FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
codeql/javascript/ql/src/NodeJS/DubiousImport.ql at codeql-cli/v2.25.5 · github/codeql · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10k
Code
Issues
998
Pull requests
460
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
codeql
/
javascript
/
ql
/
src
/
NodeJS
/
DubiousImport.ql
Copy path
More file actions
More file actions
Latest commit
History
History
History
68 lines (63 loc) · 2.27 KB
Breadcrumbs
codeql
/
javascript
/
ql
/
src
/
NodeJS
/
DubiousImport.ql
Copy path
File metadata and controls
68 lines (63 loc) · 2.27 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
/**
* @name Dubious import
* @description Importing a symbol from a module that does not export it most likely indicates a bug.
* @kind problem
* @problem.severity warning
* @id js/node/import-without-export
* @tags reliability
* maintainability
* frameworks/node.js
* @precision low
*/
import
javascript
/** Holds if `m` is likely to have exports that are not picked up by the analysis. */
predicate
hasUntrackedExports
(
NodeModule
m
)
{
// look for assignments of the form `module.exports[p] = ...`, where we cannot
// determine the name of the exported property being assigned
exists
(
DataFlow
::
PropWrite
pwn
|
pwn
.
getBase
(
)
.
analyze
(
)
.
getAValue
(
)
=
m
.
getAModuleExportsValue
(
)
and
not
exists
(
pwn
.
getPropertyName
(
)
)
)
or
// look for assignments of the form `module.exports = exp` where `exp` is indefinite
exists
(
AbstractModuleObject
am
,
AnalyzedPropertyWrite
apw
,
DataFlow
::
AnalyzedNode
exp
|
am
.
getModule
(
)
=
m
and
apw
.
writes
(
am
,
"exports"
,
exp
)
and
exp
.
getAValue
(
)
.
isIndefinite
(
_
)
)
or
// look for function calls of the form `f(module.exports)`
exists
(
InvokeExpr
invk
|
invk
.
getAnArgument
(
)
.
analyze
(
)
.
getAValue
(
)
=
m
.
getAModuleExportsValue
(
)
)
}
/**
* Holds if there is an assignment anywhere defining `prop` on the result of
* a `require` import of module `m`.
*/
predicate
propDefinedOnRequire
(
NodeModule
m
,
string
prop
)
{
exists
(
DataFlow
::
ModuleImportNode
imp
|
imp
.
asExpr
(
)
.
(
Require
)
.
getImportedModule
(
)
=
m
and
exists
(
imp
.
getAPropertyWrite
(
prop
)
)
)
}
/**
* Holds if the base expression of `pacc` could refer to the result of
* a `require` import of module `m`.
*/
predicate
propAccessOn
(
PropAccess
pacc
,
NodeModule
m
)
{
exists
(
DataFlow
::
ModuleImportNode
imp
|
imp
.
asExpr
(
)
.
(
Require
)
.
getImportedModule
(
)
=
m
and
imp
.
flowsToExpr
(
pacc
.
getBase
(
)
)
)
}
from
NodeModule
m
,
PropAccess
pacc
,
string
prop
where
propAccessOn
(
pacc
,
m
)
and
count
(
NodeModule
mm
|
propAccessOn
(
pacc
,
mm
)
)
=
1
and
prop
=
pacc
.
getPropertyName
(
)
and
// m doesn't export 'prop'
not
prop
=
m
.
getAnExportedSymbol
(
)
and
// 'prop' isn't otherwise defined on m
not
propDefinedOnRequire
(
m
,
prop
)
and
// m doesn't use complicated exports
not
hasUntrackedExports
(
m
)
select
pacc
,
"Module $@ does not export symbol "
+
prop
+
"."
,
m
,
m
.
getName
(
)
Back
|
FazBrowse Home
|
New Git URL