Skip to content

Commit 34b86c3

Browse files
committed
JS: Model fs.promises.readFile as file source
You could argue that proper modeling be done in the same way as `NodeJSFileSystemAccessRead` is done for the callback based `fs` API (in NodeJSLib.qll). However, that work is straying from the core goals I'm working towards right now, so I'll argue that "perfect is the enemy of good", and leave this as is for now.
1 parent 971f538 commit 34b86c3

File tree

2 files changed

+10
-2
lines changed

2 files changed

+10
-2
lines changed
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
# Make sure that the extensible model predicates have at least one definition
3+
# to avoid errors about undefined extensionals.
4+
- addsTo:
5+
pack: codeql/javascript-all
6+
extensible: sourceModel
7+
data:
8+
- ['fs', 'Member[promises].Member[readFile].ReturnValue.Member[then].Argument[0].Parameter[0]', 'file']

javascript/ql/test/library-tests/threat-models/sources/sources.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@ const fileContent = fs.readFileSync('file.txt', 'utf8'); // $ threat-source=file
6969
SINK(fileContent); // $ hasFlow
7070

7171
// Accessing file contents using fs.promises
72-
fs.promises.readFile('file.txt', 'utf8').then((data) => { // $ MISSING: threat-source=file
73-
SINK(data); // $ MISSING: hasFlow
72+
fs.promises.readFile('file.txt', 'utf8').then((data) => { // $ threat-source=file
73+
SINK(data); // $ hasFlow
7474
});
7575

7676
// Accessing file contents using fs.createReadStream

0 commit comments

Comments
 (0)