Improve URL handling in ClientRequest for extend() and Options

Author: Napalys

javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll

@@ -437,7 +437,14 @@ module ClientRequest {
       result = this.getArgument(0) and
       not exists(this.getOptionArgument(1, "baseUrl"))
       or
-      // Handle URL when passed as options
+      // Handle URL from options passed to extend()
+      exists(API::CallNode extendCall |
+        extendCall = API::moduleImport("got").getMember("extend").getACall() and
+        result = extendCall.getParameter(0).getMember("url").asSink() and
+        not exists(this.getArgument(0))
+      )
+      or
+      // Handle URL from options passed as third argument when first arg is undefined/missing
       exists(API::InvokeNode optionsCall |
         optionsCall = API::moduleImport("got").getMember("Options").getAnInvocation() and
         optionsCall.getReturn().getAValueReachableFromSource() = this.getAnArgument() and

javascript/ql/test/library-tests/frameworks/ClientRequests/ClientRequests.expected

@@ -263,6 +263,12 @@ test_getUrl
 | tst.js:328:5:328:38 | got(und ... ptions) | tst.js:328:9:328:17 | undefined |
 | tst.js:329:5:329:45 | got(und ... {url})) | tst.js:329:9:329:17 | undefined |
 | tst.js:329:5:329:45 | got(und ... {url})) | tst.js:329:40:329:42 | url |
+| tst.js:332:5:332:46 | got.ext ... ).get() | tst.js:336:41:336:43 | url |
+| tst.js:332:5:332:46 | got.ext ... ).get() | tst.js:339:42:339:44 | url |
+| tst.js:337:5:337:20 | jsonClient.get() | tst.js:336:41:336:43 | url |
+| tst.js:337:5:337:20 | jsonClient.get() | tst.js:339:42:339:44 | url |
+| tst.js:340:5:340:21 | jsonClient2.get() | tst.js:336:41:336:43 | url |
+| tst.js:340:5:340:21 | jsonClient2.get() | tst.js:339:42:339:44 | url |
 test_getAResponseDataNode
 | axiosTest.js:4:5:7:6 | axios({ ... \\n    }) | axiosTest.js:4:5:7:6 | axios({ ... \\n    }) | json | true |
 | axiosTest.js:12:5:17:6 | axios({ ... \\n    }) | axiosTest.js:12:5:17:6 | axios({ ... \\n    }) | json | true |

javascript/ql/test/library-tests/frameworks/ClientRequests/tst.js

@@ -329,13 +329,13 @@ function gotTests(url){
     got(undefined, undefined, Options({url}));
 
     const options2 = new Options({url});
-    got.extend(options2).extend(options).get(); // call flagged not the actual url flow
+    got.extend(options2).extend(options).get();
 
     got.paginate(url, {}); // not flagged 
 
     const jsonClient = got.extend({url: url});
-    jsonClient.get(); // call flagged not the actual url flow
+    jsonClient.get();
 
     const jsonClient2 = got.extend({url: url}).extend({url: url});
-    jsonClient2.get(); // call flagged not the actual url flow
+    jsonClient2.get();
 }