Skip to content

JS: Improve tracking of route handlers and fix a rate-limiting FN/FP#5748

Merged
codeql-ci merged 8 commits into
github:mainfrom
asgerf:js/rate-limiting-fixes
Apr 22, 2021
Merged

JS: Improve tracking of route handlers and fix a rate-limiting FN/FP#5748
codeql-ci merged 8 commits into
github:mainfrom
asgerf:js/rate-limiting-fixes

Conversation

@asgerf
Copy link
Copy Markdown
Contributor

@asgerf asgerf commented Apr 21, 2021

Tracks route handler functions through functions like this

const catchAsync = fn => (...args) => fn(...args).catch(args[2]);

It moves some of route-handler specific tracking into DataFlow::functionOneWayForwardingStep, analogous to DataFlow::functionForwardingStep. The logic in the two steps is very similar so having them in one place makes it easier to keep them in sync.

The step is used in route-handler tracking, but also in a few other places that were needed for the rate-limiting query to recognize wrapped rate limiters.

Commit-by-commit review strongly recommended as there's a lot of code being moved into another file, making the global diff hard to read.

Evaluation looks OK.

@asgerf asgerf added JS JS:changes-sources-or-sinks Changes taint sources/sinks for the JS analysis labels Apr 21, 2021
@asgerf asgerf requested a review from a team as a code owner April 21, 2021 20:21
Copy link
Copy Markdown
Contributor

@erik-krogh erik-krogh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍

The refactorings make sense, and the DB didn't grow even though we cache more 👍

@codeql-ci codeql-ci merged commit bdb4142 into github:main Apr 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation JS:changes-sources-or-sinks Changes taint sources/sinks for the JS analysis JS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants