Skip to content

Commit 6fb5376

Browse files
NapalysNapalys
committed
Refactor ReceivedItemAsRemoteFlow to handle data from both client and server WebSocket sources
1 parent 6bcfd8c commit 6fb5376

File tree

6 files changed

+53
-34
lines changed

6 files changed

+53
-34
lines changed

‎javascript/ql/lib/semmle/javascript/frameworks/WebSocket.qll

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -344,15 +344,18 @@ module ServerWebSocket {
344344
result = this.getCallback(1).getParameter(0)
345345
}
346346
}
347+
}
347348

348-
/**
349-
* A data flow node representing data received from a client, viewed as remote user input.
350-
*/
351-
private class ReceivedItemAsRemoteFlow extends RemoteFlowSource {
352-
ReceivedItemAsRemoteFlow() { this = any(ReceiveNode rercv).getReceivedItem(_) }
349+
/**
350+
* A data flow node representing data received from a client or server, viewed as remote user input.
351+
*/
352+
private class ReceivedItemAsRemoteFlow extends RemoteFlowSource {
353+
ReceivedItemAsRemoteFlow() {
354+
this = any(ClientWebSocket::ReceiveNode rercv).getReceivedItem(_) or
355+
this = any(ServerWebSocket::ReceiveNode rercv).getReceivedItem(_)
356+
}
353357

354-
override string getSourceType() { result = "WebSocket client data" }
358+
override string getSourceType() { result = "WebSocket transmitted data" }
355359

356-
override predicate isUserControlledObject() { any() }
357-
}
360+
override predicate isUserControlledObject() { any() }
358361
}

‎javascript/ql/test/library-tests/frameworks/WebSocket/browser-custom.js

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './
88
});
99

1010
socket.addEventListener('message', function (event) {
11-
console.log('Message from server ', event.data);
11+
console.log('Message from server ', event.data); // $ remoteFlow
1212
}); // $ clientReceive
1313

1414
socket.onmessage = function (event) {
15-
console.log("Message from server 2", event.data)
15+
console.log("Message from server 2", event.data); // $ remoteFlow
1616
}; // $ clientReceive
1717
})();
1818

@@ -24,12 +24,12 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './
2424
};
2525

2626
sock.onmessage = function (e) {
27-
console.log('message', e.data);
27+
console.log('message', e.data); // $ remoteFlow
2828
sock.close();
2929
}; // $ clientReceive
3030

3131
sock.addEventListener('message', function (event) {
32-
console.log('Using addEventListener ', event.data);
32+
console.log('Using addEventListener ', event.data); // $ remoteFlow
3333
}); // $ clientReceive
3434
})();
3535

@@ -40,11 +40,11 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './
4040
});
4141

4242
myWebSocketInstance.addEventListener('message', function (event) {
43-
console.log('Message from server ', event.data);
43+
console.log('Message from server ', event.data); // $ remoteFlow
4444
}); // $ clientReceive
4545

4646
myWebSocketInstance.onmessage = function (event) {
47-
console.log("Message from server 2", event.data)
47+
console.log("Message from server 2", event.data); // $ remoteFlow
4848
}; // $ clientReceive
4949
})();
5050

@@ -55,18 +55,18 @@ import { MyWebSocket, MySockJS, myWebSocketInstance, mySockJSInstance } from './
5555
};
5656

5757
mySockJSInstance.onmessage = function (e) {
58-
console.log('message', e.data);
58+
console.log('message', e.data); // $ remoteFlow
5959
mySockJSInstance.close();
6060
}; // $ clientReceive
6161

6262
mySockJSInstance.addEventListener('message', function (event) {
63-
console.log('Using addEventListener ', event.data);
63+
console.log('Using addEventListener ', event.data); // $ remoteFlow
6464
}); // $ clientReceive
6565
})();
6666

6767

6868
const recv_message = function (e) {
69-
console.log('Received message:', e.data);
69+
console.log('Received message:', e.data); // $ remoteFlow
7070
}; // $ clientReceive
7171

7272
(function () {

‎javascript/ql/test/library-tests/frameworks/WebSocket/browser.js

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
});
77

88
socket.addEventListener('message', function (event) {
9-
console.log('Message from server ', event.data);
9+
console.log('Message from server ', event.data); // $ remoteFlow
1010
}); // $clientReceive
1111

1212
socket.onmessage = function (event) {
13-
console.log("Message from server 2", event.data)
13+
console.log("Message from server 2", event.data); // $ remoteFlow
1414
}; // $clientReceive
1515
})();
1616

@@ -22,12 +22,12 @@
2222
};
2323

2424
sock.onmessage = function (e) {
25-
console.log('message', e.data);
25+
console.log('message', e.data); // $ remoteFlow
2626
sock.close();
2727
}; // $clientReceive
2828

2929
sock.addEventListener('message', function (event) {
30-
console.log('Using addEventListener ', event.data);
30+
console.log('Using addEventListener ', event.data); // $ remoteFlow
3131
}); // $clientReceive
3232
})();
3333

‎javascript/ql/test/library-tests/frameworks/WebSocket/client-custom.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ const { MyWebSocketWS, myWebSocketWSInstance } = require('./client.js');
77
ws.send('Hi from client!'); // $ clientSend
88
});
99

10-
ws.on('message', function incoming(data) {
10+
ws.on('message', function incoming(data) { // $ remoteFlow
1111
console.log(data);
1212
}); // $ clientReceive
1313
})();
@@ -17,7 +17,7 @@ const { MyWebSocketWS, myWebSocketWSInstance } = require('./client.js');
1717
myWebSocketWSInstance.send('Hi from client!'); // $ clientSend
1818
});
1919

20-
myWebSocketWSInstance.on('message', function incoming(data) {
20+
myWebSocketWSInstance.on('message', function incoming(data) { // $ remoteFlow
2121
console.log(data);
2222
}); // $ clientReceive
2323
})();

‎javascript/ql/test/library-tests/frameworks/WebSocket/client.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ const WebSocket = require('ws');
77
ws.send('Hi from client!'); // $clientSend
88
});
99

10-
ws.on('message', function incoming(data) {
10+
ws.on('message', function incoming(data) { // $ remoteFlow
1111
console.log(data);
1212
}); // $clientReceive
1313
})();

‎javascript/ql/test/library-tests/frameworks/WebSocket/test.expected

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
clientReceive
2-
| browser-custom.js:10:37:12:2 | functio ... ta);\\n\\t} |
3-
| browser-custom.js:14:21:16:2 | functio ... ata)\\n\\t} |
2+
| browser-custom.js:10:37:12:2 | functio ... Flow\\n\\t} |
3+
| browser-custom.js:14:21:16:2 | functio ... Flow\\n\\t} |
44
| browser-custom.js:26:19:29:2 | functio ... e();\\n\\t} |
5-
| browser-custom.js:31:35:33:2 | functio ... ta);\\n\\t} |
6-
| browser-custom.js:42:53:44:5 | functio ... ;\\n } |
7-
| browser-custom.js:46:37:48:5 | functio ... )\\n } |
5+
| browser-custom.js:31:35:33:2 | functio ... Flow\\n\\t} |
6+
| browser-custom.js:42:53:44:5 | functio ... w\\n } |
7+
| browser-custom.js:46:37:48:5 | functio ... w\\n } |
88
| browser-custom.js:57:34:60:5 | functio ... ;\\n } |
9-
| browser-custom.js:62:50:64:5 | functio ... ;\\n } |
10-
| browser-custom.js:68:22:70:1 | functio ... ata);\\n} |
11-
| browser.js:8:37:10:2 | functio ... ta);\\n\\t} |
12-
| browser.js:12:21:14:2 | functio ... ata)\\n\\t} |
9+
| browser-custom.js:62:50:64:5 | functio ... w\\n } |
10+
| browser-custom.js:68:22:70:1 | functio ... eFlow\\n} |
11+
| browser.js:8:37:10:2 | functio ... Flow\\n\\t} |
12+
| browser.js:12:21:14:2 | functio ... Flow\\n\\t} |
1313
| browser.js:24:19:27:2 | functio ... e();\\n\\t} |
14-
| browser.js:29:35:31:2 | functio ... ta);\\n\\t} |
14+
| browser.js:29:35:31:2 | functio ... Flow\\n\\t} |
1515
| client-custom.js:10:19:12:2 | functio ... ta);\\n\\t} |
1616
| client-custom.js:20:38:22:2 | functio ... ta);\\n\\t} |
1717
| client.js:10:19:12:2 | functio ... ta);\\n\\t} |
@@ -102,6 +102,22 @@ flowSteps
102102
| sockjs.js:11:20:11:50 | JSON.st ... .test)) | browser.js:25:26:25:31 | e.data |
103103
| sockjs.js:11:20:11:50 | JSON.st ... .test)) | browser.js:30:42:30:51 | event.data |
104104
remoteFlow
105+
| browser-custom.js:11:39:11:48 | event.data |
106+
| browser-custom.js:15:40:15:49 | event.data |
107+
| browser-custom.js:27:26:27:31 | e.data |
108+
| browser-custom.js:32:42:32:51 | event.data |
109+
| browser-custom.js:43:45:43:54 | event.data |
110+
| browser-custom.js:47:46:47:55 | event.data |
111+
| browser-custom.js:58:32:58:37 | e.data |
112+
| browser-custom.js:63:48:63:57 | event.data |
113+
| browser-custom.js:69:38:69:43 | e.data |
114+
| browser.js:9:39:9:48 | event.data |
115+
| browser.js:13:40:13:49 | event.data |
116+
| browser.js:25:26:25:31 | e.data |
117+
| browser.js:30:42:30:51 | event.data |
118+
| client-custom.js:10:37:10:40 | data |
119+
| client-custom.js:20:56:20:59 | data |
120+
| client.js:10:37:10:40 | data |
105121
| server-custom.js:7:38:7:44 | message |
106122
| server-custom.js:17:38:17:44 | message |
107123
| server.js:7:38:7:44 | message |

0 commit comments

Comments
 (0)