Skip to content

Commit ff24c1b

Browse files
committed
Added missing doc strings for Tanstack queries
1 parent 20db2e4 commit ff24c1b

File tree

3 files changed

+19
-0
lines changed

3 files changed

+19
-0
lines changed

javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -862,6 +862,10 @@ module ClientRequest {
862862
}
863863
}
864864

865+
/**
866+
* Threat model source representing HTTP response data.
867+
* Marks nodes originating from a client request’s response data as tainted.
868+
*/
865869
private class ClientRequestThreatModel extends ThreatModelSource::Range {
866870
ClientRequestThreatModel() { this = any(ClientRequest r).getAResponseDataNode() }
867871

@@ -870,6 +874,10 @@ module ClientRequest {
870874
override string getSourceType() { result = "HTTP response data" }
871875
}
872876

877+
/**
878+
* An additional taint step that captures taint propagation from the receiver of fetch response methods
879+
* (such as "json", "text", "blob", and "arrayBuffer") to the call result.
880+
*/
873881
class FetchResponseStep extends TaintTracking::AdditionalTaintStep {
874882
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
875883
exists(DataFlow::MethodCallNode call |

javascript/ql/lib/semmle/javascript/frameworks/Fetch.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
private import javascript
22

3+
/**
4+
* An additional flow step that propagates data from the receiver of fetch response methods
5+
* (like "json", "text", "blob", and "arrayBuffer") to the call result.
6+
*/
37
class Fetch extends DataFlow::AdditionalFlowStep {
48
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
59
exists(DataFlow::MethodCallNode call |

javascript/ql/lib/semmle/javascript/frameworks/Tanstack.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
private import javascript
22

3+
/**
4+
* An additional flow step that propagates data from the return value of the query function,
5+
* defined in a useQuery call from the '@tanstack/react-query' module, to the 'data' property.
6+
*/
37
class TanstackStep extends DataFlow::AdditionalFlowStep {
48
override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
59
exists(DataFlow::CallNode useQuery |
@@ -17,6 +21,9 @@ class TanstackStep extends DataFlow::AdditionalFlowStep {
1721
}
1822
}
1923

24+
/**
25+
* Retrieves a call node representing a useQuery invocation from the '@tanstack/react-query' module.
26+
*/
2027
DataFlow::CallNode useQueryCall() {
2128
result = DataFlow::moduleImport("@tanstack/react-query").getAPropertyRead("useQuery").getACall()
2229
}

0 commit comments

Comments
 (0)