Skip to content

Commit fd51142

Browse files
erik-krogherik-krogh
committed
change succ in storeStep to be a SourceNode 
1 parent 6827b84 commit fd51142

File tree

5 files changed

+29
-30
lines changed

5 files changed

+29
-30
lines changed

‎javascript/ql/src/semmle/javascript/Arrays.qll

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,10 @@ private module ArrayDataFlow {
155155
this.getMethodName() = "unshift"
156156
}
157157

158-
override predicate storeStep(DataFlow::Node element, DataFlow::Node obj, string prop) {
158+
override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
159159
prop = arrayElement() and
160160
element = this.getAnArgument() and
161-
obj = this.getReceiver().getALocalSource()
161+
obj.getAMethodCall() = this
162162
}
163163
}
164164

@@ -188,10 +188,10 @@ private module ArrayDataFlow {
188188
element = this
189189
}
190190

191-
override predicate storeStep(DataFlow::Node element, DataFlow::Node obj, string prop) {
191+
override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
192192
prop = arrayElement() and
193193
element = this.(DataFlow::PropWrite).getRhs() and
194-
this = obj.(DataFlow::SourceNode).getAPropertyWrite()
194+
this = obj.getAPropertyWrite()
195195
}
196196
}
197197

@@ -234,7 +234,7 @@ private module ArrayDataFlow {
234234
element = getCallback(0).getParameter(0)
235235
}
236236

237-
override predicate storeStep(DataFlow::Node element, DataFlow::Node obj, string prop) {
237+
override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
238238
this.getMethodName() = "map" and
239239
prop = arrayElement() and
240240
element = this.getCallback(0).getAReturn() and
@@ -254,7 +254,7 @@ private module ArrayDataFlow {
254254
private class ArrayCreationStep extends DataFlow::AdditionalFlowStep, DataFlow::Node {
255255
ArrayCreationStep() { this instanceof DataFlow::ArrayCreationNode }
256256

257-
override predicate storeStep(DataFlow::Node element, DataFlow::Node obj, string prop) {
257+
override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
258258
prop = arrayElement() and
259259
element = this.(DataFlow::ArrayCreationNode).getAnElement() and
260260
obj = this
@@ -268,10 +268,10 @@ private module ArrayDataFlow {
268268
private class ArraySpliceStep extends DataFlow::AdditionalFlowStep, DataFlow::MethodCallNode {
269269
ArraySpliceStep() { this.getMethodName() = "splice" }
270270

271-
override predicate storeStep(DataFlow::Node element, DataFlow::Node obj, string prop) {
271+
override predicate storeStep(DataFlow::Node element, DataFlow::SourceNode obj, string prop) {
272272
prop = arrayElement() and
273273
element = getArgument(2) and
274-
obj = this.getReceiver().getALocalSource()
274+
this = obj.getAMethodCall()
275275
}
276276
}
277277

‎javascript/ql/src/semmle/javascript/Collections.qll

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,9 @@ abstract private class CollectionFlowStep extends DataFlow::AdditionalFlowStep {
5252
/**
5353
* Holds if `pred` should be stored in the object `succ` under the property `prop`.
5454
*/
55-
predicate store(DataFlow::Node pred, DataFlow::Node succ, PseudoProperty prop) { none() }
55+
predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, PseudoProperty prop) { none() }
5656

57-
final override predicate storeStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
57+
final override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
5858
this.store(pred, succ, prop)
5959
}
6060

@@ -132,8 +132,8 @@ private module CollectionDataFlow {
132132
private class SetAdd extends CollectionFlowStep, DataFlow::MethodCallNode {
133133
SetAdd() { this.getMethodName() = "add" }
134134

135-
override predicate store(DataFlow::Node element, DataFlow::Node obj, PseudoProperty prop) {
136-
this = obj.(DataFlow::SourceNode).getAMethodCall() and
135+
override predicate store(DataFlow::Node element, DataFlow::SourceNode obj, PseudoProperty prop) {
136+
this = obj.getAMethodCall() and
137137
element = this.getArgument(0) and
138138
prop = setElement()
139139
}
@@ -226,8 +226,8 @@ private module CollectionDataFlow {
226226
class MapSet extends CollectionFlowStep, DataFlow::MethodCallNode {
227227
MapSet() { this.getMethodName() = "set" }
228228

229-
override predicate store(DataFlow::Node element, DataFlow::Node obj, PseudoProperty prop) {
230-
this = obj.(DataFlow::SourceNode).getAMethodCall() and
229+
override predicate store(DataFlow::Node element, DataFlow::SourceNode obj, PseudoProperty prop) {
230+
this = obj.getAMethodCall() and
231231
element = this.getArgument(1) and
232232
prop = getAPseudoProperty()
233233
}

‎javascript/ql/src/semmle/javascript/Promises.qll

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -232,9 +232,9 @@ abstract private class PromiseFlowStep extends DataFlow::AdditionalFlowStep {
232232
/**
233233
* Holds if `pred` should be stored in the object `succ` under the property `prop`.
234234
*/
235-
predicate store(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
235+
predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
236236

237-
final override predicate storeStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
237+
final override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
238238
this.store(pred, succ, prop)
239239
}
240240

@@ -273,7 +273,7 @@ private module PromiseFlow {
273273

274274
PromiseDefitionStep() { this = promise }
275275

276-
override predicate store(DataFlow::Node pred, DataFlow::Node succ, string prop) {
276+
override predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
277277
prop = valueProp() and
278278
pred = promise.getResolveParameter().getACall().getArgument(0) and
279279
succ = this
@@ -302,7 +302,7 @@ private module PromiseFlow {
302302

303303
CreationStep() { this = promise }
304304

305-
override predicate store(DataFlow::Node pred, DataFlow::Node succ, string prop) {
305+
override predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
306306
prop = valueProp() and
307307
pred = promise.getValue() and
308308
succ = this
@@ -368,7 +368,7 @@ private module PromiseFlow {
368368
succ = this
369369
}
370370

371-
override predicate store(DataFlow::Node pred, DataFlow::Node succ, string prop) {
371+
override predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
372372
prop = valueProp() and
373373
pred = getCallback([0 .. 1]).getAReturn() and
374374
succ = this
@@ -402,7 +402,7 @@ private module PromiseFlow {
402402
succ = this
403403
}
404404

405-
override predicate store(DataFlow::Node pred, DataFlow::Node succ, string prop) {
405+
override predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
406406
prop = errorProp() and
407407
pred = getCallback(0).getExceptionalReturn() and
408408
succ = this
@@ -430,7 +430,7 @@ private module PromiseFlow {
430430
succ = this
431431
}
432432

433-
override predicate store(DataFlow::Node pred, DataFlow::Node succ, string prop) {
433+
override predicate store(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
434434
prop = errorProp() and
435435
pred = getCallback(0).getExceptionalReturn() and
436436
succ = this

‎javascript/ql/src/semmle/javascript/dataflow/Configuration.qll

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -244,8 +244,11 @@ abstract class Configuration extends string {
244244
* EXPERIMENTAL. This API may change in the future.
245245
*
246246
* Holds if `pred` should be stored in the object `succ` under the property `prop`.
247+
* The object `succ` must be a `DataFlow::SourceNode` for the object wherein the value is stored.
247248
*/
248-
predicate isAdditionalStoreStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
249+
predicate isAdditionalStoreStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
250+
none()
251+
}
249252

250253
/**
251254
* EXPERIMENTAL. This API may change in the future.
@@ -540,9 +543,10 @@ abstract class AdditionalFlowStep extends DataFlow::Node {
540543
* EXPERIMENTAL. This API may change in the future.
541544
*
542545
* Holds if `pred` should be stored in the object `succ` under the property `prop`.
546+
* The object `succ` must be a `DataFlow::SourceNode` for the object wherein the value is stored.
543547
*/
544548
cached
545-
predicate storeStep(DataFlow::Node pred, DataFlow::Node succ, string prop) { none() }
549+
predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) { none() }
546550

547551
/**
548552
* EXPERIMENTAL. This API may change in the future.

‎javascript/ql/src/semmle/javascript/dataflow/TaintTracking.qll

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -603,15 +603,10 @@ module TaintTracking {
603603
* 3) A `URLSearchParams` object (either `url.searchParams` or `new URLSearchParams(input)`) has a tainted value,
604604
* which can be accessed using a `get` or `getAll` call. (See getableUrlPseudoProperty())
605605
*/
606-
override predicate storeStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
606+
override predicate storeStep(DataFlow::Node pred, DataFlow::SourceNode succ, string prop) {
607607
succ = this and
608608
(
609-
(
610-
prop = "searchParams" or
611-
prop = "hash" or
612-
prop = "search" or
613-
prop = hiddenUrlPseudoProperty()
614-
) and
609+
prop = ["searchParams", "hash", "search", hiddenUrlPseudoProperty()] and
615610
exists(DataFlow::NewNode newUrl | succ = newUrl |
616611
newUrl = DataFlow::globalVarRef("URL").getAnInstantiation() and
617612
pred = newUrl.getArgument(0)

0 commit comments

Comments
 (0)