CodeQL JavaScript 数据流示例

代码示例1

import javascript
from DataFlow::MethodCallNode readFile, DataFlow::Node source
where
  readFile.getMethodName() = "readFile" and
  source.getASuccessor*() = readFile.getArgument(0)
select source

捕获示例1

捕获示例2

import javascript
from DataFlow::CallNode method, DataFlow::Node source
where
    method = DataFlow::globalVarRef("document").getAMethodCall("write")
    and source.getASuccessor*() = method.getArgument(0)
select source

捕获示例

Taint tracking

import javascript
class WriteLocationConfiguration extends TaintTracking::Configuration {
    WriteLocationConfiguration() { this = "WriteLocationConfiguration" }
  override predicate isSource(DataFlow::Node source) {
    DataFlow::globalVarRef("document").getAPropertyRead("location").getAPropertyRead() = source
  }
  override predicate isSink(DataFlow::Node sink) {
    DataFlow::globalVarRef("document").getAMethodCall("write").getArgument(0) = sink
  }
}
from WriteLocationConfiguration cfg, DataFlow::Node source, DataFlow::Node sink
where cfg.hasFlow(source, sink)
select source, sink

捕获示例