Merge pull request github#6574 from asgerf/js/vue-api-graphs

Approved by erik-krogh

Author: codeql-ci

javascript/ql/lib/semmle/javascript/AMD.qll

@@ -313,6 +313,19 @@ class AmdModule extends Module {
       name = pwn.getPropertyName()
     )
   }
+
+  override DataFlow::Node getABulkExportedNode() {
+    // Assigned to `module.exports` via the factory's `module` parameter
+    exists(AbstractModuleObject m, DataFlow::PropWrite write |
+      m.getModule() = this and
+      write.getPropertyName() = "exports" and
+      write.getBase().analyze().getAValue() = m and
+      result = write.getRhs()
+    )
+    or
+    // Returned from factory function
+    result = getDefine().getModuleExpr().flow()
+  }
 }
 
 /**

javascript/ql/lib/semmle/javascript/Closure.qll

@@ -177,6 +177,10 @@ module Closure {
         )
       )
     }
+
+    override DataFlow::Node getABulkExportedNode() {
+      result = getExportsVariable().getAnAssignedExpr().flow()
+    }
   }
 
   /**

javascript/ql/lib/semmle/javascript/Modules.qll

@@ -111,6 +111,23 @@ abstract class Module extends TopLevel {
   cached
   abstract DataFlow::Node getAnExportedValue(string name);
 
+  /**
+   * Gets a value that is exported as the whole exports object of this module.
+   */
+  cached
+  DataFlow::Node getABulkExportedNode() { none() } // overridden in subclasses
+
+  /**
+   * Gets the ES2015 `default` export from this module, or for other types of modules,
+   * gets a bulk exported node.
+   *
+   * This can be used to determine which value a default-import will likely refer to,
+   * as the interaction between different module types is not standardized.
+   */
+  DataFlow::Node getDefaultOrBulkExport() {
+    result = [getAnExportedValue("default"), getABulkExportedNode()]
+  }
+
   /**
    * Gets the root folder relative to which the given import path (which must
    * appear in this module) is resolved.

javascript/ql/lib/semmle/javascript/NodeJS.qll

@@ -99,6 +99,14 @@ class NodeModule extends Module {
     )
   }
 
+  override DataFlow::Node getABulkExportedNode() {
+    exists(DataFlow::PropWrite write |
+      write.getBase().asExpr() = getModuleVariable().getAnAccess() and
+      write.getPropertyName() = "exports" and
+      result = write.getRhs()
+    )
+  }
+
   /** Gets a symbol that the module object inherits from its prototypes. */
   private string getAnImplicitlyExportedSymbol() {
     exists(ExternalConstructor ec | ec = getPrototypeOfExportedExpr() |

javascript/ql/lib/semmle/javascript/PackageExports.qll

@@ -164,11 +164,9 @@ private DataFlow::Node getAValueExportedByPackage() {
  * Gets an exported node from the module `mod`.
  */
 private DataFlow::Node getAnExportFromModule(Module mod) {
-  result.analyze().getAValue() = mod.(NodeModule).getAModuleExportsValue()
-  or
-  result = mod.(Closure::ClosureModule).getExportsVariable().getAnAssignedExpr().flow()
+  result = mod.getAnExportedValue(_)
   or
-  result.analyze().getAValue() = mod.(AmdModule).getDefine().getAModuleExportsValue()
+  result = mod.getABulkExportedNode()
   or
-  result = mod.getAnExportedValue(_)
+  result.analyze().getAValue() = TAbstractModuleObject(mod)
 }