a chained method call on a response.
346346 */
347- private class ResponseSource extends HTTP :: Servers :: ResponseSource {
347+ private class ExplicitResponseSource extends ResponseSource {
348348 RouteHandler rh ;
349349
350- ResponseSource ( ) {
350+ ExplicitResponseSource ( ) {
351351 this = DataFlow:: parameterNode ( rh .getResponseParameter ( ) )
352352 or
353353 isChainableResponseMethodCall ( rh , this .asExpr ( ) )
@@ -359,21 +359,47 @@ module Express {
359359 override RouteHandler getRouteHandler ( ) { result = rh }
360360 }
361361
362+ /**
363+ * An Express response source, based on static type information.
364+ */
365+ private class TypedResponseSource extends ResponseSource {
366+ TypedResponseSource ( ) {
367+ hasUnderlyingType ( "express" , "Response" )
368+ }
369+
370+ override RouteHandler getRouteHandler ( ) { none ( ) } // Not known.
371+ }
372+
373+ /** An Express request source. */
374+ abstract private class RequestSource extends HTTP:: Servers:: RequestSource {
375+ }
376+
362377 /**
363378 * An Express request source, that is, the request parameter of a
364379 * route handler.
365380 */
366- private class RequestSource extends HTTP :: Servers :: RequestSource {
381+ private class ExplicitRequestSource extends RequestSource {
367382 RouteHandler rh ;
368383
369- RequestSource ( ) { this = DataFlow:: parameterNode ( rh .getRequestParameter ( ) ) }
384+ ExplicitRequestSource ( ) { this = DataFlow:: parameterNode ( rh .getRequestParameter ( ) ) }
370385
371386 /**
372387 * Gets the route handler that handles this request.
373388 */
374389 override RouteHandler getRouteHandler ( ) { result = rh }
375390 }
376391
392+ /**
393+ * An Express request source, based on static type information.
394+ */
395+ private class TypedRequestSource extends RequestSource {
396+ TypedRequestSource ( ) {
397+ hasUnderlyingType ( "express" , "Request" )
398+ }
399+
400+ override RouteHandler getRouteHandler ( ) { none ( ) } // Not known.
401+ }
402+
377403 /**
378404 * An Express response expression.
379405 */
@@ -678,6 +704,13 @@ module Express {
678704 t .start ( ) and
679705 result = DataFlow:: exprNode ( this )
680706 or
707+ exists ( string name |
708+ result = ref ( t .continue ( ) ) .getAMethodCall ( name )
709+ |
710+ name = "route" or
711+ name = routeSetupMethodName ( )
712+ )
713+ or
681714 exists ( DataFlow:: TypeTracker t2 | result = ref ( t2 ) .track ( t2 , t ) )
682715 }
683716
0 commit comments