works again.

Author: Caleb Hoover

bin/check

@@ -44,7 +44,7 @@ check.setFlags({
 	verbose: argv.v,
 	recursive: argv.r,
 	json: !argv.j && !argv.v,
-	debug: argv.d
+	debug: argv.d || true
 });
 var Scope = check.Scope;
 

check.js

@@ -1,8 +1,6 @@
 /*
 	;(function() {eval(String(require('fs').readFileSync(process.argv[1])));})()
 */
-	
-// process.on('uncaughtException', function (i) {console.log(i);});
 
 var fs = require('fs'),
 	path = require('path'),
@@ -79,7 +77,6 @@ module.exports.setFlags = function(newFlags) {
 					});
 					traverse(ast, newScope);
 
-
 					r = newScope.vars.module.exports;
 
 				} else
@@ -98,7 +95,10 @@ module.exports.setFlags = function(newFlags) {
 
 		find = function(r, name) {
 			return _.find(r, function(i) {
-				return name.indexOf(i.source.name) === 0;
+				var r = name.indexOf(i.source.name + '.') === 0 ||
+						name.indexOf(i.source.name + '(') === 0 ||
+						name == i.source.name;
+				return r;
 			});
 		};
 
@@ -112,7 +112,7 @@ module.exports.setFlags = function(newFlags) {
 				return;
 			switch(type) {
 				case 'SOURCE':
-					source = find(this.reports, value);
+					var source = find(this.reports, value);
 					if (!source)
 						this.reports.push({
 							source: {
@@ -123,7 +123,7 @@ module.exports.setFlags = function(newFlags) {
 					break;
 				case 'SCE':
 				case 'SCES': // Possible taint: call expression containing the source.
-					source = find(this.reports, value);
+					var source = find(this.reports, value);
 					if (source) {
 						if (!source.chain)
 							source.chain = [];
@@ -137,7 +137,7 @@ module.exports.setFlags = function(newFlags) {
 				case 'SASSIGN':
 					break;
 				case 'SINK':
-					source = find(this.reports, value);
+					var source = find(this.reports, value);
 					if (source)
 						source.sink = {
 							name: name,
@@ -153,6 +153,7 @@ module.exports.setFlags = function(newFlags) {
 					}
 					break;
 			}
+			
 		};
 	} else if (flags.verbose) {
 		Scope.Scope.createNewScope = function() {
@@ -181,10 +182,9 @@ module.exports.setFlags = function(newFlags) {
 				p = 'file://' + path.relative(Scope.Scope.baseFile.split('/').reverse().slice(1).reverse().join('/'), this.file) + ':' + p;
 
 
-			console.log('  ', '[' + type + ']', p, name, value ? value : '');
-
-			// console.log('  ', cs[type]?cs[type]('[' + type + ']'):colors.blue('[' + type + ']'),
-			// 			colors.grey(p), name, value ? value : '');
+		// console.log('  ', '[' + type + ']', p, name, value ? value : '');
+			console.log('  ', cs[type]?cs[type]('[' + type + ']'):colors.blue('[' + type + ']'),
+						colors.grey(p), name, value ? value : '');
 		};
 	}
 

custom.js

@@ -4,21 +4,32 @@ var Scope = require('./scope.js');
 var custom = module.exports.custom = [
 function(scope, node, ce) { // http.get
 	var ceName = scope.resolve(ce.name);
-	if (ceName != 'require(\'http\').get') {
+	if (ceName != "require('http').get") {
 		return false;
 	}
 
 	var func = ce.arguments[1];
 
 	func.scope.sources.push(func.params[1]);
 	func.scope.log('SOURCE', node, false, func.params[1]);
-	traverse(func.body, func.scope);
+	traverse(func.body, func.scope, returnCB);
+	return true;
+}, function (scope, node, ce) {
+	var ceName = scope.resolve(ce.name);
+	if (ceName != "require('http').createServer"){
+		return false;
+	}
+
+	var func = ce.arguments[0];
+	func.scope.sources.push(func.params[0]);
+	func.scope.log('SOURCE', node, false, func.params[0]);
+	traverse(func.body, func.scope, returnCB);
 	return true;
 }, function(scope, node, ce) {// (new require('hapi').server()).route()
-	if (ce.name.indexOf('require(\'hapi\').Server()') === 0)
+	if (ce.name.indexOf("require('hapi').Server()") === 0)
 		return false;
 	var ceName = scope.resolve(ce.name);
-	if (typeof ceName != "string" || ceName.split('.').slice(-1)[0] != 'route')
+	if (typeof ceName != "string" || ceName.split('.').slice(-1)[0] != "route")
 		return false;
 
 	if (ce.arguments[0]) {
@@ -32,7 +43,7 @@ function(scope, node, ce) { // http.get
 		if (func && func.scope) {
 			func.scope.sources.push(func.params[0]);
 			func.scope.log('SOURCE', node, false, func.params[0]);
-			traverse(func.body, func.scope);
+			traverse(func.body, func.scope, returnCB);
 		}
 	}
 
@@ -51,7 +62,7 @@ function(scope, node, ce) { // http.get
 		if (func && func.scope) {
 			func.scope.sources.push(func.params[0]);
 			func.scope.log('SOURCE', node, false, func.params[0]);
-			traverse(func.body, func.scope);
+			traverse(func.body, func.scope, returnCB);
 
 		}
 	}
@@ -60,7 +71,7 @@ function(scope, node, ce) { // http.get
 
 }, function(scope, node, ce) {// require('fs').readFile
 	var ceName = scope.resolve(ce.name);
-	if (ceName != 'require(\'fs\').readFile') {
+	if (ceName != "require(\'fs\').readFile") {
 		return false;
 	}
 
@@ -69,9 +80,25 @@ function(scope, node, ce) { // http.get
 		func.scope.sources.push(func.params[1]); // the 2nd argument is the source
 		func.scope.log('SOURCE', node, false, func.params[1]);
 
-		traverse(func.body, func.scope);
+		traverse(func.body, func.scope, returnCB);
 	}
 	return true;
 }];
 
+var returnCB = function(node) {
+	// Push scope.log. We don't want line 466 to log anything. Then pop it.
+	var l = scope.log; scope.log = function () {};
+	var arg = scope.resolveExpression(node.argument);
+	scope.log = l;
+
+	var resolved = scope.resolve(arg);
+	if (resolved && typeof resolved == 'string') {
+		if (scope.isSource(resolved.name || resolved) || scope.isSource(arg.name || arg)) {
+			if (fe.name)
+				scope.sources.push(fe.name);
+			scope.log('RETURN', node, fe.name, arg, resolved);
+		}
+	}
+};
+
 module.exports = custom;

danger.json

@@ -12,5 +12,5 @@
 	"require\\([\\']express[\\']\\)\\.\\w+"
 ],
 "sources": [
-	"process.argv"
+	{"process.argv": "process.argv"}
 ]}