Skip to content

Commit 090c6fb

Browse files
erik-krogherik-krogh
committed
JS: fix ql/field-only-used-in-charpred within JavaScript
1 parent c449469 commit 090c6fb

30 files changed

+147
-181
lines changed

‎javascript/ql/lib/semmle/javascript/Arrays.qll

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -152,15 +152,12 @@ private module ArrayDataFlow {
152152
/**
153153
* A node that reads or writes an element from an array inside a for-loop.
154154
*/
155-
private class ArrayIndexingAccess extends DataFlow::Node {
156-
DataFlow::PropRef read;
157-
155+
private class ArrayIndexingAccess extends DataFlow::Node instanceof DataFlow::PropRef {
158156
ArrayIndexingAccess() {
159-
read = this and
160157
TTNumber() =
161-
unique(InferredType type | type = read.getPropertyNameExpr().flow().analyze().getAType()) and
158+
unique(InferredType type | type = super.getPropertyNameExpr().flow().analyze().getAType()) and
162159
exists(VarAccess i, ExprOrVarDecl init |
163-
i = read.getPropertyNameExpr() and init = any(ForStmt f).getInit()
160+
i = super.getPropertyNameExpr() and init = any(ForStmt f).getInit()
164161
|
165162
i.getVariable().getADefinition() = init or
166163
i.getVariable().getADefinition().(VariableDeclarator).getDeclStmt() = init

‎javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -445,9 +445,8 @@ module DataFlow {
445445
*/
446446
private class ReflectiveCallNode extends Node, TReflectiveCallNode {
447447
MethodCallExpr call;
448-
string kind;
449448

450-
ReflectiveCallNode() { this = TReflectiveCallNode(call, kind) }
449+
ReflectiveCallNode() { this = TReflectiveCallNode(call, _) }
451450

452451
override BasicBlock getBasicBlock() { result = call.getBasicBlock() }
453452

‎javascript/ql/lib/semmle/javascript/dataflow/internal/InterModuleTypeInference.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -379,9 +379,10 @@ private class AnalyzedExportAssign extends AnalyzedPropertyWrite, DataFlow::Valu
379379
*/
380380
private class AnalyzedClosureExportAssign extends AnalyzedPropertyWrite, DataFlow::ValueNode {
381381
override AssignExpr astNode;
382-
Closure::ClosureModule mod;
383382

384-
AnalyzedClosureExportAssign() { astNode.getLhs() = mod.getExportsVariable().getAReference() }
383+
AnalyzedClosureExportAssign() {
384+
astNode.getLhs() = any(Closure::ClosureModule mod).getExportsVariable().getAReference()
385+
}
385386

386387
override predicate writes(AbstractValue baseVal, string propName, DataFlow::AnalyzedNode source) {
387388
baseVal = TAbstractModuleObject(astNode.getTopLevel()) and

‎javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -302,12 +302,11 @@ private class TypeInferredMethodWithAnalyzedReturnFlow extends CallWithNonLocalA
302302
* Propagates receivers into locally defined callbacks of partial invocations.
303303
*/
304304
private class AnalyzedThisInPartialInvokeCallback extends AnalyzedNode, DataFlow::ThisNode {
305-
DataFlow::PartialInvokeNode call;
306305
DataFlow::Node receiver;
307306

308307
AnalyzedThisInPartialInvokeCallback() {
309308
exists(DataFlow::Node callbackArg |
310-
receiver = call.getBoundReceiver(callbackArg) and
309+
receiver = any(DataFlow::PartialInvokeNode call).getBoundReceiver(callbackArg) and
311310
getBinder().flowsTo(callbackArg)
312311
)
313312
}

‎javascript/ql/lib/semmle/javascript/explore/BackwardDataFlow.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,7 @@
1616
import javascript
1717

1818
private class BackwardExploringConfiguration extends DataFlow::Configuration {
19-
DataFlow::Configuration cfg;
20-
21-
BackwardExploringConfiguration() { this = cfg }
19+
BackwardExploringConfiguration() { this = any(DataFlow::Configuration cfg) }
2220

2321
override predicate isSource(DataFlow::Node node) { any() }
2422

‎javascript/ql/lib/semmle/javascript/explore/ForwardDataFlow.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,7 @@
1414
import javascript
1515

1616
private class ForwardExploringConfiguration extends DataFlow::Configuration {
17-
DataFlow::Configuration cfg;
18-
19-
ForwardExploringConfiguration() { this = cfg }
17+
ForwardExploringConfiguration() { this = any(DataFlow::Configuration cfg) }
2018

2119
override predicate isSink(DataFlow::Node node) { any() }
2220

‎javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSCore.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -149,12 +149,10 @@ DataFlow::CallNode moduleRef(AngularModule m) {
149149
* A call to a method from the `angular.Module` API.
150150
*/
151151
class ModuleApiCall extends DataFlow::CallNode {
152-
/** The module on which the method is called. */
153-
AngularModule mod;
154152
/** The name of the called method. */
155153
string methodName;
156154

157-
ModuleApiCall() { this = moduleRef(mod).getAMethodCall(methodName) }
155+
ModuleApiCall() { this = moduleRef(_).getAMethodCall(methodName) }
158156

159157
/**
160158
* Gets the name of the invoked method.

‎javascript/ql/lib/semmle/javascript/frameworks/AngularJS/AngularJSExpressions.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,9 @@ private string getInterpolatedExpressionPattern() { result = "(?<=\\{\\{).*?(?=\
6565
*/
6666
private class HtmlTextNodeAsNgSourceProvider extends NgSourceProvider, HTML::TextNode {
6767
string source;
68-
int offset;
6968

7069
HtmlTextNodeAsNgSourceProvider() {
71-
source = this.getText().regexpFind(getInterpolatedExpressionPattern(), _, offset)
70+
source = this.getText().regexpFind(getInterpolatedExpressionPattern(), _, _)
7271
}
7372

7473
override predicate providesSourceAt(

‎javascript/ql/lib/semmle/javascript/frameworks/Babel.qll

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,17 +140,15 @@ module Babel {
140140
*/
141141
private class BabelRootTransformedPathExpr extends PathExpr, Expr {
142142
RootImportConfig plugin;
143-
string rawPath;
144143
string prefix;
145144
string mappedPrefix;
146145
string suffix;
147146

148147
BabelRootTransformedPathExpr() {
149148
this instanceof PathExpr and
150149
plugin.appliesTo(getTopLevel()) and
151-
rawPath = getStringValue() and
152-
prefix = rawPath.regexpCapture("(.)/(.*)", 1) and
153-
suffix = rawPath.regexpCapture("(.)/(.*)", 2) and
150+
prefix = getStringValue().regexpCapture("(.)/(.*)", 1) and
151+
suffix = getStringValue().regexpCapture("(.)/(.*)", 2) and
154152
mappedPrefix = plugin.getRoot(prefix)
155153
}
156154

‎javascript/ql/lib/semmle/javascript/frameworks/CryptoLibraries.qll

Lines changed: 19 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -378,10 +378,9 @@ private module CryptoJS {
378378
* A model of the TweetNaCl library.
379379
*/
380380
private module TweetNaCl {
381-
private class Apply extends CryptographicOperation {
381+
private class Apply extends CryptographicOperation instanceof MethodCallExpr {
382382
Expr input;
383383
CryptographicAlgorithm algorithm;
384-
MethodCallExpr mce;
385384

386385
Apply() {
387386
/*
@@ -395,15 +394,14 @@ private module TweetNaCl {
395394
* Also matches the "hash" method name, and the "nacl-fast" module.
396395
*/
397396

398-
this = mce and
399397
exists(DataFlow::SourceNode mod, string name |
400398
name = "hash" and algorithm.matchesName("SHA512")
401399
or
402400
name = "sign" and algorithm.matchesName("ed25519")
403401
|
404402
(mod = DataFlow::moduleImport("nacl") or mod = DataFlow::moduleImport("nacl-fast")) and
405-
mce = mod.getAMemberCall(name).asExpr() and
406-
mce.getArgument(0) = input
403+
this = mod.getAMemberCall(name).asExpr() and
404+
super.getArgument(0) = input
407405
)
408406
}
409407

@@ -440,10 +438,9 @@ private module HashJs {
440438
)
441439
}
442440

443-
private class Apply extends CryptographicOperation {
441+
private class Apply extends CryptographicOperation instanceof MethodCallExpr {
444442
Expr input;
445443
CryptographicAlgorithm algorithm; // non-functional
446-
MethodCallExpr mce;
447444

448445
Apply() {
449446
/*
@@ -459,9 +456,8 @@ private module HashJs {
459456
* Also matches where `hash.<algorithmName>()` has been replaced by a more specific require a la `require("hash.js/lib/hash/sha/512")`
460457
*/
461458

462-
this = mce and
463-
mce = getAlgorithmExpr(algorithm).getAMemberCall("update").asExpr() and
464-
input = mce.getArgument(0)
459+
this = getAlgorithmExpr(algorithm).getAMemberCall("update").asExpr() and
460+
input = super.getArgument(0)
465461
}
466462

467463
override Expr getInput() { result = input }
@@ -535,16 +531,14 @@ private module Forge {
535531
override CryptographicAlgorithm getAlgorithm() { result = algorithm }
536532
}
537533

538-
private class Apply extends CryptographicOperation {
534+
private class Apply extends CryptographicOperation instanceof MethodCallExpr {
539535
Expr input;
540536
CryptographicAlgorithm algorithm; // non-functional
541-
MethodCallExpr mce;
542537

543538
Apply() {
544-
this = mce and
545539
exists(Cipher cipher |
546-
mce = cipher.getAMemberCall("update").asExpr() and
547-
mce.getArgument(0) = input and
540+
this = cipher.getAMemberCall("update").asExpr() and
541+
super.getArgument(0) = input and
548542
algorithm = cipher.getAlgorithm()
549543
)
550544
}
@@ -596,19 +590,17 @@ private module Forge {
596590
* A model of the md5 library.
597591
*/
598592
private module Md5 {
599-
private class Apply extends CryptographicOperation {
593+
private class Apply extends CryptographicOperation instanceof CallExpr {
600594
Expr input;
601595
CryptographicAlgorithm algorithm;
602-
CallExpr call;
603596

604597
Apply() {
605598
// `require("md5")("message");`
606-
this = call and
607599
exists(DataFlow::SourceNode mod |
608600
mod = DataFlow::moduleImport("md5") and
609601
algorithm.matchesName("MD5") and
610-
call = mod.getACall().asExpr() and
611-
call.getArgument(0) = input
602+
this = mod.getACall().asExpr() and
603+
super.getArgument(0) = input
612604
)
613605
}
614606

@@ -622,14 +614,12 @@ private module Md5 {
622614
* A model of the bcrypt, bcryptjs, bcrypt-nodejs libraries.
623615
*/
624616
private module Bcrypt {
625-
private class Apply extends CryptographicOperation {
617+
private class Apply extends CryptographicOperation instanceof MethodCallExpr {
626618
Expr input;
627619
CryptographicAlgorithm algorithm;
628-
MethodCallExpr mce;
629620

630621
Apply() {
631622
// `require("bcrypt").hash(password);` with minor naming variations
632-
this = mce and
633623
exists(DataFlow::SourceNode mod, string moduleName, string methodName |
634624
algorithm.matchesName("BCRYPT") and
635625
(
@@ -642,8 +632,8 @@ private module Bcrypt {
642632
methodName = "hashSync"
643633
) and
644634
mod = DataFlow::moduleImport(moduleName) and
645-
mce = mod.getAMemberCall(methodName).asExpr() and
646-
mce.getArgument(0) = input
635+
this = mod.getAMemberCall(methodName).asExpr() and
636+
super.getArgument(0) = input
647637
)
648638
}
649639

@@ -657,20 +647,18 @@ private module Bcrypt {
657647
* A model of the hasha library.
658648
*/
659649
private module Hasha {
660-
private class Apply extends CryptographicOperation {
650+
private class Apply extends CryptographicOperation instanceof CallExpr {
661651
Expr input;
662652
CryptographicAlgorithm algorithm;
663-
CallExpr call;
664653

665654
Apply() {
666655
// `require('hasha')('unicorn', { algorithm: "md5" });`
667-
this = call and
668656
exists(DataFlow::SourceNode mod, string algorithmName, Expr algorithmNameNode |
669657
mod = DataFlow::moduleImport("hasha") and
670-
call = mod.getACall().asExpr() and
671-
call.getArgument(0) = input and
658+
this = mod.getACall().asExpr() and
659+
super.getArgument(0) = input and
672660
algorithm.matchesName(algorithmName) and
673-
call.hasOptionArgument(1, "algorithm", algorithmNameNode) and
661+
super.hasOptionArgument(1, "algorithm", algorithmNameNode) and
674662
algorithmNameNode.mayHaveStringValue(algorithmName)
675663
)
676664
}

‎javascript/ql/lib/semmle/javascript/frameworks/HTTP.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -411,10 +411,10 @@ module HTTP {
411411
* E.g. `chunk` in: `http.createServer().on('request', (req, res) => req.on("data", (chunk) => ...))`.
412412
*/
413413
private class ServerRequestDataEvent extends RemoteFlowSource, DataFlow::ParameterNode {
414-
RequestSource req;
415-
416414
ServerRequestDataEvent() {
417-
exists(DataFlow::MethodCallNode mcn | mcn = req.ref().getAMethodCall(EventEmitter::on()) |
415+
exists(DataFlow::MethodCallNode mcn, RequestSource req |
416+
mcn = req.ref().getAMethodCall(EventEmitter::on())
417+
|
418418
mcn.getArgument(0).mayHaveStringValue("data") and
419419
this = mcn.getABoundCallbackParameter(1, 0)
420420
)

‎javascript/ql/lib/semmle/javascript/frameworks/HttpProxy.qll

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,13 @@ private module HttpProxy {
7474
*/
7575
class ProxyListenerCallback extends NodeJSLib::RouteHandler, DataFlow::FunctionNode {
7676
string event;
77-
API::CallNode call;
7877

7978
ProxyListenerCallback() {
80-
call = any(CreateServerCall server).getReturn().getMember(["on", "once"]).getACall() and
81-
call.getParameter(0).getARhs().mayHaveStringValue(event) and
82-
this = call.getParameter(1).getARhs().getAFunctionValue()
79+
exists(API::CallNode call |
80+
call = any(CreateServerCall server).getReturn().getMember(["on", "once"]).getACall() and
81+
call.getParameter(0).getARhs().mayHaveStringValue(event) and
82+
this = call.getParameter(1).getARhs().getAFunctionValue()
83+
)
8384
}
8485

8586
override Parameter getRequestParameter() {

‎javascript/ql/lib/semmle/javascript/frameworks/LdapJS.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ module LdapJS {
2929

3030
/** A reference to a LDAPjs client `search` options. */
3131
class SearchOptions extends API::Node {
32-
ClientCall call;
33-
34-
SearchOptions() { call.getMethodName() = "search" and this = call.getParameter(1) }
32+
SearchOptions() {
33+
exists(ClientCall call | call.getMethodName() = "search" and this = call.getParameter(1))
34+
}
3535
}
3636

3737
/** A creation of an LDAPjs filter, or object containing a filter, that doesn't sanitizes the input. */

‎javascript/ql/lib/semmle/javascript/frameworks/Nest.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -376,11 +376,11 @@ module NestJS {
376376
* redirects to `https://example.com`.
377377
*/
378378
private class ReturnValueAsRedirection extends ServerSideUrlRedirect::Sink {
379-
NestJSRouteHandler handler;
380-
381379
ReturnValueAsRedirection() {
382-
handler.hasRedirectDecorator() and
383-
this = handler.getAReturn().getALocalSource().getAPropertyWrite("url").getRhs()
380+
exists(NestJSRouteHandler handler |
381+
handler.hasRedirectDecorator() and
382+
this = handler.getAReturn().getALocalSource().getAPropertyWrite("url").getRhs()
383+
)
384384
}
385385
}
386386

‎javascript/ql/lib/semmle/javascript/frameworks/Next.qll

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -155,11 +155,7 @@ module NextJS {
155155
* A Next.js function that is exected on the server for every request, seen as a routehandler.
156156
*/
157157
class NextHttpRouteHandler extends HTTP::Servers::StandardRouteHandler, DataFlow::FunctionNode {
158-
Module pageModule;
159-
160-
NextHttpRouteHandler() {
161-
this = getServerSidePropsFunction(pageModule) or this = getInitialProps(pageModule)
162-
}
158+
NextHttpRouteHandler() { this = getServerSidePropsFunction(_) or this = getInitialProps(_) }
163159
}
164160

165161
/**

‎javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1133,17 +1133,17 @@ module NodeJSLib {
11331133
* A connection opened on a NodeJS net server.
11341134
*/
11351135
private class NodeJSNetServerConnection extends EventEmitter::Range {
1136-
NodeJSNetServer server;
1137-
11381136
NodeJSNetServerConnection() {
1139-
exists(DataFlow::MethodCallNode call |
1140-
call = server.ref().getAMethodCall("on") and
1141-
call.getArgument(0).mayHaveStringValue("connection")
1142-
|
1143-
this = call.getCallback(1).getParameter(0)
1137+
exists(NodeJSNetServer server |
1138+
exists(DataFlow::MethodCallNode call |
1139+
call = server.ref().getAMethodCall("on") and
1140+
call.getArgument(0).mayHaveStringValue("connection")
1141+
|
1142+
this = call.getCallback(1).getParameter(0)
1143+
)
1144+
or
1145+
this = server.getCallback([0, 1]).getParameter(0)
11441146
)
1145-
or
1146-
this = server.getCallback([0, 1]).getParameter(0)
11471147
}
11481148

11491149
DataFlow::SourceNode ref() { result = EventEmitter::trackEventEmitter(this) }
@@ -1163,9 +1163,9 @@ module NodeJSLib {
11631163
* A data flow node representing data received from a client to a NodeJS net server, viewed as remote user input.
11641164
*/
11651165
private class NodeJSNetServerItemAsRemoteFlow extends RemoteFlowSource {
1166-
NodeJSNetServerRegistration reg;
1167-
1168-
NodeJSNetServerItemAsRemoteFlow() { this = reg.getReceivedItem(_) }
1166+
NodeJSNetServerItemAsRemoteFlow() {
1167+
this = any(NodeJSNetServerRegistration reg).getReceivedItem(_)
1168+
}
11691169

11701170
override string getSourceType() { result = "NodeJS server" }
11711171
}

‎javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -284,10 +284,8 @@ private class JQueryAttr3Call extends JQueryAttributeDefinition, @call_expr {
284284
* the DOM element constructed by `$("<script/>")`.
285285
*/
286286
private class JQueryChainedElement extends DOM::Element, InvokeExpr {
287-
DOM::Element inner;
288-
289287
JQueryChainedElement() {
290-
exists(JQuery::MethodCall call | this = call.asExpr() |
288+
exists(JQuery::MethodCall call, DOM::Element inner | this = call.asExpr() |
291289
call.getReceiver().asExpr() = inner and
292290
defn = inner.getDefinition()
293291
)

0 commit comments

Comments
 (0)