You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/migrating-javascript-dataflow-queries.rst
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,10 +8,10 @@ library used by other languages. This library has now been deprecated in favor o
8
8
9
9
This article explains how to migrate JavaScript data flow queries to use the shared data flow library,
10
10
and some important differences to be aware of. Note that the article on :ref:`analyzing data flow in JavaScript and TypeScript <analyzing-data-flow-in-javascript-and-typescript>`
11
-
provides a general guide to new data flow library, whereas this article aims to help with migrating existing queries from the old data flow library.
11
+
provides a general guide to the new data flow library, whereas this article aims to help with migrating existing queries from the old data flow library.
12
12
13
13
Note that the ``DataFlow::Configuration`` class is still backed by the original data flow library, but has been marked as deprecated.
14
-
This means data flow queries using this class will continue work, albeit with deprecation warnings, until the 1-year deprecation period expires in early 2026.
14
+
This means data flow queries using this class will continue to work, albeit with deprecation warnings, until the 1-year deprecation period expires in early 2026.
15
15
It is recommended that all custom queries are migrated before this time, to ensure they continue to work in the future.
16
16
17
17
Data flow queries should be migrated to use ``DataFlow::ConfigSig``-style modules instead of the ``DataFlow::Configuration`` class.
@@ -30,9 +30,9 @@ with the shared data flow library when they have been migrated to ``ConfigSig``-
30
30
* - ``DataFlow::ConfigSig``
31
31
- Shared library
32
32
33
-
A straight-forward translation to ``DataFlow::ConfigSig``-style is usually possible, although there are some complications
33
+
A straightforward translation to ``DataFlow::ConfigSig``-style is usually possible, although there are some complications
34
34
that may cause the query to behave differently.
35
-
We'll first cover some straight-forward migration examples, and then go over some of the complications that may arise.
35
+
We'll first cover some straightforward migration examples, and then go over some of the complications that may arise.
36
36
37
37
Simple migration example
38
38
------------------------
@@ -78,10 +78,10 @@ With the new style this would look like this:
78
78
where MyFlow::flowPath(source, sink)
79
79
select sink, source, sink, "Flow found"
80
80
81
-
The changes can be summarised as:
81
+
The changes can be summarized as:
82
82
83
83
- The ``DataFlow::Configuration`` class was replaced with a module implementing ``DataFlow::ConfigSig``.
84
-
- The characteristic predicate was removed (modules have no characteristic predicates)
84
+
- The characteristic predicate was removed (modules have no characteristic predicates).
85
85
- Predicates such as ``isSource`` no longer have the ``override`` keyword (as they are defined in a module now).
86
86
- The configuration module is being passed to ``DataFlow::Global``, resulting in a new module, called ``MyFlow`` in this example.
87
87
- The query imports ``MyFlow::PathGraph`` instead of ``DataFlow::PathGraph``.
@@ -94,7 +94,7 @@ With these changes, we have produced an equivalent query that is backed by the n
94
94
Taint tracking
95
95
--------------
96
96
97
-
For configuration classes extending ``TaintTracking::Configuration``, the migration is similar but with few differences:
97
+
For configuration classes extending ``TaintTracking::Configuration``, the migration is similar but with a few differences:
98
98
99
99
- The ``TaintTracking::Global`` module should be used instead of ``DataFlow::Global``.
100
100
- The ``isSanitizer`` predicate should be renamed to ``isBarrier``.
@@ -134,7 +134,7 @@ or ``TaintTracking::GlobalWithState``. See :ref:`using flow state <using-flow-la
134
134
135
135
Some changes to be aware of:
136
136
137
-
- The 4-argument version of ``isAdditionalFlowStep`` now takes parameter in a different order.
137
+
- The 4-argument version of ``isAdditionalFlowStep`` now takes parameters in a different order.
138
138
It now takes ``node1, state1, node2, state2`` instead of ``node1, node2, state1, state2``.
139
139
- Taint steps apply to all flow states, not just the ``taint`` flow label. See more details further down in this article.
140
140
@@ -143,7 +143,7 @@ Barrier guards
143
143
144
144
The predicates ``isBarrierGuard`` and ``isSanitizerGuard`` have been removed.
145
145
146
-
Instead, the ``isBarrier`` predicate must used to define all barriers. To do this, barrier guards can be reduced to a set of barrier nodes using the ``DataFlow::MakeBarrierGuard`` module.
146
+
Instead, the ``isBarrier`` predicate must be used to define all barriers. To do this, barrier guards can be reduced to a set of barrier nodes using the ``DataFlow::MakeBarrierGuard`` module.
147
147
148
148
For example, consider this data flow configuration using a barrier guard:
149
149
@@ -179,7 +179,7 @@ This can be migrated to the shared data flow library as follows:
179
179
predicate blocksExpr(Expr e, boolean outcome) { ... }
180
180
}
181
181
182
-
The changes can be summarised as:
182
+
The changes can be summarized as:
183
183
- The contents of ``isBarrierGuard`` have been moved to ``isBarrier``.
184
184
- The ``node instanceof MyBarrierGuard`` check was replaced with ``node = DataFlow::MakeBarrierGuard<MyBarrierGuard>::getABarrierNode()``.
185
185
- The ``MyBarrierGuard`` class no longer has ``DataFlow::BarrierGuardNode`` as a base class. We simply use ``DataFlow::Node`` instead.
@@ -190,11 +190,11 @@ See :ref:`using flow state <using-flow-labels-for-precise-data-flow-analysis>` f
190
190
Query-specific load and store steps
191
191
-----------------------------------
192
192
193
-
The predicates ``isAdditionalLoadStep``, ``isAdditionalStoreStep``, and ``isAdditionalLoadStoreStep`` have been removed. There is no way to emulate the original behaviour.
193
+
The predicates ``isAdditionalLoadStep``, ``isAdditionalStoreStep``, and ``isAdditionalLoadStoreStep`` have been removed. There is no way to emulate the original behavior.
194
194
195
195
Library models can still contribute such steps, but they will be applicable to all queries. Also see the section on jump steps further down.
196
196
197
-
Changes in behaviour
197
+
Changes in behavior
198
198
--------------------
199
199
200
200
When the query has been migrated to the new interface, it may seem to behave differently due to some technical differences in the internals of
@@ -205,11 +205,11 @@ Taint steps now propagate all flow states
205
205
206
206
There's an important change from the old data flow library when using flow state and taint-tracking together.
207
207
208
-
When using when using ``TaintTracking::GlobalWithState``, all flow states can propagate along taint steps.
208
+
When using ``TaintTracking::GlobalWithState``, all flow states can propagate along taint steps.
209
209
In the old data flow library, only the ``taint`` flow label could propagate along taint steps.
210
210
A straight-forward translation of such a query may therefore result in new flow paths being found, which might be unexpected.
211
211
212
-
To emulate the old behaviour, use ``DataFlow::GlobalWithState`` instead of ``TaintTracking::GlobalWithState``,
212
+
To emulate the old behavior, use ``DataFlow::GlobalWithState`` instead of ``TaintTracking::GlobalWithState``,
213
213
and manually add taint steps using ``isAdditionalFlowStep``. The predicate ``TaintTracking::defaultTaintStep`` can be used to access to the set of taint steps.
214
214
215
215
For example:
@@ -276,7 +276,7 @@ Because this step crosses a function boundary, it becomes a jump step. This can
276
276
See :ref:`customizing library models for JavaScript <customizing-library-models-for-javascript>` for details about the format of the ``input`` and ``output`` strings.
277
277
The aforementioned article also provides guidance on how to store the flow summary in a data extension.
278
278
279
-
For query-specific steps that cross function boundaries, that is, steps added with ``isAdditionalFlowStep``, there is currently no way to emulate the original behaviour.
279
+
For query-specific steps that cross function boundaries, that is, steps added with ``isAdditionalFlowStep``, there is currently no way to emulate the original behavior.
280
280
A possible workaround is to convert the query-specific step to a flow summary. In this case it should be stored in a data extension to avoid performance issues, although this also means
281
281
that all other queries will be able to use the flow summary.
282
282
@@ -289,7 +289,7 @@ In the old data flow library, only barriers specific to the ``data`` flow label
289
289
290
290
This rarely has significant impact, but some users may observe some result changes because of this.
291
291
292
-
There is currently no way to emulate the original behavour.
292
+
There is currently no way to emulate the original behavior.
0 commit comments