Skip to content

Commit 9d8b93e

Browse files
hvitvedhvitved
committed
JS: No longer use models-as-data CSV interface
1 parent fdb7745 commit 9d8b93e

10 files changed

Lines changed: 119 additions & 183 deletions

File tree

‎javascript/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,5 @@ dependencies:
1515
codeql/yaml: ${workspace}
1616
dataExtensions:
1717
- semmle/javascript/frameworks/**/model.yml
18+
- semmle/javascript/frameworks/**/*.model.yml
1819
warnOnImplicitThis: true

‎javascript/ql/lib/semmle/javascript/frameworks/NoSQL.model.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: typeModel
5+
data:
6+
# In Mongo version 2.x, a client and a database handle were the same concept, but in 3.x
7+
# they were separated. To handle everything with a single model, we treat them as the same here.
8+
- ['mongodb.Db', 'mongodb.MongoClient', '']
9+
# 'marsdb' has no typings and is archived.
10+
# We just model is as a variant of 'mongoose'.
11+
- ['mongoose.Model', 'marsdb', 'Member[Collection].Instance']
12+
- ['mongoose.Query', 'marsdb', 'Member[Collection].Instance']
13+
- ['mongoose.Query', 'mongoose.Query', 'Member[sortFunc].ReturnValue']

‎javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,6 @@ module NoSql {
2121
* Provides classes modeling the `mongodb` and `mongoose` libraries.
2222
*/
2323
private module MongoDB {
24-
private class OldMongoDbAdapter extends ModelInput::TypeModelCsv {
25-
override predicate row(string row) {
26-
// In Mongo version 2.x, a client and a database handle were the same concept, but in 3.x
27-
// they were separated. To handle everything with a single model, we treat them as the same here.
28-
row = "mongodb.Db;mongodb.MongoClient;"
29-
}
30-
}
31-
3224
/**
3325
* An expression that is interpreted as a MongoDB query.
3426
*/
@@ -169,24 +161,6 @@ private module Mongoose {
169161
}
170162
}
171163

172-
/**
173-
* Provides classes modeling the MarsDB library.
174-
*/
175-
private module MarsDB {
176-
// 'marsdb' has no typings and is archived.
177-
// We just model is as a variant of 'mongoose'.
178-
private class MongooseExtension extends ModelInput::TypeModelCsv {
179-
override predicate row(string row) {
180-
row =
181-
[
182-
"mongoose.Query;marsdb;Member[Collection].Instance",
183-
"mongoose.Model;marsdb;Member[Collection].Instance",
184-
"mongoose.Query;mongoose.Query;Member[sortFunc].ReturnValue",
185-
]
186-
}
187-
}
188-
}
189-
190164
/**
191165
* Provides classes modeling the `Node Redis` library.
192166
*

‎javascript/ql/lib/semmle/javascript/frameworks/SQL.model.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sourceModel
5+
data:
6+
- ['@google-cloud/spanner.~SpannerObject', 'Member[executeSql].Argument[0..].Parameter[1]', 'database-access-result']
7+
- ['@google-cloud/spanner.~SpannerObject', 'Member[executeSql].ReturnValue.Awaited.Member[0]', 'database-access-result']
8+
- ['@google-cloud/spanner.~SpannerObject', 'Member[run].Argument[0..].Parameter[1]', 'database-access-result']
9+
- ['@google-cloud/spanner.~SpannerObject', 'Member[run].ReturnValue.Awaited', 'database-access-result']
10+
- ['sequelize.Sequelize', 'Member[query].ReturnValue.Awaited', 'database-access-result']
11+
12+
- addsTo:
13+
pack: codeql/javascript-all
14+
extensible: sinkModel
15+
data:
16+
- ['@google-cloud/spanner.Transaction', 'Member[batchUpdate].Argument[0]', 'sql-injection']
17+
- ['@google-cloud/spanner.Transaction', 'Member[batchUpdate].Argument[0].ArrayElement.Member[sql]', 'sql-injection']
18+
- ['@google-cloud/spanner.~SqlExecutorDirect', 'Argument[0]', 'sql-injection']
19+
- ['@google-cloud/spanner.~SqlExecutorDirect', 'Argument[0].Member[sql]', 'sql-injection']

‎javascript/ql/lib/semmle/javascript/frameworks/SQL.qll‎

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -415,42 +415,3 @@ private module MsSql {
415415
override string getCredentialsKind() { result = kind }
416416
}
417417
}
418-
419-
/**
420-
* Provides classes modeling the `sequelize` package.
421-
*/
422-
private module Sequelize {
423-
// Note: the sinks are specified directly in the MaD model
424-
class SequelizeSource extends ModelInput::SourceModelCsv {
425-
override predicate row(string row) {
426-
row = "sequelize.Sequelize;Member[query].ReturnValue.Awaited;database-access-result"
427-
}
428-
}
429-
}
430-
431-
private module SpannerCsv {
432-
class SpannerSinks extends ModelInput::SinkModelCsv {
433-
override predicate row(string row) {
434-
// type; path; kind
435-
row =
436-
[
437-
"@google-cloud/spanner.~SqlExecutorDirect;Argument[0];sql-injection",
438-
"@google-cloud/spanner.~SqlExecutorDirect;Argument[0].Member[sql];sql-injection",
439-
"@google-cloud/spanner.Transaction;Member[batchUpdate].Argument[0];sql-injection",
440-
"@google-cloud/spanner.Transaction;Member[batchUpdate].Argument[0].ArrayElement.Member[sql];sql-injection",
441-
]
442-
}
443-
}
444-
445-
class SpannerSources extends ModelInput::SourceModelCsv {
446-
override predicate row(string row) {
447-
row =
448-
[
449-
"@google-cloud/spanner.~SpannerObject;Member[executeSql].Argument[0..].Parameter[1];database-access-result",
450-
"@google-cloud/spanner.~SpannerObject;Member[executeSql].ReturnValue.Awaited.Member[0];database-access-result",
451-
"@google-cloud/spanner.~SpannerObject;Member[run].ReturnValue.Awaited;database-access-result",
452-
"@google-cloud/spanner.~SpannerObject;Member[run].Argument[0..].Parameter[1];database-access-result",
453-
]
454-
}
455-
}
456-
}

‎javascript/ql/test/library-tests/frameworks/data/test.ext.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: sourceModel
5+
data:
6+
- ['testlib', 'Member[BaseClass].Instance.Member[baseclassSource].ReturnValue', 'test-source']
7+
- ['testlib', 'Member[ClassDecorator].DecoratedClass.Instance.Member[inputIsSource].Parameter[0]', 'test-source']
8+
- ['testlib', 'Member[FieldDecoratorSource].DecoratedMember', 'test-source']
9+
- ['testlib', 'Member[MethodDecoratorWithArgs].ReturnValue.DecoratedMember.Parameter[0]', 'test-source']
10+
- ['testlib', 'Member[MethodDecorator].DecoratedMember.Parameter[0]', 'test-source']
11+
- ['testlib', 'Member[ParamDecoratorSource].DecoratedParameter', 'test-source']
12+
- ['testlib', 'Member[getSource].ReturnValue', 'test-source']
13+
14+
- addsTo:
15+
pack: codeql/javascript-all
16+
extensible: sinkModel
17+
data:
18+
- ['testlib', 'AnyMember.Member[memberSink].Argument[0]', 'test-sink']
19+
- ['testlib', 'Fuzzy.Member[fuzzyCall].Argument[0]', 'test-sink']
20+
- ['testlib', 'Member[ClassDecorator].DecoratedClass.Instance.Member[returnValueIsSink].ReturnValue', 'test-sink']
21+
- ['testlib', 'Member[FieldDecoratorSink].DecoratedMember', 'test-sink']
22+
- ['testlib', 'Member[MethodDecoratorWithArgs].ReturnValue.DecoratedMember.ReturnValue', 'test-sink']
23+
- ['testlib', 'Member[MethodDecorator].DecoratedMember.ReturnValue', 'test-sink']
24+
- ['testlib', 'Member[ParamDecoratorSink].DecoratedParameter', 'test-sink']
25+
- ['testlib', 'Member[foo', 'test-sink']
26+
- ['testlib', 'Member[foo] .Member[bar]', 'test-sink']
27+
- ['testlib', 'Member[foo] Member[bar]', 'test-sink']
28+
- ['testlib', 'Member[foo], Member[bar]', 'test-sink']
29+
- ['testlib', 'Member[foo],Member[bar]', 'test-sink']
30+
- ['testlib', 'Member[foo]. Member[bar]', 'test-sink']
31+
- ['testlib', 'Member[foo]..Member[bar]', 'test-sink']
32+
- ['testlib', 'Member[foo]Member[bar]', 'test-sink']
33+
- ['testlib', 'Member[foo]]', 'test-sink']
34+
- ['testlib', 'Member[foo]].Member[bar]', 'test-sink']
35+
- ['testlib', 'Member[mySinkExceptLast].Argument[0..N-2]', 'test-sink']
36+
- ['testlib', 'Member[mySinkIfArityTwo].WithArity[2].Argument[0]', 'test-sink']
37+
- ['testlib', 'Member[mySinkIfCall].Call.Argument[0]', 'test-sink']
38+
- ['testlib', 'Member[mySinkIfNew].NewCall.Argument[0]', 'test-sink']
39+
- ['testlib', 'Member[mySinkLast].Argument[N-1]', 'test-sink']
40+
- ['testlib', 'Member[mySinkSecondLast].Argument[N-2]', 'test-sink']
41+
- ['testlib', 'Member[mySinkTwoLastRange].Argument[N-2..N-1]', 'test-sink']
42+
- ['testlib', 'Member[mySinkTwoLast].Argument[N-1,N-2]', 'test-sink']
43+
- ['testlib', 'Member[mySink].Argument[0]', 'test-sink']
44+
- ['testlib', 'Member[overloadedSink].WithStringArgument[0=danger].Argument[1]', 'test-sink']
45+
- ['testlib', 'Member[sink1, sink2, sink3 ].Argument[0]', 'test-sink']
46+
- ['testlib', 'Member[typevar].TypeVar[ABC].Member[mySink].Argument[0]', 'test-sink']
47+
- ['testlib', 'Member[typevar].TypeVar[ABC].TypeVar[ABC].Member[mySink].Argument[1]', 'test-sink']
48+
- ['testlib', 'Member[typevar].TypeVar[LeftRight].Member[mySink].Argument[0]', 'test-sink']
49+
50+
- addsTo:
51+
pack: codeql/javascript-all
52+
extensible: summaryModel
53+
data:
54+
- ['testlib', 'Member[getSource].ReturnValue.Member[continue]', 'Argument[this]', 'ReturnValue', 'taint']
55+
- ['testlib', 'Member[preserveAllButFirstArgument]', 'Argument[1..]', 'ReturnValue', 'taint']
56+
- ['testlib', 'Member[preserveAllIfCall].Call', 'Argument[0..]', 'ReturnValue', 'taint']
57+
- ['testlib', 'Member[preserveArgZeroAndTwo]', 'Argument[0,2]', 'ReturnValue', 'taint']
58+
- ['testlib', 'Member[preserveTaint]', 'Argument[0]', 'ReturnValue', 'taint']
59+
- ['testlib', 'Member[taintIntoCallbackThis]', 'Argument[0]', 'Argument[1..2].Parameter[this]', 'taint']
60+
- ['testlib', 'Member[taintIntoCallback]', 'Argument[0]', 'Argument[1..2].Parameter[0]', 'taint']
61+
- ['testlib.~HasThisFlow', '', '', 'Member[getThis].ReturnValue', 'type']
62+
63+
- addsTo:
64+
pack: codeql/javascript-all
65+
extensible: typeModel
66+
data:
67+
- ['testlib.~HasThisFlow', 'testlib', 'Member[typevar]']
68+
- ['testlib.~HasThisFlow', 'testlib.~HasThisFlow', 'Member[left,right,x]']
69+
70+
- addsTo:
71+
pack: codeql/javascript-all
72+
extensible: typeVariableModel
73+
data:
74+
- ['ABC', 'Member[a].Member[b].WithArity[0].ReturnValue.Member[c]']
75+
- ['LeftRight', 'Member[left].TypeVar[LeftRight].Member[right]']
76+
- ['LeftRight', 'Member[x]']

‎javascript/ql/test/library-tests/frameworks/data/test.ql‎

Lines changed: 0 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -2,89 +2,6 @@ import javascript
22
import testUtilities.ConsistencyChecking
33
import semmle.javascript.frameworks.data.internal.ApiGraphModels as ApiGraphModels
44

5-
class Steps extends ModelInput::SummaryModelCsv {
6-
override predicate row(string row) {
7-
// type;path;input;output;kind
8-
row =
9-
[
10-
"testlib;Member[preserveTaint];Argument[0];ReturnValue;taint",
11-
"testlib;Member[taintIntoCallback];Argument[0];Argument[1..2].Parameter[0];taint",
12-
"testlib;Member[taintIntoCallbackThis];Argument[0];Argument[1..2].Parameter[this];taint",
13-
"testlib;Member[preserveArgZeroAndTwo];Argument[0,2];ReturnValue;taint",
14-
"testlib;Member[preserveAllButFirstArgument];Argument[1..];ReturnValue;taint",
15-
"testlib;Member[preserveAllIfCall].Call;Argument[0..];ReturnValue;taint",
16-
"testlib;Member[getSource].ReturnValue.Member[continue];Argument[this];ReturnValue;taint",
17-
"testlib.~HasThisFlow;;;Member[getThis].ReturnValue;type",
18-
]
19-
}
20-
}
21-
22-
class TypeDefs extends ModelInput::TypeModelCsv {
23-
override predicate row(string row) {
24-
row =
25-
[
26-
"testlib.~HasThisFlow;testlib;Member[typevar]",
27-
"testlib.~HasThisFlow;testlib.~HasThisFlow;Member[left,right,x]",
28-
]
29-
}
30-
}
31-
32-
class Sinks extends ModelInput::SinkModelCsv {
33-
override predicate row(string row) {
34-
// type;path;kind
35-
row =
36-
[
37-
"testlib;Member[mySink].Argument[0];test-sink",
38-
"testlib;Member[mySinkIfCall].Call.Argument[0];test-sink",
39-
"testlib;Member[mySinkIfNew].NewCall.Argument[0];test-sink",
40-
"testlib;Member[mySinkLast].Argument[N-1];test-sink",
41-
"testlib;Member[mySinkSecondLast].Argument[N-2];test-sink",
42-
"testlib;Member[mySinkTwoLast].Argument[N-1,N-2];test-sink",
43-
"testlib;Member[mySinkTwoLastRange].Argument[N-2..N-1];test-sink",
44-
"testlib;Member[mySinkExceptLast].Argument[0..N-2];test-sink",
45-
"testlib;Member[mySinkIfArityTwo].WithArity[2].Argument[0];test-sink",
46-
"testlib;Member[sink1, sink2, sink3 ].Argument[0];test-sink",
47-
"testlib;Member[ClassDecorator].DecoratedClass.Instance.Member[returnValueIsSink].ReturnValue;test-sink",
48-
"testlib;Member[FieldDecoratorSink].DecoratedMember;test-sink",
49-
"testlib;Member[MethodDecorator].DecoratedMember.ReturnValue;test-sink",
50-
"testlib;Member[MethodDecoratorWithArgs].ReturnValue.DecoratedMember.ReturnValue;test-sink",
51-
"testlib;Member[ParamDecoratorSink].DecoratedParameter;test-sink",
52-
"testlib;AnyMember.Member[memberSink].Argument[0];test-sink",
53-
"testlib;Member[overloadedSink].WithStringArgument[0=danger].Argument[1];test-sink",
54-
"testlib;Member[typevar].TypeVar[ABC].Member[mySink].Argument[0];test-sink",
55-
"testlib;Member[typevar].TypeVar[ABC].TypeVar[ABC].Member[mySink].Argument[1];test-sink",
56-
"testlib;Member[typevar].TypeVar[LeftRight].Member[mySink].Argument[0];test-sink",
57-
"testlib;Fuzzy.Member[fuzzyCall].Argument[0];test-sink"
58-
]
59-
}
60-
}
61-
62-
class TypeVars extends ModelInput::TypeVariableModelCsv {
63-
override predicate row(string row) {
64-
row =
65-
[
66-
"ABC;Member[a].Member[b].WithArity[0].ReturnValue.Member[c]", //
67-
"LeftRight;Member[left].TypeVar[LeftRight].Member[right]", //
68-
"LeftRight;Member[x]",
69-
]
70-
}
71-
}
72-
73-
class Sources extends ModelInput::SourceModelCsv {
74-
override predicate row(string row) {
75-
row =
76-
[
77-
"testlib;Member[getSource].ReturnValue;test-source",
78-
"testlib;Member[ClassDecorator].DecoratedClass.Instance.Member[inputIsSource].Parameter[0];test-source",
79-
"testlib;Member[FieldDecoratorSource].DecoratedMember;test-source",
80-
"testlib;Member[ParamDecoratorSource].DecoratedParameter;test-source",
81-
"testlib;Member[MethodDecorator].DecoratedMember.Parameter[0];test-source",
82-
"testlib;Member[MethodDecoratorWithArgs].ReturnValue.DecoratedMember.Parameter[0];test-source",
83-
"testlib;Member[BaseClass].Instance.Member[baseclassSource].ReturnValue;test-source",
84-
]
85-
}
86-
}
87-
885
class BasicTaintTracking extends TaintTracking::Configuration {
896
BasicTaintTracking() { this = "BasicTaintTracking" }
907

@@ -109,24 +26,6 @@ query predicate isSink(DataFlow::Node node, string kind) {
10926
node = ModelOutput::getASinkNode(kind).asSink()
11027
}
11128

112-
class SyntaxErrorTest extends ModelInput::SinkModelCsv {
113-
override predicate row(string row) {
114-
row =
115-
[
116-
"testlib;Member[foo],Member[bar];test-sink", //
117-
"testlib;Member[foo] Member[bar];test-sink", //
118-
"testlib;Member[foo]. Member[bar];test-sink", //
119-
"testlib;Member[foo], Member[bar];test-sink", //
120-
"testlib;Member[foo]..Member[bar];test-sink", //
121-
"testlib;Member[foo] .Member[bar];test-sink", //
122-
"testlib;Member[foo]Member[bar];test-sink", //
123-
"testlib;Member[foo;test-sink", //
124-
"testlib;Member[foo]];test-sink", //
125-
"testlib;Member[foo]].Member[bar];test-sink"
126-
]
127-
}
128-
}
129-
13029
query predicate syntaxErrors(ApiGraphModels::AccessPath path) { path.hasSyntaxError() }
13130

13231
query predicate warning = ModelOutput::getAWarning/0;

‎javascript/ql/test/library-tests/frameworks/data/warnings.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
| CSV type row should have 3 columns but has 1: test.TooFewColumns |
2-
| CSV type row should have 3 columns but has 6: test.TooManyColumns;;Member[Foo].Instance;too;many;columns |
31
| Invalid argument '0-1' in token 'Argument[0-1]' in access path: Method[foo].Argument[0-1] |
42
| Invalid argument '*' in token 'Argument[*]' in access path: Method[foo].Argument[*] |
53
| Invalid token 'Argument' is missing its arguments, in access path: Method[foo].Argument |

‎javascript/ql/test/library-tests/frameworks/data/warnings.ext.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: typeModel
5+
data:
6+
- ['test.X', 'test.Y', 'Method[foo].Arg[0]']
7+
- ['test.X', 'test.Y', 'Method[foo].Argument[0-1]']
8+
- ['test.X', 'test.Y', 'Method[foo].Argument[*]']
9+
- ['test.X', 'test.Y', 'Method[foo].Argument']
10+
- ['test.X', 'test.Y', 'Method[foo].Member']

‎javascript/ql/test/library-tests/frameworks/data/warnings.ql‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,6 @@
11
import javascript
22
import semmle.javascript.frameworks.data.internal.ApiGraphModels as ApiGraphModels
33

4-
private class InvalidTypeModel extends ModelInput::TypeModelCsv {
5-
override predicate row(string row) {
6-
row =
7-
[
8-
"test.TooManyColumns;;Member[Foo].Instance;too;many;columns", //
9-
"test.TooFewColumns", //
10-
"test.X;test.Y;Method[foo].Arg[0]", //
11-
"test.X;test.Y;Method[foo].Argument[0-1]", //
12-
"test.X;test.Y;Method[foo].Argument[*]", //
13-
"test.X;test.Y;Method[foo].Argument", //
14-
"test.X;test.Y;Method[foo].Member", //
15-
]
16-
}
17-
}
18-
194
class IsTesting extends ApiGraphModels::TestAllModels {
205
IsTesting() { this = this }
216
}

0 commit comments

Comments
 (0)