JS: add type-tracking to the fs-module and model the original-fs

Author: esbena

change-notes/1.24/analysis-javascript.md

@@ -58,7 +58,7 @@
 | Expression has no effect (`js/useless-expression`) | Fewer false positive results | The query now recognizes block-level flow type annotations and ignores the first statement of a try block. |
 | Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. |
 | Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. |
-| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed. |
+| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed and used. |
 | Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. |
 
 ## Changes to libraries

javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll

@@ -429,16 +429,27 @@ module NodeJSLib {
   }
 
   /**
-   * A member `member` from module `fs` or its drop-in replacements `graceful-fs` or `fs-extra`.
+   * A member `member` from module `fs` or its drop-in replacements `graceful-fs`, `fs-extra`, `original-fs`.
    */
   private DataFlow::SourceNode fsModuleMember(string member) {
+    result = fsModule(DataFlow::TypeTracker::end()).getAPropertyRead(member)
+  }
+
+  private DataFlow::SourceNode fsModule(DataFlow::TypeTracker t) {
     exists(string moduleName |
       moduleName = "fs" or
       moduleName = "graceful-fs" or
-      moduleName = "fs-extra"
+      moduleName = "fs-extra" or
+      moduleName = "original-fs"
     |
-      result = DataFlow::moduleMember(moduleName, member)
-    )
+      result = DataFlow::moduleImport(moduleName)
+      or
+      // extra support for flexible names
+      result.asExpr().(Require).getArgument(0).mayHaveStringValue(moduleName)
+    ) and
+    t.start()
+    or
+    exists(DataFlow::TypeTracker t2 | result = fsModule(t2).track(t2, t))
   }
 
   /**

javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

@@ -1,7 +1,4 @@
 | normalizedPaths.js:208:38:208:63 | // OK - ...  anyway | Spurious alert |
-| other-fs-libraries.js:14:34:14:42 | // NOT OK | Missing alert |
-| other-fs-libraries.js:16:41:16:49 | // NOT OK | Missing alert |
-| other-fs-libraries.js:17:42:17:50 | // NOT OK | Missing alert |
 | tainted-string-steps.js:25:43:25:74 | // NOT  ... flagged | Missing alert |
 | tainted-string-steps.js:26:49:26:74 | // OK - ... flagged | Spurious alert |
 | tainted-string-steps.js:28:39:28:70 | // NOT  ... flagged | Missing alert |