Javascript Taint Tracking
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
I have the following code:
source.js:
```js
function id(mod) {
return mod;
}
function __importDefault(mod) {
return mod && mod.__esModule
? mod
: {
default: mod,
}
}
var sinkMod0 = __importDefault(require("./sink"))
var sinkMod1 = require("./sink")
var sinkMod2 = id(require("./sink"))
var sinkMod3 = unknown(require("./sink"))
function source(s) {
sinkMod0.default(s)
sinkMod1(s)
sinkMod2(s)
sinkMod3(s)
}
```
sink.js:
```js
module.exports = function (data) {
sink(data)
}
```
I am using the following query to get all calls to `sink` from the source function:
```ql
/**
* @kind path-problem
*/
import javascript
import semmle.javascript.dataflow.TaintTracking
module Config implements DataFlow::ConfigSig {
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }
predicate isSource(DataFlow::Node source) {
exists(Function f |
f.getName() = "source" and
source.asExpr() = f.getAParameter()
)
}
predicate isSink(DataFlow::Node node) {
exists(DataFlow::CallNode cn |
cn.getAnArgument() = node and
cn.getCalleeName() = "sink"
)
}
}
module Flow = DataFlow::Global;
import Flow::PathGraph
from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, ""
```
The above query doesnt find the flow through `sinkMod3(s)` . Is there a way to get codeQL to treat the `unknown(..)` function as an identity function?
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.