JS: introduce concept: FileNameSource

Author: Esben Sparre Andreasen

javascript/ql/src/semmle/javascript/Concepts.qll

@@ -29,6 +29,13 @@ abstract class FileSystemAccess extends DataFlow::Node {
   abstract DataFlow::Node getAPathArgument();
 }
 
+/**
+ * A data flow node that contains a file name or an array of file names from the local file system.
+ */
+abstract class FileNameSource extends DataFlow::Node {
+
+}
+
 /**
  * A data flow node that performs a database access.
  */

javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll

@@ -365,6 +365,22 @@ module NodeJSLib {
     }
   }
 
+  /**
+   * A data flow node that contains a file name or an array of file names from the local file system.
+   */
+  private class NodeJSFileNameSource extends FileNameSource {
+
+    NodeJSFileNameSource() {
+      exists (string name |
+        name = "readdir" or
+        name = "realpath" |
+        this = fsModuleMember(name).getACall().getCallback([1..2]).getParameter(1) or
+        this = fsModuleMember(name + "Sync").getACall()
+      )
+    }
+
+  }
+  
   /**
    * A call to a method from module `child_process`.
    */