Skip to content

Commit b526a2e

Browse files
erik-krogherik-krogh
committed
implement a model of WebSocket and ws based on the EventEmitter model
1 parent 007b079 commit b526a2e

File tree

7 files changed

+266
-0
lines changed

7 files changed

+266
-0
lines changed

‎javascript/ql/src/javascript.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ import semmle.javascript.frameworks.TorrentLibraries
9696
import semmle.javascript.frameworks.Typeahead
9797
import semmle.javascript.frameworks.UriLibraries
9898
import semmle.javascript.frameworks.Vue
99+
import semmle.javascript.frameworks.WebSocket
99100
import semmle.javascript.frameworks.XmlParsers
100101
import semmle.javascript.frameworks.xUnit
101102
import semmle.javascript.linters.ESLint

‎javascript/ql/src/semmle/javascript/frameworks/WebSocket.qll‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
/**
2+
* Provides classes for working with [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSocket).
3+
*
4+
* The model is based on the EventEmitter model, and there a therefore a
5+
* data-flow step from where a WebSocket event is send to where the message
6+
* is received.
7+
*
8+
* WebSockets include no concept of channels, therefore every client can send
9+
* to every server (and vice versa).
10+
*/
11+
12+
import javascript
13+
14+
/**
15+
* Gets the channel name used throughout this WebSocket model.
16+
* WebSockets don't have a concept of channels, and therefore a singleton name is used.
17+
* The name can be anything, as long as it is used consistently in this WebSocket model.
18+
*/
19+
private string channelName() { result = "message" }
20+
21+
module ClientWebSocket {
22+
/**
23+
* A class that can be used to instantiate a WebSocket instance.
24+
*/
25+
class SocketClass extends DataFlow::SourceNode {
26+
boolean isNode;
27+
28+
SocketClass() {
29+
this = DataFlow::globalVarRef("WebSocket") and isNode = false
30+
or
31+
this = DataFlow::moduleImport("ws") and isNode = true
32+
}
33+
34+
/**
35+
* Holds if this class an import of the "ws" module.
36+
*/
37+
predicate isNode() { isNode = true }
38+
}
39+
40+
/**
41+
* A client WebSocket instance.
42+
*/
43+
class ClientSocket extends EventEmitter::Range, DataFlow::SourceNode {
44+
SocketClass socketClass;
45+
46+
ClientSocket() { this = socketClass.getAnInstantiation() }
47+
48+
/**
49+
* Holds if this ClientSocket is created from the "ws" module.
50+
*
51+
* The predicate is used to differentiate where the behavior of the "ws" module differs from the native WebSocket in browsers.
52+
*/
53+
predicate isNode() { socketClass.isNode() }
54+
}
55+
56+
/**
57+
* A message sent from a WebSocket client.
58+
*/
59+
class SendNode extends EventDispatch::Range, DataFlow::CallNode {
60+
override ClientSocket emitter;
61+
62+
SendNode() { this = emitter.getAMemberCall("send") }
63+
64+
override string getChannel() { result = channelName() }
65+
66+
override DataFlow::Node getSentItem(int i) { i = 0 and result = this.getArgument(0) }
67+
68+
override ServerWebSocket::ReceiveNode getAReceiver() { any() }
69+
}
70+
71+
/**
72+
* Gets a methodName that can be used to register a listener for WebSocket messages on a given socket.
73+
*/
74+
string getARegisterMethodName(ClientSocket socket) {
75+
result = "addEventListener"
76+
or
77+
socket.isNode() and
78+
result = EventEmitter::on()
79+
}
80+
81+
/**
82+
* A handler that is registered to receive messages from a WebSocket.
83+
*
84+
* If the registration happens with the "addEventListener" method or the "onmessage" setter property, then the handler receives an event with a "data" property.
85+
* Otherwise the handler receives the data directly.
86+
*
87+
* This confusing API is caused by the "ws" library only mostly using their own API, where event objects are not used.
88+
* But the "ws" library additionally supports the WebSocket API from browsers, which exclusively use event objects with a "data" property.
89+
*/
90+
class ReceiveNode extends EventRegistration::Range, DataFlow::FunctionNode {
91+
override ClientSocket emitter;
92+
boolean receivesEvent;
93+
94+
ReceiveNode() {
95+
exists(DataFlow::CallNode call, string methodName |
96+
methodName = getARegisterMethodName(emitter) and
97+
call = emitter.getAMemberCall(methodName) and
98+
call.getArgument(0).mayHaveStringValue("message") and
99+
this = call.getCallback(1) and
100+
if methodName = "addEventListener" then receivesEvent = true else receivesEvent = false
101+
)
102+
or
103+
this = emitter.getAPropertyWrite("onmessage").getRhs() and
104+
receivesEvent = true
105+
}
106+
107+
override string getChannel() { result = channelName() }
108+
109+
override DataFlow::Node getReceivedItem(int i) {
110+
i = 0 and
111+
result = this.getParameter(0).getAPropertyRead("data") and
112+
receivesEvent = true
113+
or
114+
i = 0 and
115+
result = this.getParameter(0) and
116+
receivesEvent = false
117+
}
118+
}
119+
}
120+
121+
module ServerWebSocket {
122+
/**
123+
* A server WebSocket instance.
124+
*/
125+
class ServerSocket extends EventEmitter::Range, DataFlow::SourceNode {
126+
ServerSocket() {
127+
exists(DataFlow::CallNode onCall |
128+
onCall = DataFlow::moduleImport("ws")
129+
.getAConstructorInvocation("Server")
130+
.getAMemberCall(EventEmitter::on()) and
131+
onCall.getArgument(0).mayHaveStringValue("connection")
132+
|
133+
this = onCall.getCallback(1).getParameter(0)
134+
)
135+
}
136+
}
137+
138+
/**
139+
* A message sent from a WebSocket server.
140+
*/
141+
class SendNode extends EventDispatch::Range, DataFlow::CallNode {
142+
override ServerSocket emitter;
143+
144+
SendNode() { this = emitter.getAMemberCall("send") }
145+
146+
override string getChannel() { result = channelName() }
147+
148+
override DataFlow::Node getSentItem(int i) {
149+
i = 0 and
150+
result = getArgument(0)
151+
}
152+
153+
override ClientWebSocket::ReceiveNode getAReceiver() { any() }
154+
}
155+
156+
/**
157+
* A registration of an event handler that receives data from a WebSocket.
158+
*/
159+
class ReceiveNode extends EventRegistration::Range, DataFlow::CallNode {
160+
override ServerSocket emitter;
161+
162+
ReceiveNode() {
163+
this = emitter.getAMemberCall(EventEmitter::on()) and
164+
this.getArgument(0).mayHaveStringValue("message")
165+
}
166+
167+
override string getChannel() { result = channelName() }
168+
169+
override DataFlow::Node getReceivedItem(int i) {
170+
i = 0 and
171+
result = this.getCallback(1).getParameter(0)
172+
}
173+
}
174+
175+
/**
176+
* A data flow node representing data received from a client, viewed as remote user input.
177+
*/
178+
private class ReceivedItemAsRemoteFlow extends RemoteFlowSource {
179+
ReceivedItemAsRemoteFlow() { this = any(ReceiveNode rercv).getReceivedItem(_) }
180+
181+
override string getSourceType() { result = "WebSocket client data" }
182+
183+
override predicate isUserControlledObject() { any() }
184+
}
185+
}

‎javascript/ql/test/library-tests/frameworks/WebSocket/browser.js‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
(function () {
2+
const socket = new WebSocket('ws://localhost:8080');
3+
4+
socket.addEventListener('open', function (event) {
5+
socket.send('Hi from browser!');
6+
});
7+
8+
socket.addEventListener('message', function (event) {
9+
console.log('Message from server ', event.data);
10+
});
11+
12+
socket.onmessage = function(event) {
13+
console.log("Message from server 2", event.data)
14+
};
15+
})();

‎javascript/ql/test/library-tests/frameworks/WebSocket/client.js‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
(function () {
2+
const WebSocket = require('ws');
3+
4+
const ws = new WebSocket('ws://example.org');
5+
6+
ws.on('open', function open() {
7+
ws.send('Hi from client!');
8+
});
9+
10+
ws.on('message', function incoming(data) {
11+
console.log(data);
12+
});
13+
})();

‎javascript/ql/test/library-tests/frameworks/WebSocket/server.js‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
(function () {
2+
const WebSocket = require('ws');
3+
4+
const wss = new WebSocket.Server({ port: 8080 });
5+
6+
wss.on('connection', function connection(ws) {
7+
ws.on('message', function incoming(message) {
8+
console.log('received: %s', message);
9+
});
10+
11+
ws.send('Hi from server!');
12+
});
13+
})();

‎javascript/ql/test/library-tests/frameworks/WebSocket/test.expected‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
clientSocket
2+
| browser.js:2:17:2:52 | new Web ... :8080') |
3+
| client.js:4:13:4:45 | new Web ... e.org') |
4+
clientSend
5+
| browser.js:5:6:5:36 | socket. ... wser!') |
6+
| client.js:7:5:7:30 | ws.send ... ient!') |
7+
clientReceive
8+
| browser.js:8:37:10:2 | functio ... ta);\\n\\t} |
9+
| browser.js:12:21:14:5 | functio ... )\\n } |
10+
| client.js:10:19:12:2 | functio ... ta);\\n\\t} |
11+
serverSocket
12+
| server.js:6:43:6:44 | ws |
13+
serverSend
14+
| server.js:11:5:11:30 | ws.send ... rver!') |
15+
serverReceive
16+
| server.js:7:5:9:6 | ws.on(' ... \\n \\t\\t}) |
17+
taintStep
18+
| browser.js:5:18:5:35 | 'Hi from browser!' | server.js:7:40:7:46 | message |
19+
| client.js:7:13:7:29 | 'Hi from client!' | server.js:7:40:7:46 | message |
20+
| server.js:11:13:11:29 | 'Hi from server!' | browser.js:9:42:9:51 | event.data |
21+
| server.js:11:13:11:29 | 'Hi from server!' | browser.js:13:44:13:53 | event.data |
22+
| server.js:11:13:11:29 | 'Hi from server!' | client.js:10:37:10:40 | data |

‎javascript/ql/test/library-tests/frameworks/WebSocket/test.ql‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import javascript
2+
3+
query ClientWebSocket::ClientSocket clientSocket() { any() }
4+
5+
query ClientWebSocket::SendNode clientSend() { any() }
6+
7+
query ClientWebSocket::ReceiveNode clientReceive() { any() }
8+
9+
query ServerWebSocket::ServerSocket serverSocket() { any() }
10+
11+
query ServerWebSocket::SendNode serverSend() { any() }
12+
13+
query ServerWebSocket::ReceiveNode serverReceive() { any() }
14+
15+
query predicate taintStep(DataFlow::Node pred, DataFlow::Node succ) {
16+
any(DataFlow::AdditionalFlowStep s).step(pred, succ)
17+
}

0 commit comments

Comments
 (0)