github / github/codeql

Javascript Taint Tracking

未關閉
#18,765 5 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

I have the following code:

source.js:
```js
function id(mod) {
return mod;
}

function __importDefault(mod) {
return mod && mod.__esModule
? mod
: {
default: mod,
}
}
var sinkMod0 = __importDefault(require("./sink"))
var sinkMod1 = require("./sink")
var sinkMod2 = id(require("./sink"))
var sinkMod3 = unknown(require("./sink"))

function source(s) {
sinkMod0.default(s)
sinkMod1(s)
sinkMod2(s)
sinkMod3(s)
}
```

sink.js:
```js
module.exports = function (data) {
sink(data)
}
```

I am using the following query to get all calls to `sink` from the source function:
```ql
/**
* @kind path-problem
*/

import javascript
import semmle.javascript.dataflow.TaintTracking

module Config implements DataFlow::ConfigSig {
DataFlow::FlowFeature getAFeature() { result instanceof DataFlow::FeatureHasSourceCallContext }

predicate isSource(DataFlow::Node source) {
exists(Function f |
f.getName() = "source" and
source.asExpr() = f.getAParameter()
)
}

predicate isSink(DataFlow::Node node) {
exists(DataFlow::CallNode cn |
cn.getAnArgument() = node and
cn.getCalleeName() = "sink"
)
}
}

module Flow = DataFlow::Global;

import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, ""
```

The above query doesnt find the flow through `sinkMod3(s)` . Is there a way to get codeQL to treat the `unknown(..)` function as an identity function?

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。