JS: Improve handling of default exports in Vue

Author: asgerf

javascript/ql/lib/semmle/javascript/Modules.qll

@@ -111,6 +111,23 @@ abstract class Module extends TopLevel {
   cached
   abstract DataFlow::Node getAnExportedValue(string name);
 
+  /**
+   * Gets a value that is exported as the whole exports object of this module.
+   */
+  cached
+  DataFlow::Node getABulkExportedNode() { none() } // overridden in subclasses
+
+  /**
+   * Gets the ES2015 `default` export from this module, or for other types of modules,
+   * gets a bulk exported node.
+   *
+   * This can be used to determine which value a default-import will likely refer to,
+   * as the interaction between different module types is not standardized.
+   */
+  DataFlow::Node getDefaultOrBulkExport() {
+    result = [getAnExportedValue("default"), getABulkExportedNode()]
+  }
+
   /**
    * Gets the root folder relative to which the given import path (which must
    * appear in this module) is resolved.

javascript/ql/lib/semmle/javascript/NodeJS.qll

@@ -99,6 +99,13 @@ class NodeModule extends Module {
     )
   }
 
+  override DataFlow::Node getABulkExportedNode() {
+    exists(DataFlow::PropWrite write |
+      write.getBase().asExpr() = getModuleVariable().getAnAccess() and
+      result = write.getRhs()
+    )
+  }
+
   /** Gets a symbol that the module object inherits from its prototypes. */
   private string getAnImplicitlyExportedSymbol() {
     exists(ExternalConstructor ec | ec = getPrototypeOfExportedExpr() |

javascript/ql/lib/semmle/javascript/frameworks/Vue.qll

@@ -21,7 +21,7 @@ module Vue {
     override DataFlow::SourceNode getAUse() { none() }
 
     override DataFlow::Node getARhs() {
-      result = any(SingleFileComponent c).getModule().getAnExportedValue("default")
+      result = any(SingleFileComponent c).getModule().getDefaultOrBulkExport()
     }
   }
 
@@ -550,10 +550,8 @@ module Vue {
     }
 
     override API::Node getOwnOptions() {
-      exists(ExportDefaultDeclaration decl |
-        decl.getTopLevel() = getModule() and
-        result.getARhs() = DataFlow::valueNode(decl.getOperand())
-      )
+      // Use the entry point generated by `VueExportEntryPoint`
+      result.getARhs() = getModule().getDefaultOrBulkExport()
     }
 
     override DataFlow::Node getOwnOptionsObject() {