Skip to content

Commit a6d3afd

Browse files
esbenaesbena
committed
JS: support additional Koa request sources
1 parent d4d910b commit a6d3afd

File tree

3 files changed

+32
-1
lines changed

3 files changed

+32
-1
lines changed

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- [Socket.IO](https://socket.io/)
1919
- [ws](https://github.com/websockets/ws)
2020
- [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API)
21+
- [Koa](https://www.npmjs.com/package/koa)
2122

2223
## New queries
2324

‎javascript/ql/src/semmle/javascript/frameworks/Koa.qll‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ module Koa {
99
/**
1010
* An expression that creates a new Koa application.
1111
*/
12-
class AppDefinition extends HTTP::Servers::StandardServerDefinition, NewExpr {
12+
class AppDefinition extends HTTP::Servers::StandardServerDefinition, InvokeExpr {
1313
AppDefinition() {
1414
// `app = new Koa()`
1515
this = DataFlow::moduleImport("koa").getAnInvocation().asExpr()
@@ -115,6 +115,26 @@ module Koa {
115115
override RouteHandler getRouteHandler() { result = ctx.getRouteHandler() }
116116
}
117117

118+
/**
119+
* A Koa request source, accessed through the a request property of a
120+
* generator route handler (deprecated in Koa 3).
121+
*/
122+
private class GeneratorRequestSource extends HTTP::Servers::RequestSource {
123+
RouteHandler rh;
124+
125+
GeneratorRequestSource() {
126+
exists(DataFlow::FunctionNode fun | fun = rh |
127+
fun.getFunction().isGenerator() and
128+
fun.getReceiver().getAPropertyRead("request") = this
129+
)
130+
}
131+
132+
/**
133+
* Gets the route handler that provides this response.
134+
*/
135+
override RouteHandler getRouteHandler() { result = rh }
136+
}
137+
118138
/**
119139
* A Koa response source, that is, an access to the `response` property
120140
* of a context object.

‎javascript/ql/test/library-tests/frameworks/koa/tests.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ test_RouteSetup
33
| src/koa.js:10:1:28:2 | app2.us ... z');\\n}) |
44
| src/koa.js:30:1:45:2 | app2.us ... rl);\\n}) |
55
| src/koa.js:47:1:56:2 | app2.us ... foo;\\n}) |
6+
| src/koa.js:59:1:61:2 | app3.us ... url;\\n}) |
67
test_RequestInputAccess
78
| src/koa.js:19:3:19:18 | ctx.request.body | body | src/koa.js:10:10:28:1 | functio ... az');\\n} |
89
| src/koa.js:20:3:20:23 | ctx.req ... ery.foo | parameter | src/koa.js:10:10:28:1 | functio ... az');\\n} |
@@ -24,6 +25,7 @@ test_RequestInputAccess
2425
| src/koa.js:49:2:49:14 | cookies.get() | cookie | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
2526
| src/koa.js:52:2:52:10 | query.foo | parameter | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
2627
| src/koa.js:55:2:55:12 | headers.foo | header | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
28+
| src/koa.js:60:2:60:17 | this.request.url | url | src/koa.js:59:10:61:1 | functio ... .url;\\n} |
2729
test_RouteHandler_getAResponseHeader
2830
| src/koa.js:10:10:28:1 | functio ... az');\\n} | header1 | src/koa.js:11:3:11:25 | this.se ... 1', '') |
2931
| src/koa.js:10:10:28:1 | functio ... az');\\n} | header2 | src/koa.js:12:3:12:37 | this.re ... 2', '') |
@@ -75,6 +77,7 @@ test_RouteHandler_getAContextExpr
7577
| src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:48:16:48:18 | ctx |
7678
| src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:51:14:51:16 | ctx |
7779
| src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:54:16:54:18 | ctx |
80+
| src/koa.js:59:10:61:1 | functio ... .url;\\n} | src/koa.js:60:2:60:5 | this |
7881
test_HeaderDefinition
7982
| src/koa.js:11:3:11:25 | this.se ... 1', '') | src/koa.js:10:10:28:1 | functio ... az');\\n} |
8083
| src/koa.js:12:3:12:37 | this.re ... 2', '') | src/koa.js:10:10:28:1 | functio ... az');\\n} |
@@ -87,6 +90,7 @@ test_RouteSetup_getServer
8790
| src/koa.js:10:1:28:2 | app2.us ... z');\\n}) | src/koa.js:5:12:5:20 | new Koa() |
8891
| src/koa.js:30:1:45:2 | app2.us ... rl);\\n}) | src/koa.js:5:12:5:20 | new Koa() |
8992
| src/koa.js:47:1:56:2 | app2.us ... foo;\\n}) | src/koa.js:5:12:5:20 | new Koa() |
93+
| src/koa.js:59:1:61:2 | app3.us ... url;\\n}) | src/koa.js:58:12:58:16 | Koa() |
9094
test_HeaderDefinition_getAHeaderName
9195
| src/koa.js:11:3:11:25 | this.se ... 1', '') | header1 |
9296
| src/koa.js:12:3:12:37 | this.re ... 2', '') | header2 |
@@ -116,14 +120,17 @@ test_RouteSetup_getARouteHandler
116120
| src/koa.js:10:1:28:2 | app2.us ... z');\\n}) | src/koa.js:10:10:28:1 | functio ... az');\\n} |
117121
| src/koa.js:30:1:45:2 | app2.us ... rl);\\n}) | src/koa.js:30:10:45:1 | async c ... url);\\n} |
118122
| src/koa.js:47:1:56:2 | app2.us ... foo;\\n}) | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
123+
| src/koa.js:59:1:61:2 | app3.us ... url;\\n}) | src/koa.js:59:10:61:1 | functio ... .url;\\n} |
119124
test_AppDefinition
120125
| src/koa.js:2:12:2:33 | new (re ... oa'))() |
121126
| src/koa.js:5:12:5:20 | new Koa() |
127+
| src/koa.js:58:12:58:16 | Koa() |
122128
test_RouteHandler
123129
| src/koa.js:7:1:7:22 | functio ... r1() {} | src/koa.js:5:12:5:20 | new Koa() |
124130
| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:5:12:5:20 | new Koa() |
125131
| src/koa.js:30:10:45:1 | async c ... url);\\n} | src/koa.js:5:12:5:20 | new Koa() |
126132
| src/koa.js:47:10:56:1 | async c ... .foo;\\n} | src/koa.js:5:12:5:20 | new Koa() |
133+
| src/koa.js:59:10:61:1 | functio ... .url;\\n} | src/koa.js:58:12:58:16 | Koa() |
127134
test_RequestExpr
128135
| src/koa.js:19:3:19:13 | ctx.request | src/koa.js:10:10:28:1 | functio ... az');\\n} |
129136
| src/koa.js:20:3:20:13 | ctx.request | src/koa.js:10:10:28:1 | functio ... az');\\n} |
@@ -133,6 +140,7 @@ test_RequestExpr
133140
| src/koa.js:24:3:24:13 | ctx.request | src/koa.js:10:10:28:1 | functio ... az');\\n} |
134141
| src/koa.js:25:3:25:13 | ctx.request | src/koa.js:10:10:28:1 | functio ... az');\\n} |
135142
| src/koa.js:26:3:26:13 | ctx.request | src/koa.js:10:10:28:1 | functio ... az');\\n} |
143+
| src/koa.js:60:2:60:13 | this.request | src/koa.js:59:10:61:1 | functio ... .url;\\n} |
136144
test_RouteHandler_getARequestExpr
137145
| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:19:3:19:13 | ctx.request |
138146
| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:20:3:20:13 | ctx.request |
@@ -142,6 +150,7 @@ test_RouteHandler_getARequestExpr
142150
| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:24:3:24:13 | ctx.request |
143151
| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:25:3:25:13 | ctx.request |
144152
| src/koa.js:10:10:28:1 | functio ... az');\\n} | src/koa.js:26:3:26:13 | ctx.request |
153+
| src/koa.js:59:10:61:1 | functio ... .url;\\n} | src/koa.js:60:2:60:13 | this.request |
145154
test_ContextExpr
146155
| src/koa.js:11:3:11:6 | this | src/koa.js:10:10:28:1 | functio ... az');\\n} |
147156
| src/koa.js:12:3:12:6 | this | src/koa.js:10:10:28:1 | functio ... az');\\n} |
@@ -174,6 +183,7 @@ test_ContextExpr
174183
| src/koa.js:48:16:48:18 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
175184
| src/koa.js:51:14:51:16 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
176185
| src/koa.js:54:16:54:18 | ctx | src/koa.js:47:10:56:1 | async c ... .foo;\\n} |
186+
| src/koa.js:60:2:60:5 | this | src/koa.js:59:10:61:1 | functio ... .url;\\n} |
177187
test_RedirectInvocation
178188
| src/koa.js:43:2:43:18 | ctx.redirect(url) | src/koa.js:43:15:43:17 | url | src/koa.js:30:10:45:1 | async c ... url);\\n} |
179189
| src/koa.js:44:2:44:27 | ctx.res ... ct(url) | src/koa.js:44:24:44:26 | url | src/koa.js:30:10:45:1 | async c ... url);\\n} |

0 commit comments

Comments
 (0)