CodeQL unable to find out sources of a chosen dataflow node in Javascript
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
Hi, for the following snippet i'm interested in finding out what nodes flow to `s + c` node.
```javascript
function main() {
let s = window.location;
let c = "";
let input = s + c;
eval(input);
}
```
By looking at the snippet, the answer clearly consists of five dataflow nodes. `s + c` itself, c , "" , s , window.location.
The followings are methods i tried so far.
CodeQL query for locating `s + c` explicitly by providing location
```codeql
import javascript
class SinkNode extends DataFlow::Node {
SinkNode() {
exists(DataFlow::Node node |
node.hasLocationInfo("filepath to the snippet",
4, 15, 4, 19) and
this = node
)
}
}
```
```codeql
class TestSucessor extends DataFlow::Node {
TestSucessor() {
exists(DataFlow::Node node |
node instanceof Sink and
exists(DataFlow::Node source |
source.getASuccessor*() = node and
this = source
)
)
}
}
```
This would only mark `s + c` as a predecessor.

```codeql
class TestPredecessor extends DataFlow::Node {
TestPredecessor() {
exists(DataFlow::Node node |
node instanceof Sink and
this = node.getAPredecessor*()
)
}
}
```
This would only mark `s + c` as a predecessor.
```codeql
class TestLocalSource extends DataFlow::Node {
TestLocalSource() {
exists(DataFlow::Node node |
this = node.getALocalSource*() and
node instanceof Sink
)
}
}
class TestLocalUse extends DataFlow::SourceNode {
TestLocalUse() {
exists(DataFlow::SourceNode src |
exists(DataFlow::Node node |
node instanceof Sink and
src.getALocalUse() = node and
this = src
)
)
}
}
```
Neither mark anything out.
I would see that an overkill for this issue is simply using tainted analysis. Mark `s+c` as sink and use `any()` for the source. However, i want to keep it simple. Any idea how to do it simply?
Many thanks.
Contributor guide
Research direction
Start by reproducing the JavaScript snippet and the supplied CodeQL queries, then read the DataFlow::Node APIs mentioned: getASuccessor*, getAPredecessor*, getALocalSource* and getALocalUse. Done means a simple query identifies the five expected nodes flowing into s + c: the expression, c, "", s, and window.location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100