Skip to content

Commit c146e04

Browse files
committed
JS: Update NoSQL model
1 parent b6b8a55 commit c146e04

File tree

1 file changed

+10
-16
lines changed
  • javascript/ql/src/semmle/javascript/frameworks

1 file changed

+10
-16
lines changed

javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -62,22 +62,20 @@ private module MongoDB {
6262
}
6363

6464
/** A call to a MongoDB query method. */
65-
private class QueryCall extends DatabaseAccess, DataFlow::CallNode {
65+
private class QueryCall extends DatabaseAccess, API::CallNode {
6666
int queryArgIdx;
67-
API::Node callee;
6867

6968
QueryCall() {
7069
exists(string method |
7170
CollectionMethodSignatures::interpretsArgumentAsQuery(method, queryArgIdx) and
72-
callee = getACollection().getMember(method)
73-
) and
74-
this = callee.getACall()
71+
this = getACollection().getMember(method).getACall()
72+
)
7573
}
7674

7775
override DataFlow::Node getAQueryArgument() { result = getArgument(queryArgIdx) }
7876

7977
DataFlow::Node getACodeOperator() {
80-
result = getADollarWhereProperty(callee.getParameter(queryArgIdx))
78+
result = getADollarWhereProperty(getParameter(queryArgIdx))
8179
}
8280
}
8381

@@ -670,22 +668,20 @@ private module Minimongo {
670668
}
671669

672670
/** A call to a Minimongo query method. */
673-
private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
671+
private class QueryCall extends DatabaseAccess, API::CallNode {
674672
int queryArgIdx;
675-
API::Node callee;
676673

677674
QueryCall() {
678675
exists(string m |
679-
callee = API::moduleImport("minimongo").getAMember().getReturn().getAMember().getMember(m) and
680-
this = callee.getACall() and
676+
this = API::moduleImport("minimongo").getAMember().getReturn().getAMember().getMember(m).getACall() and
681677
CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
682678
)
683679
}
684680

685681
override DataFlow::Node getAQueryArgument() { result = getArgument(queryArgIdx) }
686682

687683
DataFlow::Node getACodeOperator() {
688-
result = getADollarWhereProperty(callee.getParameter(queryArgIdx))
684+
result = getADollarWhereProperty(getParameter(queryArgIdx))
689685
}
690686
}
691687

@@ -706,14 +702,12 @@ private module Minimongo {
706702
*/
707703
private module MarsDB {
708704
/** A call to a MarsDB query method. */
709-
private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
705+
private class QueryCall extends DatabaseAccess, API::MethodCallNode {
710706
int queryArgIdx;
711-
API::Node callee;
712707

713708
QueryCall() {
714709
exists(string m |
715-
callee = API::moduleImport("marsdb").getMember("Collection").getInstance().getMember(m) and
716-
this = callee.getACall() and
710+
this = API::moduleImport("marsdb").getMember("Collection").getInstance().getMember(m).getACall() and
717711
// implements parts of the Minimongo interface
718712
Minimongo::CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
719713
)
@@ -722,7 +716,7 @@ private module MarsDB {
722716
override DataFlow::Node getAQueryArgument() { result = getArgument(queryArgIdx) }
723717

724718
DataFlow::Node getACodeOperator() {
725-
result = getADollarWhereProperty(callee.getParameter(queryArgIdx))
719+
result = getADollarWhereProperty(getParameter(queryArgIdx))
726720
}
727721
}
728722

0 commit comments

Comments
 (0)