Javascript Taint Tracking

I have the following code:

source.js:
```js
function id(mod) {
return mod;
}

function __importDefault(mod) {
return mod && mod.__esModule
? mod
: {
default: mod,
}
}
var sinkMod0 = __importDefault(require("./sink"))
var sinkMod1 = require("./sink")
var sinkMod2 = id(require("./sink"))
var sinkMod3 = unknown(require("./sink"))

function source(s) {
sinkMod0.default(s)
sinkMod1(s)
sinkMod2(s)
sinkMod3(s)
}
```

sink.js:
```js
module.exports = function (data) {
sink(data)
}
```

I am using the following query to get all calls to `sink` from the source function:
```ql
/**
* @kind path-problem
*/

import javascript
import semmle.javascript.dataflow.TaintTracking

module Config implements DataFlow::ConfigSig {
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }

predicate isSource(DataFlow::Node source) {
exists(Function f |
f.getName() = "source" and
source.asExpr() = f.getAParameter()
)
}

predicate isSink(DataFlow::Node node) {
exists(DataFlow::CallNode cn |
cn.getAnArgument() = node and
cn.getCalleeName() = "sink"
)
}
}

module Flow = DataFlow::Global;

import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, ""
```

The above query doesnt find the flow through `sinkMod3(s)` . Is there a way to get codeQL to treat the `unknown(..)` function as an identity function?

Start with the supplied source.js, sink.js, and query, then inspect the taint-tracking entry points imported from semmle.javascript.dataflow.TaintTracking. Compare the reported flows through sinkMod0, sinkMod1, and sinkMod2 with the missing sinkMod3 path. Done means the query can report the flow through unknown(require("./sink")) when unknown is intended to behave as an identity function.

Scritto dal modello di indicizzazione a partire dal testo della issue.