JS: model more implicit Node.js stream writes.

Author: MathiasVP

javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll

@@ -858,6 +858,100 @@ module NodeJSLib {
     }
   }
 
+  signature predicate isSuperClassSig(ClassDefinition clazz);
+
+  overlay[local?]
+  private module StreamSuperClass<isSuperClassSig/1 isSuperClass> {
+    /** Gets a relevant super class of `subclass`. */
+    ClassDefinition streamSuperClass(ClassDefinition subclass) {
+      isSuperClass(result) and
+      DataFlow::localFlowStep*(TValueNode(result), TValueNode(subclass.getSuperClass()))
+    }
+  }
+
+  signature predicate hasStreamKindSig(string kind);
+
+  overlay[local?]
+  private module WritableStreamClass<hasStreamKindSig/1 hasStreamKind> {
+    /**
+     * Holds if `c` extends a built-in Node.js stream class whose name
+     * satisfies `hasStreamKind`.
+     */
+    predicate writableStreamClass(ClassDefinition c) {
+      exists(string kind, EarlyStageNode constructor |
+        hasStreamKind(kind) and
+        memberRead(getAStreamModuleNode(), kind, constructor) and
+        DataFlow::localFlowStep*(constructor, TValueNode(c.getSuperClass()))
+      )
+      or
+      exists(StreamSuperClass<writableStreamClass/1>::streamSuperClass(c))
+    }
+  }
+
+  overlay[local?]
+  private predicate isWritableOrDuplex(string kind) { kind = ["Writable", "Duplex"] }
+
+  overlay[local?]
+  private predicate isTransform(string kind) { kind = "Transform" }
+
+  signature predicate hasStreamMethodNameSig(string name);
+
+  overlay[local?]
+  private module StreamMethodOverride<hasStreamMethodNameSig/1 hasStreamMethodName> {
+    private predicate overridesStreamMethod(ClassDefinition c) {
+      exists(string name, MemberDeclaration member |
+        hasStreamMethodName(name) and
+        member = StreamSuperClass<overridesStreamMethod/1>::streamSuperClass*(c).getMember(name) and
+        not member.isStatic()
+      )
+    }
+
+    private predicate overridesStreamInstanceMethod(NewExpr creation) {
+      exists(Assignment assignment, PropAccess property |
+        property = assignment.getLhs() and
+        hasStreamMethodName(property.getPropertyName()) and
+        DataFlow::localFlowStep*(TValueNode(creation), TValueNode(property.getBase()))
+      )
+    }
+
+    predicate hasStreamMethodOverride(ClassDefinition clazz, NewExpr creation) {
+      overridesStreamMethod(clazz)
+      or
+      overridesStreamInstanceMethod(creation)
+    }
+  }
+
+  overlay[local?]
+  private predicate isWriteMethod(string name) { name = "write" }
+
+  overlay[local?]
+  private predicate isWriteHook(string name) { name = "_write" }
+
+  /** Gets the implementation hook invoked by an inherited stream `write` method. */
+  overlay[local?]
+  private predicate pipeImplementationHook(PipeCall pipe, string hook) {
+    exists(ClassDefinition c, NewExpr creation |
+      DataFlow::localFlowStep*(TValueNode(c), TValueNode(creation.getCallee())) and
+      DataFlow::localFlowStep*(TValueNode(creation), TValueNode(pipe.getArgument(0))) and
+      not StreamMethodOverride<isWriteMethod/1>::hasStreamMethodOverride(c, creation)
+    |
+      WritableStreamClass<isWritableOrDuplex/1>::writableStreamClass(c) and
+      hook = "_write"
+      or
+      WritableStreamClass<isTransform/1>::writableStreamClass(c) and
+      if not StreamMethodOverride<isWriteHook/1>::hasStreamMethodOverride(c, creation)
+      then hook = "_transform"
+      else hook = "_write"
+    )
+  }
+
+  overlay[local?]
+  private string pipeHookTag(string hook, string part) {
+    hook = ["_write", "_transform"] and
+    part = ["member", "call", "encoding", "callback"] and
+    result = "nodejs.pipe." + hook + "." + part
+  }
+
   private DataFlow::SourceNode bufferInstance(DataFlow::TypeTracker t) {
     t.start() and
     exists(DataFlow::SourceNode constructor |
@@ -888,7 +982,14 @@ module NodeJSLib {
     override predicate needsSynthesizedNode(AstNode node, string tag, DataFlowCallable container) {
       (
         node instanceof PipeCall and
-        tag = ["nodejs.pipe.write.member", "nodejs.pipe.write.call", "nodejs.pipe.write.chunk"]
+        (
+          tag = ["nodejs.pipe.write.member", "nodejs.pipe.write.call", "nodejs.pipe.write.chunk"]
+          or
+          exists(string hook |
+            pipeImplementationHook(node, hook) and
+            tag = pipeHookTag(hook, _)
+          )
+        )
         or
         node instanceof ReadableFromCall and
         tag = "nodejs.readable.from.chunk"
@@ -973,6 +1074,8 @@ module NodeJSLib {
       this =
         getSynthesizedNode(pipe,
           ["nodejs.pipe.write.member", "nodejs.pipe.write.call", "nodejs.pipe.write.chunk"])
+      or
+      this = getSynthesizedNode(pipe, pipeHookTag(_, _))
     }
 
     override BasicBlock getBasicBlock() { result = pipe.getBasicBlock() }
@@ -1001,6 +1104,9 @@ module NodeJSLib {
         getSynthesizedNode(any(PipeCall call),
           ["nodejs.pipe.write.member", "nodejs.pipe.write.chunk"])
       or
+      this =
+        getSynthesizedNode(any(PipeCall call), pipeHookTag(_, ["member", "encoding", "callback"]))
+      or
       this = getSynthesizedNode(any(ReadableFromCall call), "nodejs.readable.from.chunk")
     }
   }
@@ -1033,6 +1139,53 @@ module NodeJSLib {
     override int getNumArgument() { result = 1 }
   }
 
+  overlay[local?]
+  private class PipeHookMember extends PipeNode, DataFlow::PropRead {
+    string hook;
+
+    PipeHookMember() { this = getSynthesizedNode(pipe, pipeHookTag(hook, "member")) }
+
+    override DataFlow::Node getBase() { result = pipe.getArgument(0).flow() }
+
+    override string getPropertyName() { result = hook }
+
+    override Expr getPropertyNameExpr() { none() }
+  }
+
+  /** An implicit `_write` or `_transform` invocation made by the native `write` method. */
+  overlay[local?]
+  private class PipeHookCall extends PipeNode, DataFlow::Impl::MethodCallNodeDef {
+    string hook;
+
+    PipeHookCall() { this = getSynthesizedNode(pipe, pipeHookTag(hook, "call")) }
+
+    override InvokeExpr getInvokeExpr() { result = pipe }
+
+    override string getCalleeName() { result = hook }
+
+    override string getMethodName() { result = hook }
+
+    override DataFlow::Node getCalleeNode() {
+      result = getSynthesizedNode(pipe, pipeHookTag(hook, "member"))
+    }
+
+    override DataFlow::Node getReceiver() { result = pipe.getArgument(0).flow() }
+
+    override DataFlow::Node getArgument(int index) {
+      index = 0 and result = getSynthesizedNode(pipe, "nodejs.pipe.write.chunk")
+      or
+      index = 1 and result = getSynthesizedNode(pipe, pipeHookTag(hook, "encoding"))
+      or
+      index = 2 and result = getSynthesizedNode(pipe, pipeHookTag(hook, "callback"))
+    }
+
+    override DataFlow::Node getAnArgument() { result = this.getArgument(_) }
+
+    override DataFlow::Node getASpreadArgument() { none() }
+
+    override int getNumArgument() { result = 3 }
+  }
+
   /**
    * A write to the file system, using a stream.
    */