add onmessage handlers registered using global property as PostMessageEventHandler

erik-krogh · erik-krogh · commit cb7de2714aec · 2020-09-14T16:50:45.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/DOM.qll b/javascript/ql/src/semmle/javascript/security/dataflow/DOM.qll
@@ -199,6 +199,11 @@ class PostMessageEventHandler extends Function {
       addEventListener.getArgument(0).mayHaveStringValue("message") and
       addEventListener.getArgument(1).getABoundFunctionValue(paramIndex).getFunction() = this
     )
+    or
+    exists(DataFlow::Node rhs |
+      rhs = DataFlow::globalObjectRef().getAPropertyWrite("onmessage").getRhs() and
+      rhs.getABoundFunctionValue(paramIndex).getFunction() = this
+    )
   }
 
   /**

Original file line number	Diff line number	Diff line change
`@@ -199,6 +199,11 @@ class PostMessageEventHandler extends Function {`
`199`	`199`	`addEventListener.getArgument(0).mayHaveStringValue("message") and`
`200`	`200`	`addEventListener.getArgument(1).getABoundFunctionValue(paramIndex).getFunction() = this`
`201`	`201`	`)`
	`202`	`+ or`
	`203`	`+ exists(DataFlow::Node rhs \|`
	`204`	`+ rhs = DataFlow::globalObjectRef().getAPropertyWrite("onmessage").getRhs() and`
	`205`	`+ rhs.getABoundFunctionValue(paramIndex).getFunction() = this`
	`206`	`+ )`
`202`	`207`	`}`
`203`	`208`
`204`	`209`	`/**`