local data flow, global data flow, taint tracking
data flow graph

数据流节点属于DataFlow:Node类以及它的子类，AST节点属于ASTNode类以及它的子类。

类

DataFlow::ValueNode
an expression, destructuring pattern, or declaration of a function, class, namespace, or enum.
匹配示例
image.png
DataFlow::PropRef 包括DataFlow::PropRead和DataFlow::PropWrite
DataFlow::PropRead类
A data flow node that reads to an object property.
匹配示例
image.png
DataFlow::PropWrite
A data flow node that writes to an object property.
匹配示例
image.png
DataFlow::ParameterNode
a function parameter.
匹配示例

  1. x function f(x) {}; //x is a parameter of function f(x) {}

DataFlow::InvokeNode
a function invocation (with or without new).
匹配示例

  1. Math.abs(x)
  2. new Array(16)

DataFlow::NewNode
a function invocation (with new).

  1. new Array(16)

DataFlow::CallNode
a function invocation (without new).
匹配示例

  1. Math.abs(x)

DataFlow::MethodCallNode
a method call, that is, a call of form x.m(…).
匹配示例

  1. Math.abs(x)
  2. obj.foo()

DataFlow::GlobalVarRefNode
a direct reference to a global variable，相对于该类来说，更常用下面predicate
DataFlow::globalVarRef(name)
匹配示例

  1. document
  2. Math
  3. window.document
  4. window.Mat

DataFlow::FunctionNode
a function definition
匹配示例

  1. function greet() {         // function declaration
  2.   console.log("Hi");
  3. }
  5. var greet =
  6.   function() {             // function expression
  7.     console.log("Hi");
  8.   };
  10. var greet2 =
  11.   () => console.log("Hi")  // arrow function expression
  13. var o = {
  14.   m() {                    // function expression in a method definition in an object literal
  15.     return 0;
  16.   },
  17.   get x() {                // function expression in a getter method definition in an object literal
  18.     return 1
  19.   }
  20. };
  22. class C {
  23.   m() {                    // function expression in a method definition in a class
  24.     return 0;
  25.   }
  26. }

DataFlow::ClassNode
a class definition or a function definition acting as a class.
匹配示例

  1. class C {
  2.   method()
  3. }
  5. function F() {}
  7. F.prototype.method = function() {}
  9. F.prototype = {
  10.   method: function() {}
  11. }
  13. extend(F.prototype, {
  14.   method: function() {}
  15. });

谓词

DataFlow::valueNode(x)
DataFlow::parameterNode(p)
DataFlow::thisNode(s)
DataFlow::globalVarRef(g)
查询示例
匹配所有引用全局变量document的节点

  1. DataFlow::globalVarRef("document")

DataFlow::moduleMember(p, m)
查询示例
匹配所有调用fs模块readFile方法的节点

  1. DataFlow::moduleMember("fs", "readFile")

getAPredecessor
getASuccessor
asExpr
可以将DataFlow::Node转为一个表达式