FlowState in Javascript

[Sim4n6]

Is there a similar way to use FlowState in Javascript, please ?

[aeisenberg]

In the JavaScript API, these are called flow labels. See https://codeql.github.com/docs/codeql-language-guides/using-flow-labels-for-precise-data-flow-analysis/ for a tutorial.

[Sim4n6]

Would you believe me if I tell you I was not able to set up a basic isAdditionalTaintStep with Flow labels, please?

[aeisenberg]

As a matter of fact...I would believe you. 😄

Can you please describe what you have tried so far and what exactly you are trying to achieve?

[Sim4n6]

:-D

I'm working on the Unicode Bypass Validation query version JS.

I am using the isAdditionalTaintStep() as follows in a TaintTracking::Configuration.

 override predicate isAdditionalTaintStep(
    DataFlow::Node nodeFrom, DataFlow::FlowLabel state, DataFlow::Node nodeTo,
    DataFlow::FlowLabel state
  ) {}

I get this error:

This predicate does not override another predicate.

why ? maybe it is set to final on the upper class ?

[aeisenberg]

That predicate does not exist on the super class. I think @atorralba has already answered your question here:

#13089 (comment)

His suggestion is to use isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node trg, DataFlow::FlowLabel inlbl, DataFlow::FlowLabel outlbl) instead and specify custom labels.

[Sim4n6]

You mean

  override predicate isAdditionalFlowStep(
    DataFlow::Node nodeFrom, DataFlow::Node nodeTo, DataFlow::FlowLabel stateFrom,
    DataFlow::FlowLabel stateTo
  ) {
    isAdditionalTaintStep(nodeFrom, nodeTo) and
    stateFrom instanceof PreValidation and
    stateTo instanceof PreValidation
  }

  predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
//
}

[aeisenberg]

I think so.

[Sim4n6]

it is the warning that I was missing without a second override

  override predicate isAdditionalFlowStep(
    DataFlow::Node nodeFrom, DataFlow::Node nodeTo, DataFlow::FlowLabel stateFrom,
    DataFlow::FlowLabel stateTo
  ) {
    isAdditionalTaintStep(nodeFrom, nodeTo) and
    stateFrom instanceof PreValidation and
    stateTo instanceof PreValidation
  }

  override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
//
}

now it should work , thanks man !