Model NestJS middlewares as sources

Author: Vasco-jofra

javascript/ql/lib/semmle/javascript/frameworks/Nest.qll

@@ -447,6 +447,61 @@ module NestJS {
     }
   }
 
+  /**
+   * A NestJS Middleware Class
+   */
+  private class NestMiddlewareClass extends DataFlow::ClassNode {
+    NestMiddlewareClass() {
+      exists(ClassDefinition cls |
+        this = cls.flow() and
+        cls.getASuperInterface().hasUnderlyingType("@nestjs/common", "NestMiddleware")
+      )
+    }
+
+    DataFlow::FunctionNode getUseFunction() { result = this.getInstanceMethod("use") }
+  }
+
+  /**
+   * A NestJS Middleware Class route handler (the `use` method)
+   */
+  private class MiddlewareRouteHandler extends Http::RouteHandler, DataFlow::FunctionNode {
+    MiddlewareRouteHandler() { this = any(NestMiddlewareClass m).getUseFunction() }
+
+    override Http::HeaderDefinition getAResponseHeader(string name) { none() }
+
+    /**
+     * Gets the request object used by this route
+     */
+    DataFlow::ParameterNode getRequest() { result = this.getParameter(0) }
+
+    /**
+     * Gets the response object used by this route
+     */
+    DataFlow::ParameterNode getResponse() { result = this.getParameter(1) }
+  }
+
+  /**
+   * A source of `express` request objects for NestJS middlewares
+   */
+  private class MiddlewareRequestSource extends Express::RequestSource {
+    MiddlewareRouteHandler middlewareRouteHandler;
+
+    MiddlewareRequestSource() { this = middlewareRouteHandler.getRequest() }
+
+    override Http::RouteHandler getRouteHandler() { result = middlewareRouteHandler }
+  }
+
+  /**
+   * A source of `express` response objects for NestJS middlewares
+   */
+  private class MiddlewareResponseSource extends Express::ResponseSource {
+    MiddlewareRouteHandler middlewareRouteHandler;
+
+    MiddlewareResponseSource() { this = middlewareRouteHandler.getResponse() }
+
+    override Http::RouteHandler getRouteHandler() { result = middlewareRouteHandler }
+  }
+
   /**
    * A value passed in the `providers` array in:
    * ```js

javascript/ql/test/library-tests/frameworks/Nest/local/middleware.ts

@@ -0,0 +1,12 @@
+import { Injectable, NestMiddleware } from '@nestjs/common';
+import { Response, NextFunction } from 'express';
+import { CustomRequest } from '@randomPackage/request';
+
+@Injectable()
+export class LoggerMiddleware implements NestMiddleware {
+  // The request can be a custom type that extends the express Request
+  use(req: CustomRequest, res: Response, next: NextFunction) {
+    console.log(req.query.abc);
+    next();
+  }
+}

javascript/ql/test/library-tests/frameworks/Nest/test.expected

@@ -10,6 +10,7 @@ routeHandler
 | local/customPipe.ts:36:5:38:5 | propaga ... K\\n    } |
 | local/customPipe.ts:41:5:43:5 | propaga ... K\\n    } |
 | local/customPipe.ts:47:5:49:5 | propaga ... K\\n    } |
+| local/middleware.ts:8:3:11:3 | use(req ... ();\\n  } |
 | local/routes.ts:6:3:8:3 | getFoo( ... o';\\n  } |
 | local/routes.ts:11:3:13:3 | postFoo ... o';\\n  } |
 | local/routes.ts:16:3:18:3 | getRoot ... o';\\n  } |
@@ -29,9 +30,11 @@ routeHandler
 | local/validation.ts:42:3:45:3 | route6( ...  OK\\n  } |
 requestSource
 | local/customDecorator.ts:5:21:5:51 | ctx.swi ... quest() |
+| local/middleware.ts:8:7:8:9 | req |
 | local/routes.ts:30:12:30:14 | req |
 | local/routes.ts:61:23:61:25 | req |
 responseSource
+| local/middleware.ts:8:27:8:29 | res |
 | local/routes.ts:61:35:61:37 | res |
 | local/routes.ts:62:5:62:25 | res.sen ... uery.x) |
 requestInputAccess
@@ -44,6 +47,7 @@ requestInputAccess
 | parameter | local/customDecorator.ts:6:12:6:41 | request ... ryParam |
 | parameter | local/customPipe.ts:5:15:5:19 | value |
 | parameter | local/customPipe.ts:13:15:13:19 | value |
+| parameter | local/middleware.ts:9:17:9:29 | req.query.abc |
 | parameter | local/routes.ts:27:17:27:17 | x |
 | parameter | local/routes.ts:28:14:28:21 | queryObj |
 | parameter | local/routes.ts:29:20:29:23 | name |