JS: Port firebase to data as models

javascript/ql/lib/ext/firebase.model.yml

@@ -0,0 +1,37 @@
+extensions:
+  - addsTo:
+      pack: codeql/javascript-all
+      extensible: typeModel
+    data:
+      - ["firebase/app", "global", "Member[firebase]"]
+
+      - ["FirebaseDB", "firebase/app", "Member[database].ReturnValue"]
+      - ["FirebaseDB", "firebase-functions", "Member[database]"]
+      - ["FirebaseDB", "firebase-admin", "Member[database].ReturnValue"]
+      - ["FirebaseDB", "FirebaseDBApp", "Member[database].ReturnValue"]
+      - ["FirebaseDB", "firebase.database.Database", ""]
+
+      - ["FirebaseDBApp", "firebase-admin", "Member[initializeApp,app].ReturnValue"]
+      - ["FirebaseDBApp", "firebase/app", "Member[initializeApp,app].ReturnValue"]
+      - ["FirebaseDBApp", "firebase/app", "Member[initializeApp].ReturnValue"]
+
+      - ["FirebaseDBRef", "FirebaseDB", "Member[ref,refFromURL].ReturnValue"]
+      - ["FirebaseDBRef", "FirebaseDBRef", "Member[child,once,on,push,set,then].ReturnValue"]
+      - ["FirebaseDBRef", "FirebaseDBRef", "Member[ref,root,parent,before,after]"]
+      - ["FirebaseDBRef", "FirebaseDBRef", "Member[endAt,startAt,orderByChild,orderByKey,orderByValue,orderByPriority,equalTo,limitToLast,limitToFirst].ReturnValue"]
+      - ["FirebaseDBRef", "FirebaseDBRef", "Member[onCreate,onUpdate,onWrite,onDelete,then,forEach].Argument[0].Parameter[0]"]
+      - ["FirebaseDBRef", "FirebaseDBRef", "Member[once,on].Argument[1].Parameter[0]"]
+
+      - ["Snapshot", "FirebaseDBRef", "Member[child,once,on,push,set,then].ReturnValue"]
+      - ["Snapshot", "FirebaseDBRef", "Member[before,after]"]
+      - ["Snapshot", "FirebaseDBRef", "Member[once,on].Argument[1].Parameter[0]"]
+      - ["Snapshot", "FirebaseDBRef", "Member[onCreate,onUpdate,onWrite,onDelete,transaction,then,forEach].Argument[0].Parameter[0]"]
+
+      - ["Snapshot", "Snapshot", "Awaited"]
+
+  - addsTo:
+      pack: codeql/javascript-all
+      extensible: sourceModel
+    data:
+      - ["FirebaseDBRef", "Member[transaction].Argument[0].Parameter[0]", 'remote']
+      - ["Snapshot", "Member[val,exportVal].ReturnValue", 'remote']

javascript/ql/lib/semmle/javascript/frameworks/Firebase.qll

@@ -282,20 +282,18 @@ module Firebase {
    * `firebase.database().ref().on('value', x => {...})`.
    */
   DataFlow::SourceNode snapshot() { result = snapshot(DataFlow::TypeTracker::end()) }
-
-  /**
-   * A reference to a value obtained from a Firebase database.
-   */
-  class FirebaseVal extends RemoteFlowSource {
-    FirebaseVal() {
-      exists(string name | this = snapshot().getAMethodCall(name) |
-        name = "val" or
-        name = "exportVal"
-      )
-      or
-      this = Database::transactionCallback().(DataFlow::FunctionNode).getParameter(0)
-    }
-
-    override string getSourceType() { result = "Firebase database" }
-  }
+  // /**
+  //  * A reference to a value obtained from a Firebase database.
+  //  */
+  // deprecated class FirebaseVal extends RemoteFlowSource {
+  //   FirebaseVal() {
+  //     exists(string name | this = snapshot().getAMethodCall(name) |
+  //       name = "val" or
+  //       name = "exportVal"
+  //     )
+  //     or
+  //     this = Database::transactionCallback().(DataFlow::FunctionNode).getParameter(0)
+  //   }
+  //   override string getSourceType() { result = "Firebase database" }
+  // }
 }

javascript/ql/test/library-tests/frameworks/Firebase/src/import_assign.ts

@@ -1,5 +1,5 @@
 import firebase = require("firebase");
 
 function test(db: firebase.database.Database) {
-  db.ref("hello");
+  db.ref("hello"); // $firebaseRef
 }

javascript/ql/test/library-tests/frameworks/Firebase/src/import_named.ts

@@ -1,5 +1,5 @@
 import { database } from "firebase";
 
 function test(db: database.Database) {
-  db.ref("hello");
+  db.ref("hello"); // $firebaseRef
 }

javascript/ql/test/library-tests/frameworks/Firebase/src/import_star.ts

@@ -1,5 +1,5 @@
 import * as firebase from "firebase";
 
 function test(db: firebase.database.Database) {
-  db.ref("hello");
+  db.ref("hello"); // $firebaseRef
 }

javascript/ql/test/library-tests/frameworks/Firebase/tests.expected

@@ -3,33 +3,42 @@ firebaseRef
 | src/import_named.ts:4:3:4:17 | db.ref("hello") |
 | src/import_star.ts:4:3:4:17 | db.ref("hello") |
 | tst.js:5:1:5:22 | fb.data ... ef('x') |
+| tst.js:5:1:8:2 | fb.data ... eRef\\n}) |
+| tst.js:5:38:5:38 | x |
 | tst.js:7:3:7:7 | x.ref |
 | tst.js:7:3:7:14 | x.ref.parent |
 | tst.js:10:1:10:25 | admin.d ... ef('x') |
+| tst.js:10:1:13:2 | admin.d ... eRef\\n}) |
+| tst.js:10:41:10:41 | x |
 | tst.js:12:3:12:7 | x.ref |
 | tst.js:12:3:12:14 | x.ref.parent |
+| tst.js:15:1:15:27 | functio ... ef('x') |
+| tst.js:15:38:15:38 | x |
 | tst.js:17:3:17:7 | x.ref |
 | tst.js:17:3:17:14 | x.ref.parent |
+| tst.js:20:1:20:27 | functio ... ef('x') |
+| tst.js:20:38:20:38 | x |
+| tst.js:21:3:21:10 | x.before |
+| tst.js:22:3:22:9 | x.after |
 | tst.js:23:3:23:7 | x.ref |
 | tst.js:23:3:23:14 | x.ref.parent |
 | tst.js:32:12:32:42 | this.fi ... .ref(x) |
 | tst.js:46:12:46:42 | this.fi ... .ref(x) |
-| tst.js:50:12:50:25 | this.getRef(x) |
 | tst.js:50:12:50:34 | this.ge ... hild(x) |
+| tst.js:50:12:50:48 | this.ge ... value') |
 | tst.js:54:5:54:37 | this.fi ... ef('x') |
-| tst.js:58:1:58:61 | new Fir ... /news') |
-| tst.js:59:1:59:38 | new Fir ... /news') |
 firebaseSnapshot
-| tst.js:5:1:8:2 | fb.data ... ent;\\n}) |
+| tst.js:5:1:8:2 | fb.data ... eRef\\n}) |
 | tst.js:5:38:5:38 | x |
-| tst.js:10:1:13:2 | admin.d ... ent;\\n}) |
+| tst.js:10:1:13:2 | admin.d ... eRef\\n}) |
 | tst.js:10:41:10:41 | x |
 | tst.js:15:38:15:38 | x |
 | tst.js:20:38:20:38 | x |
 | tst.js:21:3:21:10 | x.before |
 | tst.js:22:3:22:9 | x.after |
+| tst.js:50:12:50:34 | this.ge ... hild(x) |
 | tst.js:50:12:50:48 | this.ge ... value') |
-| tst.js:60:1:60:39 | new Fir ... em('x') |
+| tst.js:61:36:61:36 | x |
 firebaseVal
 | tst.js:6:3:6:9 | x.val() |
 | tst.js:11:3:11:9 | x.val() |

javascript/ql/test/library-tests/frameworks/Firebase/tests.ql

@@ -1,10 +1,16 @@
 import javascript
 
-query predicate firebaseRef(DataFlow::SourceNode ref) { ref = Firebase::Database::ref() }
+query predicate firebaseRef(DataFlow::SourceNode ref) {
+  ref = ModelOutput::getATypeNode("FirebaseDBRef").asSource()
+}
 
-query predicate firebaseSnapshot(DataFlow::SourceNode snap) { snap = Firebase::snapshot() }
+query predicate firebaseSnapshot(DataFlow::SourceNode snap) {
+  snap = ModelOutput::getATypeNode("Snapshot").asSource()
+}
 
-query predicate firebaseVal(Firebase::FirebaseVal val) { any() }
+query predicate firebaseVal(DataFlow::SourceNode val) {
+  val = ModelOutput::getASourceNode("remote").asSource()
+}
 
 query predicate requestInputAccess(Http::RequestInputAccess acc) { any() }
 

javascript/ql/test/library-tests/frameworks/Firebase/tests.qlref

@@ -0,0 +1,2 @@
+query: tests.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

javascript/ql/test/library-tests/frameworks/Firebase/tst.js

@@ -2,25 +2,25 @@ import * as fb from 'firebase/app';
 import * as admin from 'firebase-admin';
 import * as functions from 'firebase-functions';
 
-fb.database().ref('x').once('value', x => {
-  x.val();
-  x.ref.parent;
-});
+fb.database().ref('x').once('value', x => { // $firebaseSnapshot $firebaseRef
+  x.val(); // $firebaseVal
+  x.ref.parent; // $firebaseRef
+}); // $firebaseRef $firebaseSnapshot
 
-admin.database().ref('x').once('value', x => {
-  x.val();
-  x.ref.parent;
-});
+admin.database().ref('x').once('value', x => { // $firebaseSnapshot $firebaseRef
+  x.val(); // $firebaseVal
+  x.ref.parent; // $firebaseRef
+}); // $firebaseRef $firebaseSnapshot
 
-functions.database.ref('x').onCreate(x => {
-  x.val();
-  x.ref.parent;
+functions.database.ref('x').onCreate(x => {// $firebaseSnapshot $firebaseRef
+  x.val(); // $firebaseVal
+  x.ref.parent; // $firebaseRef
 });
 
-functions.database.ref('x').onUpdate(x => {
-  x.before.val();
-  x.after.val();
-  x.ref.parent;
+functions.database.ref('x').onUpdate(x => { // $firebaseSnapshot $firebaseRef
+  x.before.val(); // $firebaseRef $firebaseSnapshot $firebaseVal
+  x.after.val(); // $firebaseRef $firebaseSnapshot $firebaseVal
+  x.ref.parent; // $firebaseRef
 });
 
 class FirebaseWrapper {
@@ -29,7 +29,7 @@ class FirebaseWrapper {
   }
 
   getRef(x) {
-    return this.firebase.database().ref(x);
+    return this.firebase.database().ref(x); // $firebaseRef
   }
 }
 
@@ -43,22 +43,22 @@ class FirebaseWrapper2 {
   }
 
   getRef(x) {
-    return this.firebase.database().ref(x);
+    return this.firebase.database().ref(x); // $firebaseRef
   }
 
   getNewsItem(x) {
-    return this.getRef(x).child(x).once('value');
+    return this.getRef(x).child(x).once('value'); // $firebaseRef $firebaseSnapshot
   }
 
   adjustValue(fn) {
-    this.firebase.database().ref('x').transaction(fn);
+    this.firebase.database().ref('x').transaction(fn); // $firebaseRef
   }
 }
 
 new FirebaseWrapper(firebase.initializeApp()).getRef('/news');
 new FirebaseWrapper2().getRef('/news');
 new FirebaseWrapper2().getNewsItem('x');
-new FirebaseWrapper2().adjustValue(x => x + 1);
+new FirebaseWrapper2().adjustValue(x => x + 1); // $firebaseSnapshot $firebaseVal
 
 class Box {
   constructor(x) {
@@ -69,4 +69,4 @@ let box1 = new Box(fb.database());
 let box2 = new Box(whatever());
 box2.x.ref(); // not a firebase ref
 
-functions.https.onRequest((req, res) => { res.send(req.params.foo); });
+functions.https.onRequest((req, res) => { res.send(req.params.foo); }); // $routeHandler $requestInputAccess $responseSendArgument

javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected

@@ -62,6 +62,19 @@
 | dragAndDrop.ts:73:29:73:39 | droppedHtml | dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:73:29:73:39 | droppedHtml | Cross-site scripting vulnerability due to $@. | dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | user-provided value |
 | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | Cross-site scripting vulnerability due to $@. | event-handler-receiver.js:2:49:2:61 | location.href | user-provided value |
 | express.js:6:15:6:33 | req.param("wobble") | express.js:6:15:6:33 | req.param("wobble") | express.js:6:15:6:33 | req.param("wobble") | Cross-site scripting vulnerability due to $@. | express.js:6:15:6:33 | req.param("wobble") | user-provided value |
+| firebase-client.js:7:59:7:65 | x.val() | firebase-client.js:7:59:7:65 | x.val() | firebase-client.js:7:59:7:65 | x.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:7:59:7:65 | x.val() | user-provided value |
+| firebase-client.js:8:59:8:79 | x.expor ... message | firebase-client.js:8:59:8:71 | x.exportVal() | firebase-client.js:8:59:8:79 | x.expor ... message | Cross-site scripting vulnerability due to $@. | firebase-client.js:8:59:8:71 | x.exportVal() | user-provided value |
+| firebase-client.js:10:63:10:82 | parentSnapshot.val() | firebase-client.js:10:63:10:82 | parentSnapshot.val() | firebase-client.js:10:63:10:82 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:10:63:10:82 | parentSnapshot.val() | user-provided value |
+| firebase-client.js:14:54:14:70 | bioSnapshot.val() | firebase-client.js:14:54:14:70 | bioSnapshot.val() | firebase-client.js:14:54:14:70 | bioSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:14:54:14:70 | bioSnapshot.val() | user-provided value |
+| firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | firebase-client.js:18:20:18:38 | childSnapshot.val() | firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | Cross-site scripting vulnerability due to $@. | firebase-client.js:18:20:18:38 | childSnapshot.val() | user-provided value |
+| firebase-client.js:25:59:25:65 | x.val() | firebase-client.js:25:59:25:65 | x.val() | firebase-client.js:25:59:25:65 | x.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:25:59:25:65 | x.val() | user-provided value |
+| firebase-client.js:26:59:26:79 | x.expor ... message | firebase-client.js:26:59:26:71 | x.exportVal() | firebase-client.js:26:59:26:79 | x.expor ... message | Cross-site scripting vulnerability due to $@. | firebase-client.js:26:59:26:71 | x.exportVal() | user-provided value |
+| firebase-client.js:28:63:28:82 | parentSnapshot.val() | firebase-client.js:28:63:28:82 | parentSnapshot.val() | firebase-client.js:28:63:28:82 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:28:63:28:82 | parentSnapshot.val() | user-provided value |
+| firebase-client.js:33:52:33:65 | snapshot.val() | firebase-client.js:33:52:33:65 | snapshot.val() | firebase-client.js:33:52:33:65 | snapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:33:52:33:65 | snapshot.val() | user-provided value |
+| firebase-client.js:38:56:38:67 | userData.bio | firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:38:56:38:67 | userData.bio | Cross-site scripting vulnerability due to $@. | firebase-client.js:37:22:37:35 | snapshot.val() | user-provided value |
+| firebase-client.js:44:55:44:74 | parentSnapshot.val() | firebase-client.js:44:55:44:74 | parentSnapshot.val() | firebase-client.js:44:55:44:74 | parentSnapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:44:55:44:74 | parentSnapshot.val() | user-provided value |
+| firebase-client.js:52:57:52:70 | snapshot.val() | firebase-client.js:52:57:52:70 | snapshot.val() | firebase-client.js:52:57:52:70 | snapshot.val() | Cross-site scripting vulnerability due to $@. | firebase-client.js:52:57:52:70 | snapshot.val() | user-provided value |
+| firebase-client.js:66:34:66:57 | "<p>" + ...  "</p>" | firebase-client.js:65:23:65:36 | snapshot.val() | firebase-client.js:66:34:66:57 | "<p>" + ...  "</p>" | Cross-site scripting vulnerability due to $@. | firebase-client.js:65:23:65:36 | snapshot.val() | user-provided value |
 | jquery.js:7:5:7:34 | "<div i ... + "\\">" | jquery.js:2:17:2:40 | documen ... .search | jquery.js:7:5:7:34 | "<div i ... + "\\">" | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |
 | jquery.js:8:18:8:34 | "XSS: " + tainted | jquery.js:2:17:2:40 | documen ... .search | jquery.js:8:18:8:34 | "XSS: " + tainted | Cross-site scripting vulnerability due to $@. | jquery.js:2:17:2:40 | documen ... .search | user-provided value |
 | jquery.js:10:5:10:40 | "<b>" + ...  "</b>" | jquery.js:10:13:10:20 | location | jquery.js:10:5:10:40 | "<b>" + ...  "</b>" | Cross-site scripting vulnerability due to $@. | jquery.js:10:13:10:20 | location | user-provided value |
@@ -352,6 +365,18 @@ edges
 | dragAndDrop.ts:71:27:71:61 | e.dataT ... /html') | dragAndDrop.ts:71:13:71:61 | droppedHtml | provenance |  |
 | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance |  |
 | event-handler-receiver.js:2:49:2:61 | location.href | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | provenance | Config |
+| firebase-client.js:8:59:8:71 | x.exportVal() | firebase-client.js:8:59:8:79 | x.expor ... message | provenance |  |
+| firebase-client.js:18:13:18:38 | data | firebase-client.js:19:64:19:67 | data | provenance |  |
+| firebase-client.js:18:20:18:38 | childSnapshot.val() | firebase-client.js:18:13:18:38 | data | provenance |  |
+| firebase-client.js:19:64:19:67 | data | firebase-client.js:19:64:19:76 | data.username | provenance |  |
+| firebase-client.js:19:64:19:76 | data.username | firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | provenance |  |
+| firebase-client.js:26:59:26:71 | x.exportVal() | firebase-client.js:26:59:26:79 | x.expor ... message | provenance |  |
+| firebase-client.js:37:11:37:35 | userData | firebase-client.js:38:56:38:63 | userData | provenance |  |
+| firebase-client.js:37:22:37:35 | snapshot.val() | firebase-client.js:37:11:37:35 | userData | provenance |  |
+| firebase-client.js:38:56:38:63 | userData | firebase-client.js:38:56:38:67 | userData.bio | provenance |  |
+| firebase-client.js:65:13:65:44 | message | firebase-client.js:66:42:66:48 | message | provenance |  |
+| firebase-client.js:65:23:65:36 | snapshot.val() | firebase-client.js:65:13:65:44 | message | provenance |  |
+| firebase-client.js:66:42:66:48 | message | firebase-client.js:66:34:66:57 | "<p>" + ...  "</p>" | provenance |  |
 | jquery.js:2:7:2:40 | tainted | jquery.js:4:5:4:11 | tainted | provenance |  |
 | jquery.js:2:7:2:40 | tainted | jquery.js:5:13:5:19 | tainted | provenance |  |
 | jquery.js:2:7:2:40 | tainted | jquery.js:6:11:6:17 | tainted | provenance |  |
@@ -954,6 +979,31 @@ nodes
 | event-handler-receiver.js:2:31:2:83 | '<h2><a ... ></h2>' | semmle.label | '<h2><a ... ></h2>' |
 | event-handler-receiver.js:2:49:2:61 | location.href | semmle.label | location.href |
 | express.js:6:15:6:33 | req.param("wobble") | semmle.label | req.param("wobble") |
+| firebase-client.js:7:59:7:65 | x.val() | semmle.label | x.val() |
+| firebase-client.js:8:59:8:71 | x.exportVal() | semmle.label | x.exportVal() |
+| firebase-client.js:8:59:8:79 | x.expor ... message | semmle.label | x.expor ... message |
+| firebase-client.js:10:63:10:82 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
+| firebase-client.js:14:54:14:70 | bioSnapshot.val() | semmle.label | bioSnapshot.val() |
+| firebase-client.js:18:13:18:38 | data | semmle.label | data |
+| firebase-client.js:18:20:18:38 | childSnapshot.val() | semmle.label | childSnapshot.val() |
+| firebase-client.js:19:56:19:84 | `<div>$ ... </div>` | semmle.label | `<div>$ ... </div>` |
+| firebase-client.js:19:64:19:67 | data | semmle.label | data |
+| firebase-client.js:19:64:19:76 | data.username | semmle.label | data.username |
+| firebase-client.js:25:59:25:65 | x.val() | semmle.label | x.val() |
+| firebase-client.js:26:59:26:71 | x.exportVal() | semmle.label | x.exportVal() |
+| firebase-client.js:26:59:26:79 | x.expor ... message | semmle.label | x.expor ... message |
+| firebase-client.js:28:63:28:82 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
+| firebase-client.js:33:52:33:65 | snapshot.val() | semmle.label | snapshot.val() |
+| firebase-client.js:37:11:37:35 | userData | semmle.label | userData |
+| firebase-client.js:37:22:37:35 | snapshot.val() | semmle.label | snapshot.val() |
+| firebase-client.js:38:56:38:63 | userData | semmle.label | userData |
+| firebase-client.js:38:56:38:67 | userData.bio | semmle.label | userData.bio |
+| firebase-client.js:44:55:44:74 | parentSnapshot.val() | semmle.label | parentSnapshot.val() |
+| firebase-client.js:52:57:52:70 | snapshot.val() | semmle.label | snapshot.val() |
+| firebase-client.js:65:13:65:44 | message | semmle.label | message |
+| firebase-client.js:65:23:65:36 | snapshot.val() | semmle.label | snapshot.val() |
+| firebase-client.js:66:34:66:57 | "<p>" + ...  "</p>" | semmle.label | "<p>" + ...  "</p>" |
+| firebase-client.js:66:42:66:48 | message | semmle.label | message |
 | jquery.js:2:7:2:40 | tainted | semmle.label | tainted |
 | jquery.js:2:17:2:40 | documen ... .search | semmle.label | documen ... .search |
 | jquery.js:4:5:4:11 | tainted | semmle.label | tainted |