JS: Add missing flow steps.

Author: MathiasVP

javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll

@@ -1032,6 +1032,22 @@ module NodeJSLib {
     bufferInstance(DataFlow::TypeTracker::end()).flowsTo(node)
   }
 
+  private DataFlow::SourceNode pipeTransformCallback(PipeHookCall call, DataFlow::TypeTracker t) {
+    t.start() and
+    call.getMethodName() = "_transform" and
+    result = call.getArgument(2)
+    or
+    exists(DataFlow::TypeTracker t0 | result = pipeTransformCallback(call, t0).track(t0, t))
+  }
+
+  private DataFlow::SourceNode pipeTransformReceiver(PipeHookCall call, DataFlow::TypeTracker t) {
+    t.start() and
+    call.getMethodName() = "_transform" and
+    result = call.getReceiver().getALocalSource()
+    or
+    exists(DataFlow::TypeTracker t0 | result = pipeTransformReceiver(call, t0).track(t0, t))
+  }
+
   overlay[local?]
   private class StreamFlowStep extends AdditionalFlowInternal {
     override predicate needsSynthesizedNode(AstNode node, string tag, DataFlowCallable container) {
@@ -1105,6 +1121,20 @@ module NodeJSLib {
         contents = DataFlow::ContentSet::iteratorElement() and
         succ = call.flow()
       )
+      or
+      exists(PipeHookCall hook, DataFlow::CallNode callback |
+        callback = pipeTransformCallback(hook, DataFlow::TypeTracker::end()).getACall() and
+        pred = callback.getArgument(1) and
+        contents = DataFlow::ContentSet::iteratorElement() and
+        succ = hook.getReceiver()
+      )
+      or
+      exists(PipeHookCall hook, DataFlow::MethodCallNode push |
+        push = pipeTransformReceiver(hook, DataFlow::TypeTracker::end()).getAMethodCall("push") and
+        pred = push.getArgument(0) and
+        contents = DataFlow::ContentSet::iteratorElement() and
+        succ = hook.getReceiver()
+      )
     }
   }