- Notifications
You must be signed in to change notification settings - Fork1.7k
-
Hi 👋, I'm working on a project and I need a way to determine if Invocations nodes, without any found callees, originate from an external library. I'm not sure if there exists a mechanism to determine this information due to the callee not being found. To my knowledge, for JavaScript, CodeQL does not analyze the node_modules by default and contains modeling of certain popular external libraries like express. For example in this code: varurl=require('fast-url-parser');...varpath=url.parse(request.url).pathname Running this query: from DataFlow::InvokeNodenodewherenotexists(node.getACallee(0))selectnode, ... Correctly finds the callee parse as not being found. However there are many invocation nodes without found callees throughout most packages and I just want to focus on the nodes that relate to external libraries. I've looked into libraries like Thanks! |
BetaWas this translation helpful?Give feedback.
All reactions
Does this do the job for you:
import javascriptimport semmle.javascript.ApiGraphsselect API::moduleImport(_).getMember(_).getACall()
With your test code, this gets me the three calls to the three external function calls. If you want to additionally check that there's no callee, then you could do something like this:
import javascriptimport semmle.javascript.ApiGraphsfrom DataFlow::CallNodeexternalwhereexternal= API::moduleImport(_).getMember(_).getACall()andnotexists(external.getACallee(0))selectexternal
Replies: 1 comment 3 replies
-
Hi@jghebre 👋🏻 Would you be able to give an example of the sort of nodes you would want to exclude? |
BetaWas this translation helpful?Give feedback.
All reactions
-
BetaWas this translation helpful?Give feedback.
All reactions
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
Does this do the job for you: import javascriptimport semmle.javascript.ApiGraphsselect API::moduleImport(_).getMember(_).getACall() With your test code, this gets me the three calls to the three external function calls. If you want to additionally check that there's no callee, then you could do something like this: import javascriptimport semmle.javascript.ApiGraphsfrom DataFlow::CallNodeexternalwhereexternal= API::moduleImport(_).getMember(_).getACall()andnotexists(external.getACallee(0))selectexternal |
BetaWas this translation helpful?Give feedback.
All reactions
-
Yep works on all my cases so far. I think this is it, thank you! |
BetaWas this translation helpful?Give feedback.
All reactions
🎉 1