1
+ /**
2
+ * Provides helper predicates to work with any Readable Stream in dataflow queries
3
+ *
4
+ * main predicate in which you can use by passing a Readable Stream is `customStreamPipeAdditionalTaintStep`
5
+ */
6
+
1
7
import javascript
2
8
3
9
/**
4
10
* Holds if there is a step between `fs.createReadStream` and `stream.Readable.from` first parameters to all other piped parameters
11
+ *
12
+ * It can be global additional step too
5
13
*/
6
14
predicate readablePipeAdditionalTaintStep ( DataFlow:: Node pred , DataFlow:: Node succ ) {
7
15
exists ( API:: Node receiver |
@@ -20,6 +28,8 @@ predicate readablePipeAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node su
20
28
21
29
/**
22
30
* additional taint steps for piped stream from `createReadStream` method of `fs/promises.open`
31
+ *
32
+ * It can be global additional step too
23
33
*/
24
34
predicate promisesFileHandlePipeAdditionalTaintStep ( DataFlow:: Node pred , DataFlow:: Node succ ) {
25
35
exists ( API:: Node receiver | receiver = nodeJsPromisesFileSystem ( ) .getMember ( "open" ) |
@@ -45,9 +55,7 @@ API::Node nodeJsPromisesFileSystem() {
45
55
*
46
56
* or `receiver.pipe(succ)` and receiver is pred
47
57
*
48
- * Receiver can be any method node that support stream pipe method, it can't be a parameter node
49
- *
50
- * Pass receiver method as receiver, not a return value of the receiver method
58
+ * Receiver is a Readable Stream object
51
59
*/
52
60
predicate customStreamPipeAdditionalTaintStep (
53
61
API:: Node receiver , DataFlow:: Node pred , DataFlow:: Node succ
@@ -83,6 +91,8 @@ predicate customStreamPipeAdditionalTaintStep(
83
91
* succ
84
92
* )
85
93
* ```
94
+ *
95
+ * It can be global additional step too
86
96
*/
87
97
predicate streamPipelineAdditionalTaintStep ( DataFlow:: Node pred , DataFlow:: Node succ ) {
88
98
// this step connect the a pipeline parameter to the next pipeline parameter
@@ -114,8 +124,8 @@ API::Node nodeJsStream() {
114
124
}
115
125
116
126
/**
117
- * Gets a Readable Stream method(not a return value of the method)
118
- * and returns all nodes responsible for a data read access
127
+ * Gets a Readable stream object,
128
+ * and returns all nodes responsible for a data read of this Readable stream
119
129
*/
120
130
DataFlow:: Node readableStreamDataNode ( API:: Node stream ) {
121
131
result = stream .asSource ( )
0 commit comments