Skip to content

Commit a4fa298

Browse files
semmle-qlcisemmle-qlci
authored
Merge pull request #1526 from xiemaisi/js/remove-TrackedExpr
Approved by esben-semmle
2 parents 4f3cbe0 + 3c3422e commit a4fa298

File tree

8 files changed

+67
-22
lines changed

8 files changed

+67
-22
lines changed

‎javascript/ql/src/meta/analysis-quality/CandidateTracking.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* Provides an auxiliary predicate shared among the unpromoted-candidate queries.
3+
*/
4+
5+
import javascript
6+
7+
/**
8+
* Gets a source node to which `cand` may flow inter-procedurally, with `t` tracking
9+
* the state of flow.
10+
*/
11+
DataFlow::SourceNode track(HTTP::RouteHandlerCandidate cand, DataFlow::TypeTracker t) {
12+
t.start() and
13+
result = cand
14+
or
15+
exists(DataFlow::TypeTracker t2 | result = track(cand, t2).track(t2, t))
16+
}

‎javascript/ql/src/meta/analysis-quality/UnpromotedRouteHandlerCandidate.ql‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@
99
*/
1010

1111
import javascript
12+
import CandidateTracking
1213

1314
from HTTP::RouteHandlerCandidate rh
1415
where
1516
not rh instanceof HTTP::RouteHandler and
1617
not exists(HTTP::RouteSetupCandidate setup |
17-
rh.(DataFlow::TrackedNode).flowsTo(setup.getARouteHandlerArg())
18+
track(rh, DataFlow::TypeTracker::end()).flowsTo(setup.getARouteHandlerArg())
1819
)
1920
select rh,
2021
"A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`."

‎javascript/ql/src/meta/analysis-quality/UnpromotedRouteSetupCandidate.ql‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@
99
*/
1010

1111
import javascript
12+
import CandidateTracking
1213

1314
from HTTP::RouteSetupCandidate setup
1415
where
1516
not setup.asExpr() instanceof HTTP::RouteSetup and
1617
exists(HTTP::RouteHandlerCandidate rh |
17-
rh.(DataFlow::TrackedNode).flowsTo(setup.getARouteHandlerArg())
18+
track(rh, DataFlow::TypeTracker::end()).flowsTo(setup.getARouteHandlerArg())
1819
)
1920
select setup,
2021
"A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`."

‎javascript/ql/src/semmle/javascript/frameworks/Express.qll‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -657,7 +657,7 @@ module Express {
657657
/**
658658
* An Express server application.
659659
*/
660-
private class Application extends HTTP::ServerDefinition, DataFlow::TrackedExpr {
660+
private class Application extends HTTP::ServerDefinition {
661661
Application() { this = appCreation().asExpr() }
662662

663663
/**
@@ -671,9 +671,23 @@ module Express {
671671
/**
672672
* An Express router.
673673
*/
674-
class RouterDefinition extends InvokeExpr, DataFlow::TrackedExpr {
674+
class RouterDefinition extends InvokeExpr {
675675
RouterDefinition() { this = routerCreation().asExpr() }
676676

677+
private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
678+
t.start() and
679+
result = DataFlow::exprNode(this)
680+
or
681+
exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
682+
}
683+
684+
/**
685+
* Holds if `sink` may refer to this router.
686+
*/
687+
predicate flowsTo(Expr sink) {
688+
ref(DataFlow::TypeTracker::end()).flowsToExpr(sink)
689+
}
690+
677691
/**
678692
* Gets a `RouteSetup` that was used for setting up a route on this router.
679693
*/

‎javascript/ql/src/semmle/javascript/frameworks/HTTP.qll‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -248,8 +248,20 @@ module HTTP {
248248
/**
249249
* A standard server definition.
250250
*/
251-
abstract class StandardServerDefinition extends ServerDefinition, DataFlow::TrackedExpr {
251+
abstract class StandardServerDefinition extends ServerDefinition {
252252
override RouteHandler getARouteHandler() { result.(StandardRouteHandler).getServer() = this }
253+
254+
private DataFlow::SourceNode ref(DataFlow::TypeTracker t) {
255+
t.start() and
256+
result = DataFlow::exprNode(this)
257+
or
258+
exists(DataFlow::TypeTracker t2 | result = ref(t2).track(t2, t))
259+
}
260+
261+
/**
262+
* Holds if `sink` may refer to this server definition.
263+
*/
264+
predicate flowsTo(Expr sink) { ref(DataFlow::TypeTracker::end()).flowsToExpr(sink) }
253265
}
254266

255267
/**

‎javascript/ql/src/semmle/javascript/frameworks/Restify.qll‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ module Restify {
99
/**
1010
* An expression that creates a new Restify server.
1111
*/
12-
class ServerDefinition extends HTTP::Servers::StandardServerDefinition, CallExpr,
13-
DataFlow::TrackedExpr {
12+
class ServerDefinition extends HTTP::Servers::StandardServerDefinition, CallExpr {
1413
ServerDefinition() {
1514
// `server = restify.createServer()`
1615
this = DataFlow::moduleMember("restify", "createServer").getACall().asExpr()

‎javascript/ql/test/library-tests/frameworks/HTTP-heuristics/UnpromotedRouteHandlerCandidate.expected‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,30 +3,15 @@
33
| src/hapi.js:1:1:1:30 | functio ... t, h){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
44
| src/iterated-handlers.js:4:2:4:22 | functio ... res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
55
| src/middleware-attacher-getter.js:29:32:29:51 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
6-
| src/nodejs.js:5:22:5:41 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
7-
| src/nodejs.js:11:23:11:42 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
8-
| src/nodejs.js:12:25:12:44 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
96
| src/route-objects.js:7:19:7:38 | function(req, res){} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
107
| src/route-objects.js:8:12:10:5 | (req, res) {\\n\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
118
| src/route-objects.js:20:16:22:9 | (req, r ... } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
129
| src/route-objects.js:27:16:29:9 | (req, r ... } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
1310
| src/route-objects.js:40:12:42:5 | (req, res) {\\n\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
1411
| src/route-objects.js:50:12:52:5 | (req, res) {\\n\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
1512
| src/route-objects.js:56:12:58:5 | functio ... ;\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
16-
| src/tst.js:6:32:6:52 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
17-
| src/tst.js:8:32:8:61 | functio ... nse) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
18-
| src/tst.js:30:36:30:56 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
19-
| src/tst.js:33:18:33:38 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
20-
| src/tst.js:34:18:34:38 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
21-
| src/tst.js:37:5:37:25 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
22-
| src/tst.js:38:5:38:25 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
23-
| src/tst.js:43:18:43:38 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
2413
| src/tst.js:46:1:46:23 | functio ... res) {} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
2514
| src/tst.js:52:1:54:1 | functio ... req()\\n} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
2615
| src/tst.js:61:1:63:1 | functio ... turn;\\n} | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
2716
| src/tst.js:70:5:72:5 | functio ... \\n\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
28-
| src/tst.js:79:5:81:5 | functio ... \\n\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
29-
| src/tst.js:84:5:86:5 | functio ... \\n\\n } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
3017
| src/tst.js:109:16:111:9 | functio ... } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
31-
| src/tst.js:124:16:126:9 | functio ... } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |
32-
| src/tst.js:132:16:134:9 | functio ... } | A `RouteHandlerCandidate` that did not get promoted to `RouteHandler`, and it is not used in a `RouteSetupCandidate`. |

‎javascript/ql/test/library-tests/frameworks/HTTP-heuristics/UnpromotedRouteSetupCandidate.expected‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| src/nodejs.js:5:1:5:42 | unknown ... res){}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
2+
| src/nodejs.js:11:1:11:43 | unknown ... res){}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
3+
| src/nodejs.js:12:1:12:45 | unknown ... res){}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
4+
| src/tst.js:6:1:6:53 | someOth ... es) {}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
5+
| src/tst.js:8:1:8:62 | someOth ... se) {}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
6+
| src/tst.js:30:1:30:57 | someOth ... es) {}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
7+
| src/tst.js:32:1:34:39 | someOth ... es) {}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
8+
| src/tst.js:36:1:39:2 | someOth ... ) {}\\n]) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
9+
| src/tst.js:41:1:43:39 | someOth ... es) {}) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
10+
| src/tst.js:87:5:87:57 | unknown ... cSetup) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
11+
| src/tst.js:96:5:96:36 | unknown ... h', rh) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
12+
| src/tst.js:98:5:98:38 | unknown ... , [rh]) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
13+
| src/tst.js:104:5:104:45 | unknown ... wn, rh) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
14+
| src/tst.js:137:5:137:57 | unknown ... cSetup) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
15+
| src/tst.js:149:5:149:36 | unknown ... h', rh) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
16+
| src/tst.js:151:5:151:38 | unknown ... , [rh]) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |
17+
| src/tst.js:157:5:157:45 | unknown ... wn, rh) | A `RouteSetupCandidate` that did not get promoted to `RouteSetup`, and it is using at least one `RouteHandlerCandidate`. |

0 commit comments

Comments
 (0)