Skip to content

Commit 19dd204

Browse files
authored
Merge pull request #89 from advanced-security/mbaluda-cap
Event handler phases
2 parents 0f4a47d + d43e418 commit 19dd204

31 files changed

+4729
-4390
lines changed

.github/codeql/codeql-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ queries:
44
- uses: security-extended
55
# for ui5/cap queries
66
- uses: ./javascript/frameworks/ui5/src/codeql-suites/javascript-security-extended.qls
7-
- uses: ./javascript/frameworks/cap/src
7+
- uses: ./javascript/frameworks/cap/src/codeql-suites/javascript-security-extended.qls
88

99
paths:
1010
- "**/*.xml"

.github/workflows/code_scanning.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ jobs:
6464
pip install sarif-tools
6565
sarif --version
6666
sarif diff ${{ steps.analyze.outputs.sarif-output }} .github/workflows/javascript.sarif.expected -o sarif-diff.json
67+
cat sarif-diff.json
6768
! grep -q "[1-9]" sarif-diff.json
6869
6970
- name: Upload sarif change

.github/workflows/javascript.sarif.expected

Lines changed: 4452 additions & 4301 deletions
Large diffs are not rendered by default.
Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-cap-models
4-
version: 0.3.0
4+
version: 0.1.0
55
extensionTargets:
6-
codeql/javascript-all: "^0.8.1"
7-
codeql/javascript-queries: "^0.8.1"
6+
codeql/javascript-all: "^0.8.7"
7+
codeql/javascript-queries: "^0.8.7"
88
dataExtensions:
99
- "*.model.yml"

javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDS.qll

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -80,23 +80,23 @@ module CDS {
8080
}
8181

8282
/**
83-
* Parameter of request handler of `_.on`:
83+
* Parameter of request handler phases `_.before`, `_.on` `_.after`:
8484
* ```js
8585
* _.on ('READ','Books', (req) => req.reply([...]))
8686
* ```
8787
*/
88-
class OnNodeParam extends ValueNode, ParameterNode {
89-
MethodCallNode on;
88+
class EventPhaseNodeParam extends ValueNode, ParameterNode {
89+
MethodCallNode eventPhase;
9090

91-
OnNodeParam() {
91+
EventPhaseNodeParam() {
9292
exists(FunctionNode handler |
93-
on.getMethodName() = "on" and
94-
on.getLastArgument() = handler and
93+
eventPhase.getMethodName() = ["before", "on", "after"] and
94+
eventPhase.getLastArgument() = handler and
9595
handler.getLastParameter() = this
9696
)
9797
}
9898

99-
MethodCallNode getOnNode() { result = on }
99+
MethodCallNode getEventPhaseNode() { result = eventPhase }
100100
}
101101

102102
/**
@@ -106,30 +106,35 @@ module CDS {
106106
* ```
107107
* not sure how else to know which service is registering the handler
108108
*/
109-
class RequestSource extends OnNodeParam {
109+
class RequestSource extends EventPhaseNodeParam {
110110
RequestSource() {
111111
// TODO : consider - do we need to actually ever know which service the handler is associated to?
112112
exists(UserDefinedApplicationService svc, FunctionNode init |
113113
svc.getAnInstanceMember() = init and
114114
init.getName() = "init" and
115-
this.getOnNode().getEnclosingFunction() = init.getAstNode()
115+
this.getEventPhaseNode().getEnclosingFunction() = init.getAstNode()
116116
)
117117
or
118-
exists(WithCallParameter pa | this.getOnNode().getEnclosingFunction() = pa.getFunction())
118+
exists(WithCallParameter pa |
119+
this.getEventPhaseNode().getEnclosingFunction() = pa.getFunction()
120+
)
119121
}
120122
}
121123

122124
class ApplicationService extends API::Node {
123-
ApplicationService() { exists(CdsFacade c | this = c.getMember("ApplicationService")) }
125+
ApplicationService() {
126+
exists(CdsFacade c | this = c.getMember(["ApplicationService", "Service"]))
127+
}
124128
}
125129

126130
/**
127131
* ```js
128132
* const cds = require('@sap/cds')
133+
* const cds = require('@sap/cds/lib')
129134
* ```
130135
*/
131136
class CdsFacade extends API::Node {
132-
CdsFacade() { this = API::moduleImport("@sap/cds") }
137+
CdsFacade() { this = API::moduleImport(["@sap/cds", "@sap/cds/lib"]) }
133138
}
134139

135140
/**
@@ -143,13 +148,26 @@ module CDS {
143148
* Arguments of calls to `cds.log.{trace, debug, info, log, warn, error}`
144149
*/
145150
class CdsLogSink extends DataFlow::Node {
146-
CdsLogSink() { this = any(CdsLogCall cdsLog).getACall().getAChainedMethodCall(["trace", "debug", "info", "log", "warn", "error"]).getAnArgument() }
151+
CdsLogSink() {
152+
this =
153+
any(CdsLogCall cdsLog)
154+
.getACall()
155+
.getAChainedMethodCall(["trace", "debug", "info", "log", "warn", "error"])
156+
.getAnArgument()
157+
}
147158
}
148159

149160
/**
150161
* Methods that parse source strings into a CQL expression
151162
*/
152163
class ParseSink extends DataFlow::Node {
153-
ParseSink() { this = any(CdsFacade cds).getMember("parse").getMember(["expr", "ref", "xpr"]).getACall().getAnArgument() }
164+
ParseSink() {
165+
this =
166+
any(CdsFacade cds)
167+
.getMember("parse")
168+
.getMember(["expr", "ref", "xpr"])
169+
.getACall()
170+
.getAnArgument()
171+
}
154172
}
155173
}
Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,22 @@
11
---
22
lockVersion: 1.0.0
33
dependencies:
4+
codeql/dataflow:
5+
version: 0.1.7
46
codeql/javascript-all:
5-
version: 0.8.5
7+
version: 0.8.7
68
codeql/mad:
7-
version: 0.2.5
9+
version: 0.2.7
810
codeql/regex:
9-
version: 0.2.5
11+
version: 0.2.7
12+
codeql/ssa:
13+
version: 0.2.7
1014
codeql/tutorial:
11-
version: 0.2.5
15+
version: 0.2.7
16+
codeql/typetracking:
17+
version: 0.2.7
1218
codeql/util:
13-
version: 0.2.5
19+
version: 0.2.7
1420
codeql/yaml:
15-
version: 0.2.5
21+
version: 0.2.7
1622
compiled: false
Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
library: true
33
name: advanced-security/javascript-sap-cap-all
4-
version: 0.1.1
4+
version: 0.1.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.1"
9-
advanced-security/javascript-sap-cap-models: "^0.3.0"
8+
codeql/javascript-all: "^0.8.7"
9+
advanced-security/javascript-sap-cap-models: "^0.1.0"
Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,22 @@
11
---
22
lockVersion: 1.0.0
33
dependencies:
4+
codeql/dataflow:
5+
version: 0.1.7
46
codeql/javascript-all:
5-
version: 0.8.5
7+
version: 0.8.7
68
codeql/mad:
7-
version: 0.2.5
9+
version: 0.2.7
810
codeql/regex:
9-
version: 0.2.5
11+
version: 0.2.7
12+
codeql/ssa:
13+
version: 0.2.7
1014
codeql/tutorial:
11-
version: 0.2.5
15+
version: 0.2.7
16+
codeql/typetracking:
17+
version: 0.2.7
1218
codeql/util:
13-
version: 0.2.5
19+
version: 0.2.7
1420
codeql/yaml:
15-
version: 0.2.5
21+
version: 0.2.7
1622
compiled: false
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
- description: SAP CAPire Code Scanning Suite
2+
- queries: .
3+
- include:
4+
tags contain: security
5+
kind:
6+
- problem
7+
- path-problem
8+
precision:
9+
- high
10+
- very-high
11+
problem.severity:
12+
- warning
13+
- error
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
- description: SAP CAPire Code Scanning Suite
2+
- queries: .
3+
- include:
4+
tags contain: diagnostics

0 commit comments

Comments
 (0)