Skip to content

Commit 4f8166a

Browse files
NapalysNapalys
authored
Merge pull request #20450 from Napalys/js/graph-ql-ench
JS: Improve graphql flow
2 parents 203788d + 7affcf4 commit 4f8166a

File tree

5 files changed

+134
-0
lines changed

5 files changed

+134
-0
lines changed

‎javascript/ql/lib/change-notes/2025-09-17-graphql-enhance.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Support for the [graphql](https://www.npmjs.com/package/graphql) library has been improved. Data flow from GraphQL query sources and variables to resolver function parameters is now tracked.

‎javascript/ql/lib/ext/graph-ql.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/javascript-all
4+
extensible: summaryModel
5+
data:
6+
- ["graphql", "Member[graphql]", "Argument[0].Member[source,variableValues]", "Argument[0].Member[rootValue].AnyMember.Parameter[0]", "taint"]

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@
6161
| fastify.js:107:23:107:31 | userInput | fastify.js:106:21:106:38 | request.query.code | fastify.js:107:23:107:31 | userInput | This code execution depends on a $@. | fastify.js:106:21:106:38 | request.query.code | user-provided value |
6262
| fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:41 | request.query | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:41 | request.query | user-provided value |
6363
| fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:51 | request ... plyCode | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:51 | request ... plyCode | user-provided value |
64+
| graph-ql.js:20:19:20:22 | expr | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:20:19:20:22 | expr | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
65+
| graph-ql.js:39:19:39:30 | name + title | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:39:19:39:30 | name + title | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
6466
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
6567
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
6668
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -154,6 +156,23 @@ edges
154156
| fastify.js:106:9:106:17 | userInput | fastify.js:107:23:107:31 | userInput | provenance | |
155157
| fastify.js:106:21:106:33 | request.query | fastify.js:106:9:106:17 | userInput | provenance | |
156158
| fastify.js:106:21:106:38 | request.query.code | fastify.js:106:9:106:17 | userInput | provenance | |
159+
| graph-ql.js:18:10:18:17 | { expr } | graph-ql.js:18:12:18:15 | expr | provenance | |
160+
| graph-ql.js:18:12:18:15 | expr | graph-ql.js:20:19:20:22 | expr | provenance | |
161+
| graph-ql.js:28:9:28:28 | { query, variables } | graph-ql.js:28:11:28:15 | query | provenance | |
162+
| graph-ql.js:28:9:28:28 | { query, variables } | graph-ql.js:28:18:28:26 | variables | provenance | |
163+
| graph-ql.js:28:11:28:15 | query | graph-ql.js:31:13:31:17 | query | provenance | |
164+
| graph-ql.js:28:18:28:26 | variables | graph-ql.js:33:21:33:29 | variables | provenance | |
165+
| graph-ql.js:28:18:28:26 | variables | graph-ql.js:54:21:54:29 | variables | provenance | |
166+
| graph-ql.js:28:32:28:39 | req.body | graph-ql.js:28:9:28:28 | { query, variables } | provenance | |
167+
| graph-ql.js:31:13:31:17 | query | graph-ql.js:18:10:18:17 | { expr } | provenance | |
168+
| graph-ql.js:33:21:33:29 | variables | graph-ql.js:18:10:18:17 | { expr } | provenance | |
169+
| graph-ql.js:38:13:38:27 | { name, title } | graph-ql.js:38:15:38:18 | name | provenance | |
170+
| graph-ql.js:38:13:38:27 | { name, title } | graph-ql.js:38:21:38:25 | title | provenance | |
171+
| graph-ql.js:38:15:38:18 | name | graph-ql.js:39:19:39:22 | name | provenance | |
172+
| graph-ql.js:38:21:38:25 | title | graph-ql.js:39:26:39:30 | title | provenance | |
173+
| graph-ql.js:39:19:39:22 | name | graph-ql.js:39:19:39:30 | name + title | provenance | |
174+
| graph-ql.js:39:26:39:30 | title | graph-ql.js:39:19:39:30 | name + title | provenance | |
175+
| graph-ql.js:54:21:54:29 | variables | graph-ql.js:38:13:38:27 | { name, title } | provenance | |
157176
| react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
158177
| react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
159178
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | |
@@ -288,6 +307,22 @@ nodes
288307
| fastify.js:106:21:106:38 | request.query.code | semmle.label | request.query.code |
289308
| fastify.js:107:23:107:31 | userInput | semmle.label | userInput |
290309
| fastify.js:108:28:108:50 | reply.l ... tedCode | semmle.label | reply.l ... tedCode |
310+
| graph-ql.js:18:10:18:17 | { expr } | semmle.label | { expr } |
311+
| graph-ql.js:18:12:18:15 | expr | semmle.label | expr |
312+
| graph-ql.js:20:19:20:22 | expr | semmle.label | expr |
313+
| graph-ql.js:28:9:28:28 | { query, variables } | semmle.label | { query, variables } |
314+
| graph-ql.js:28:11:28:15 | query | semmle.label | query |
315+
| graph-ql.js:28:18:28:26 | variables | semmle.label | variables |
316+
| graph-ql.js:28:32:28:39 | req.body | semmle.label | req.body |
317+
| graph-ql.js:31:13:31:17 | query | semmle.label | query |
318+
| graph-ql.js:33:21:33:29 | variables | semmle.label | variables |
319+
| graph-ql.js:38:13:38:27 | { name, title } | semmle.label | { name, title } |
320+
| graph-ql.js:38:15:38:18 | name | semmle.label | name |
321+
| graph-ql.js:38:21:38:25 | title | semmle.label | title |
322+
| graph-ql.js:39:19:39:22 | name | semmle.label | name |
323+
| graph-ql.js:39:19:39:30 | name + title | semmle.label | name + title |
324+
| graph-ql.js:39:26:39:30 | title | semmle.label | title |
325+
| graph-ql.js:54:21:54:29 | variables | semmle.label | variables |
291326
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
292327
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
293328
| react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,23 @@ edges
5555
| fastify.js:106:9:106:17 | userInput | fastify.js:107:23:107:31 | userInput | provenance | |
5656
| fastify.js:106:21:106:33 | request.query | fastify.js:106:9:106:17 | userInput | provenance | |
5757
| fastify.js:106:21:106:38 | request.query.code | fastify.js:106:9:106:17 | userInput | provenance | |
58+
| graph-ql.js:18:10:18:17 | { expr } | graph-ql.js:18:12:18:15 | expr | provenance | |
59+
| graph-ql.js:18:12:18:15 | expr | graph-ql.js:20:19:20:22 | expr | provenance | |
60+
| graph-ql.js:28:9:28:28 | { query, variables } | graph-ql.js:28:11:28:15 | query | provenance | |
61+
| graph-ql.js:28:9:28:28 | { query, variables } | graph-ql.js:28:18:28:26 | variables | provenance | |
62+
| graph-ql.js:28:11:28:15 | query | graph-ql.js:31:13:31:17 | query | provenance | |
63+
| graph-ql.js:28:18:28:26 | variables | graph-ql.js:33:21:33:29 | variables | provenance | |
64+
| graph-ql.js:28:18:28:26 | variables | graph-ql.js:54:21:54:29 | variables | provenance | |
65+
| graph-ql.js:28:32:28:39 | req.body | graph-ql.js:28:9:28:28 | { query, variables } | provenance | |
66+
| graph-ql.js:31:13:31:17 | query | graph-ql.js:18:10:18:17 | { expr } | provenance | |
67+
| graph-ql.js:33:21:33:29 | variables | graph-ql.js:18:10:18:17 | { expr } | provenance | |
68+
| graph-ql.js:38:13:38:27 | { name, title } | graph-ql.js:38:15:38:18 | name | provenance | |
69+
| graph-ql.js:38:13:38:27 | { name, title } | graph-ql.js:38:21:38:25 | title | provenance | |
70+
| graph-ql.js:38:15:38:18 | name | graph-ql.js:39:19:39:22 | name | provenance | |
71+
| graph-ql.js:38:21:38:25 | title | graph-ql.js:39:26:39:30 | title | provenance | |
72+
| graph-ql.js:39:19:39:22 | name | graph-ql.js:39:19:39:30 | name + title | provenance | |
73+
| graph-ql.js:39:26:39:30 | title | graph-ql.js:39:19:39:30 | name + title | provenance | |
74+
| graph-ql.js:54:21:54:29 | variables | graph-ql.js:38:13:38:27 | { name, title } | provenance | |
5875
| react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
5976
| react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
6077
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | |
@@ -191,6 +208,22 @@ nodes
191208
| fastify.js:106:21:106:38 | request.query.code | semmle.label | request.query.code |
192209
| fastify.js:107:23:107:31 | userInput | semmle.label | userInput |
193210
| fastify.js:108:28:108:50 | reply.l ... tedCode | semmle.label | reply.l ... tedCode |
211+
| graph-ql.js:18:10:18:17 | { expr } | semmle.label | { expr } |
212+
| graph-ql.js:18:12:18:15 | expr | semmle.label | expr |
213+
| graph-ql.js:20:19:20:22 | expr | semmle.label | expr |
214+
| graph-ql.js:28:9:28:28 | { query, variables } | semmle.label | { query, variables } |
215+
| graph-ql.js:28:11:28:15 | query | semmle.label | query |
216+
| graph-ql.js:28:18:28:26 | variables | semmle.label | variables |
217+
| graph-ql.js:28:32:28:39 | req.body | semmle.label | req.body |
218+
| graph-ql.js:31:13:31:17 | query | semmle.label | query |
219+
| graph-ql.js:33:21:33:29 | variables | semmle.label | variables |
220+
| graph-ql.js:38:13:38:27 | { name, title } | semmle.label | { name, title } |
221+
| graph-ql.js:38:15:38:18 | name | semmle.label | name |
222+
| graph-ql.js:38:21:38:25 | title | semmle.label | title |
223+
| graph-ql.js:39:19:39:22 | name | semmle.label | name |
224+
| graph-ql.js:39:19:39:30 | name + title | semmle.label | name + title |
225+
| graph-ql.js:39:26:39:30 | title | semmle.label | title |
226+
| graph-ql.js:54:21:54:29 | variables | semmle.label | variables |
194227
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
195228
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
196229
| react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/graph-ql.js‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
const express = require('express');
2+
const { graphql, buildSchema } = require('graphql');
3+
4+
const app = express();
5+
app.use(express.json());
6+
7+
const schema = buildSchema(`
8+
type Query {
9+
greet(name: String!): String
10+
calc(expr: String!): String
11+
}
12+
`);
13+
14+
const root = {
15+
greet: ({ name }) => {
16+
return `Hello, ${name}!`;
17+
},
18+
calc: ({ expr }) => {
19+
try {
20+
return eval(expr).toString(); // $ Alert[js/code-injection]
21+
} catch (e) {
22+
return `Error: ${e.message}`;
23+
}
24+
}
25+
};
26+
27+
app.post('/graphql', async (req, res) => {
28+
const { query, variables } = req.body; // $ Source[js/code-injection]
29+
const result = await graphql({
30+
schema,
31+
source: query,
32+
rootValue: root,
33+
variableValues: variables
34+
});
35+
res.json(result);
36+
37+
const root1 = {
38+
greet: ({ name, title }) => {
39+
return eval(name + title).toString(); // $ Alert[js/code-injection]
40+
}
41+
};
42+
graphql({
43+
schema: buildSchema(`
44+
type Query {
45+
greet(name: String!, title: String): String
46+
}
47+
`),
48+
source: `
49+
query GreetUser($name: String!, $title: String) {
50+
greet(name: $name, title: $title)
51+
}
52+
`,
53+
rootValue: root1,
54+
variableValues: variables
55+
});
56+
});

0 commit comments

Comments
 (0)