diff --git a/javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll b/javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll index db1444db7415..50beb04b8879 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll @@ -74,6 +74,8 @@ private class DefaultModels extends CommandLineArguments::Range { or // `require('commander').opt()` => `{a: ..., b: ...}` this = commander().getMember("opts").getACall() + or + this = API::moduleImport("yargs/yargs").getReturn().getMember("argv").asSource() } } diff --git a/javascript/ql/test/library-tests/threat-models/sources/sources.js b/javascript/ql/test/library-tests/threat-models/sources/sources.js index 0e9e73f57be4..60168992dae7 100644 --- a/javascript/ql/test/library-tests/threat-models/sources/sources.js +++ b/javascript/ql/test/library-tests/threat-models/sources/sources.js @@ -13,7 +13,7 @@ const yargs = require('yargs/yargs'); const { hideBin } = require('yargs/helpers'); const argv = yargs(hideBin(process.argv)).argv; // $ threat-source=commandargs -SINK(argv.foo); // $ MISSING: hasFlow +SINK(argv.foo); // $ hasFlow // older version // https://www.npmjs.com/package/yargs/v/7.1.2