Skip to content

Commit 43f98a7

Browse files
author
Esben Sparre Andreasen
committed
JS: refactor NodeJSFileSystemRead* to FileStreamRead
1 parent 30f7f41 commit 43f98a7

1 file changed

Lines changed: 19 additions & 57 deletions

File tree

javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll

Lines changed: 19 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -503,72 +503,34 @@ module NodeJSLib {
503503
}
504504

505505
/**
506-
* A call to read corresponds to a pattern where file stream is open first with createReadStream, followed by 'read' call
506+
* A read from the file system using a stream.
507507
*/
508-
private class NodeJSFileSystemRead extends FileSystemReadAccess, DataFlow::CallNode {
508+
private class FileStreamRead extends FileSystemReadAccess, DataFlow::CallNode {
509509

510-
NodeJSFileSystemAccessCall init;
511-
512-
NodeJSFileSystemRead() {
513-
exists (NodeJSFileSystemAccessCall n |
514-
n.getCalleeName() = "createReadStream" and init = n |
515-
this = n.getAMemberCall("read")
516-
)
517-
}
518-
519-
override DataFlow::Node getADataNode() {
520-
result = this
521-
}
522-
523-
override DataFlow::Node getAPathArgument() {
524-
result = init.getAPathArgument()
525-
}
526-
}
527-
528-
/**
529-
* A call to read corresponds to a pattern where file stream is open first with createReadStream, followed by 'pipe' call
530-
*/
531-
private class NodeJSFileSystemPipe extends FileSystemReadAccess, DataFlow::CallNode {
532-
533-
NodeJSFileSystemAccessCall init;
534-
535-
NodeJSFileSystemPipe() {
536-
exists (NodeJSFileSystemAccessCall n |
537-
n.getCalleeName() = "createReadStream" and init = n |
538-
this = n.getAMemberCall("pipe")
539-
)
540-
}
541-
542-
override DataFlow::Node getADataNode() {
543-
result = this.getArgument(0)
544-
}
545-
546-
override DataFlow::Node getAPathArgument() {
547-
result = init.getAPathArgument()
548-
}
549-
}
550-
551-
/**
552-
* An 'on' event where data comes in as a parameter (usage: readstream.on('data', chunk))
553-
*/
554-
private class NodeJSFileSystemReadDataEvent extends FileSystemReadAccess, DataFlow::CallNode {
510+
NodeJSFileSystemAccessCall stream;
555511

556-
NodeJSFileSystemAccessCall init;
512+
string method;
557513

558-
NodeJSFileSystemReadDataEvent() {
559-
exists(NodeJSFileSystemAccessCall n |
560-
n.getCalleeName() = "createReadStream" and init = n |
561-
this = n.getAMethodCall("on") and
562-
this.getArgument(0).mayHaveStringValue("data")
563-
)
514+
FileStreamRead() {
515+
stream.getMethodName() = "createReadStream" and
516+
this = stream.getAMemberCall(method) and
517+
(method = "read" or method = "pipe" or method = "on")
564518
}
565519

566520
override DataFlow::Node getADataNode() {
567-
result = this.getCallback(1).getParameter(0)
521+
method = "read" and
522+
result = this
523+
or
524+
method = "pipe" and
525+
result = getArgument(0)
526+
or
527+
method = "on" and
528+
getArgument(0).mayHaveStringValue("data") and
529+
result = getCallback(1).getParameter(0)
568530
}
569-
531+
570532
override DataFlow::Node getAPathArgument() {
571-
result = init.getAPathArgument()
533+
result = stream.getAPathArgument()
572534
}
573535
}
574536

0 commit comments

Comments
 (0)