|
| 1 | +/** |
| 2 | + * This file patches an incompatibility introduced into the standard data flow library between |
| 3 | + * class DataFlow::Configurations and `summmaryModels` added in models-as-data files, and likely |
| 4 | + * introduced in this PR: https://github.com/github/codeql/pull/19445/files. |
| 5 | + */ |
| 6 | + |
| 7 | +import javascript |
| 8 | +import semmle.javascript.dataflow.internal.FlowSummaryPrivate |
| 9 | +private import semmle.javascript.frameworks.data.internal.ApiGraphModels as Shared |
| 10 | + |
| 11 | +/** |
| 12 | + * Holds if `path` is an input or output spec for a summary with the given `base` node. |
| 13 | + */ |
| 14 | +pragma[nomagic] |
| 15 | +private predicate relevantInputOutputPath(API::InvokeNode base, AccessPath inputOrOutput) { |
| 16 | + exists(string type, string input, string output, string path | |
| 17 | + ModelOutput::resolvedSummaryBase(type, path, base) and |
| 18 | + ModelOutput::relevantSummaryModel(type, path, input, output, _, _) and |
| 19 | + inputOrOutput = [input, output] |
| 20 | + ) |
| 21 | +} |
| 22 | + |
| 23 | +/** |
| 24 | + * Gets the API node for the first `n` tokens of the given input/output path, evaluated relative to `baseNode`. |
| 25 | + */ |
| 26 | +private API::Node getNodeFromInputOutputPath(API::InvokeNode baseNode, AccessPath path, int n) { |
| 27 | + relevantInputOutputPath(baseNode, path) and |
| 28 | + ( |
| 29 | + n = 1 and |
| 30 | + result = Shared::getSuccessorFromInvoke(baseNode, path.getToken(0)) |
| 31 | + or |
| 32 | + result = |
| 33 | + Shared::getSuccessorFromNode(getNodeFromInputOutputPath(baseNode, path, n - 1), |
| 34 | + path.getToken(n - 1)) |
| 35 | + ) |
| 36 | +} |
| 37 | + |
| 38 | +/** |
| 39 | + * Gets the API node for the given input/output path, evaluated relative to `baseNode`. |
| 40 | + */ |
| 41 | +private API::Node getNodeFromInputOutputPath(API::InvokeNode baseNode, AccessPath path) { |
| 42 | + result = getNodeFromInputOutputPath(baseNode, path, path.getNumToken()) |
| 43 | +} |
| 44 | + |
| 45 | +private predicate summaryStep(API::Node pred, API::Node succ, string kind) { |
| 46 | + exists(string type, string path, API::InvokeNode base, AccessPath input, AccessPath output | |
| 47 | + ModelOutput::relevantSummaryModel(type, path, input, output, kind, _) and |
| 48 | + ModelOutput::resolvedSummaryBase(type, path, base) and |
| 49 | + pred = getNodeFromInputOutputPath(base, input) and |
| 50 | + succ = getNodeFromInputOutputPath(base, output) |
| 51 | + ) |
| 52 | +} |
| 53 | + |
| 54 | +/** |
| 55 | + * Like `ModelOutput::summaryStep` but with API nodes mapped to data-flow nodes. |
| 56 | + */ |
| 57 | +private predicate summaryStepNodes(DataFlow::Node pred, DataFlow::Node succ, string kind) { |
| 58 | + exists(API::Node predNode, API::Node succNode | |
| 59 | + summaryStep(predNode, succNode, kind) and |
| 60 | + pred = predNode.asSink() and |
| 61 | + succ = succNode.asSource() |
| 62 | + ) |
| 63 | +} |
| 64 | + |
| 65 | +/** Data flow steps induced by summary models of kind `value`. */ |
| 66 | +private class DataFlowStepFromSummary extends DataFlow::SharedFlowStep { |
| 67 | + override predicate step(DataFlow::Node pred, DataFlow::Node succ) { |
| 68 | + summaryStepNodes(pred, succ, "value") |
| 69 | + } |
| 70 | +} |
| 71 | + |
| 72 | +/** Taint steps induced by summary models of kind `taint`. */ |
| 73 | +private class TaintStepFromSummary extends TaintTracking::SharedTaintStep { |
| 74 | + override predicate step(DataFlow::Node pred, DataFlow::Node succ) { |
| 75 | + summaryStepNodes(pred, succ, "taint") |
| 76 | + } |
| 77 | +} |
0 commit comments