JS: Model newer yargs command-line parsing pattern

github · Oct 25, 2024 · d3ae4c9 · d3ae4c9
1 parent 3448751
commit d3ae4c9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll b/javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll
@@ -74,6 +74,8 @@ private class DefaultModels extends CommandLineArguments::Range {
     or
     // `require('commander').opt()` => `{a: ..., b: ...}`
     this = commander().getMember("opts").getACall()
+    or
+    this = API::moduleImport("yargs/yargs").getReturn().getMember("argv").asSource()
   }
 }
 

diff --git a/javascript/ql/test/library-tests/threat-models/sources/sources.js b/javascript/ql/test/library-tests/threat-models/sources/sources.js
@@ -13,7 +13,7 @@ const yargs = require('yargs/yargs');
 const { hideBin } = require('yargs/helpers');
 const argv = yargs(hideBin(process.argv)).argv; // $ threat-source=commandargs
 
-SINK(argv.foo); // $ MISSING: hasFlow
+SINK(argv.foo); // $ hasFlow
 
 // older version
 // https://www.npmjs.com/package/yargs/v/7.1.2
-Original file line number
+Diff line change
@@ Expand Up @@
         or
         // `require('commander').opt()` => `{a: ..., b: ...}`
         this = commander().getMember("opts").getACall()
+        or
+        this = API::moduleImport("yargs/yargs").getReturn().getMember("argv").asSource()
       }
     }
@@ Expand Down @@