JS: Add model for live-server
#6572
Conversation
erik-krogh
added
the
Awaiting evaluation
erik-krogh
force-pushed
the
live-server
branch
from
cb75762 to
28dce6e
Compare
erik-krogh
removed
the
Awaiting evaluation
| @@ -156,10 +113,11 @@ module Connect { | |||
| * An access to a user-controlled Connect request input. | |||
| */ | |||
| private class RequestInputAccess extends HTTP::RequestInputAccess { | |||
| RequestExpr request; | |||
| NodeJSLib::RequestExpr request; | |||
There was a problem hiding this comment.
Could we keep hiding that this is just a NodeJSLib::RequestExpr reference under the hood?
Perhaps the deleted RequestExpr should just be an alias now?
There was a problem hiding this comment.
I've added a class RequestExpr = NodeJSLib::RequestExpr;
| result = middleware.getAMemberCall(["push", "unshift"]).getArgument(0).getAFunctionValue() | ||
| or | ||
| result = middleware.(DataFlow::ArrayCreationNode).getAnElement().getAFunctionValue() |
There was a problem hiding this comment.
This middleware value is just an array in practice, right?
I expect that this push/unshift pattern could apply to all kinds of middleware setups that take arrays as arguments.
Should we (later?) add a utility class that would enable us to write the above as:
result = middleware.(DataFlow::ArrayLikeNode).getAnElement().getAFunctionValue()There was a problem hiding this comment.
We could do that. The same utility class could also be used in UnsafeShellCommandConstructionCustomizations.qll.
I'll put it on my list, and look at it later.
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
And improve+simplify the model for
connectby basing it off theNodeJSmodel.Adds source+sink for CVE-2020-7680.
Evaluation was uneventful.