Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Javascript Dataflow - disallow return flow #18404

Closed
DSimsek000 opened this issue Jan 5, 2025 · 3 comments
Closed

Javascript Dataflow - disallow return flow #18404

DSimsek000 opened this issue Jan 5, 2025 · 3 comments
Labels
question Further information is requested

Comments

@DSimsek000
Copy link

I noticed that the CodeQL dataflow libraries for Javascript lack builtin functionality similar to https://codeql.github.com/codeql-standard-libraries/go/codeql/dataflow/internal/DataFlowImplCommon.qll/type.DataFlowImplCommon$MakeImplCommon$DataFlowImplCommonPublic$FeatureHasSourceCallContext.html

When using the taint tracking module, how can queries be written to ensure that data flows are limited to paths reachable from the source, that is achieve a restriction similar to FeatureHasSourceCallContext (#6932)?

@DSimsek000 DSimsek000 added the question Further information is requested label Jan 5, 2025
@aibaars
Copy link
Contributor

aibaars commented Jan 6, 2025

JavaScript currently has its own dataflow library, the team is working on replacing it with the same library used by the other languages. I'm not sure whether there is a way to achieve the same functionality with JavaScript's current dataflow library. I'll ask the team.

@asgerf
Copy link
Contributor

asgerf commented Jan 6, 2025

There is no such feature in the old data flow library. We are expecting to merge the switch to the new data flow library this month, after which you'll be able to use FeatureHasSourceCallContext.

@DSimsek000
Copy link
Author

Thank you for the update!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

3 participants