github / github/codeql

Javascript Taint Tracking

Open
#18,765 5 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

I have the following code:

source.js:
```js
function id(mod) {
return mod;
}

function __importDefault(mod) {
return mod && mod.__esModule
? mod
: {
default: mod,
}
}
var sinkMod0 = __importDefault(require("./sink"))
var sinkMod1 = require("./sink")
var sinkMod2 = id(require("./sink"))
var sinkMod3 = unknown(require("./sink"))

function source(s) {
sinkMod0.default(s)
sinkMod1(s)
sinkMod2(s)
sinkMod3(s)
}
```

sink.js:
```js
module.exports = function (data) {
sink(data)
}
```

I am using the following query to get all calls to `sink` from the source function:
```ql
/**
* @kind path-problem
*/

import javascript
import semmle.javascript.dataflow.TaintTracking

module Config implements DataFlow::ConfigSig {
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }

predicate isSource(DataFlow::Node source) {
exists(Function f |
f.getName() = "source" and
source.asExpr() = f.getAParameter()
)
}

predicate isSink(DataFlow::Node node) {
exists(DataFlow::CallNode cn |
cn.getAnArgument() = node and
cn.getCalleeName() = "sink"
)
}
}

module Flow = DataFlow::Global;

import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, ""
```

The above query doesnt find the flow through `sinkMod3(s)` . Is there a way to get codeQL to treat the `unknown(..)` function as an identity function?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.