Debug JsViewBindingPath

advanced-security · Jan 17, 2024 · 1bfb972 · 1bfb972
1 parent d935f6d
commit 1bfb972
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 11 deletions.
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Bindings.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Bindings.qll
@@ -342,8 +342,9 @@ private newtype TBindingPath =
       earlyPathPropertyBinding(_, binding, bindingPath)
       or
       latePathBinding(_, binding, bindingPath)
-    ) and
-    not bindingPath.mayHaveStringValue(_)
+    )
+    // and
+    // not bindingPath.mayHaveStringValue(_)
   }
 
 /**
@@ -423,6 +424,13 @@ private newtype TBindingTarget =
   TXmlContextBindingTarget(ContextBindingAttribute target, Binding binding) {
     binding = TXmlContextBinding(target, _)
   } or
+  TEarlyJavaScriptBindingTarget(DataFlow::Node target, Binding binding) {
+    exists(DataFlow::NewNode newNode, Property property |
+      binding = TEarlyJavaScriptPropertyBinding(newNode, _) and
+      newNode.getAnArgument().getALocalSource().asExpr().(ObjectExpr).getAProperty() = property and
+      target = property.getInit().flow().getALocalSource()
+    )
+  } or
   TLateJavaScriptBindingTarget(DataFlow::Node target, Binding binding) {
     exists(DataFlow::MethodCallNode call |
       binding = TLateJavaScriptContextBinding(call, _) and
@@ -453,6 +461,11 @@ class BindingTarget extends TBindingTarget {
       result = attribute.getName()
     )
     or
+    exists(DataFlow::Node target |
+      this = TEarlyJavaScriptBindingTarget(target, _) and
+      result = target.toString()
+    )
+    or
     exists(DataFlow::Node target |
       this = TLateJavaScriptBindingTarget(target, _) and
       result = target.toString()
@@ -484,7 +497,10 @@ class BindingTarget extends TBindingTarget {
 
   DataFlow::Node asDataFlowNode() {
     exists(DataFlow::Node target |
-      this = TLateJavaScriptBindingTarget(target, _) and
+      (
+        this = TEarlyJavaScriptBindingTarget(target, _) or
+        this = TLateJavaScriptBindingTarget(target, _)
+      ) and
       result = target
     )
   }
@@ -500,6 +516,11 @@ class BindingTarget extends TBindingTarget {
       result = attribute.getLocation()
     )
     or
+    exists(DataFlow::Node target |
+      this = TEarlyJavaScriptBindingTarget(target, _) and
+      result = target.asExpr().getLocation()
+    )
+    or
     exists(DataFlow::Node target |
       this = TLateJavaScriptBindingTarget(target, _) and
       result = target.asExpr().getLocation()
@@ -514,6 +535,7 @@ class BindingTarget extends TBindingTarget {
   Binding getBinding() {
     this = TXmlPropertyBindingTarget(_, result) or
     this = TXmlContextBindingTarget(_, result) or
+    this = TEarlyJavaScriptBindingTarget(_, result) or
     this = TLateJavaScriptBindingTarget(_, result) or
     this = TJsonPropertyBindingTarget(_, _, result)
   }

diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll
@@ -65,12 +65,6 @@ abstract class UI5BindingPath extends BindingPath {
   /**
    * Gets the view that this binding path resides in.
    */
-  /*
-   * NOTE:
-   * - [[Declarative (inside data format): path --getFile--> view]] --getController--> controller --getModel--> model.
-   * - Procedural (inside JS source code): [[path --(getting the handler it's inside and getting the owner controller of the handler )--> controller --getView--> view]].
-   */
-
   UI5View getView() {
     /* 1. Declarative, inside a certain data format. */
     this.getLocation().getFile() = result
@@ -392,10 +386,11 @@ class JsonView extends UI5View {
 
 class JsViewBindingPath extends UI5BindingPath {
   DataFlow::Node bindingTarget;
+  Binding binding;
 
   JsViewBindingPath() {
-    this.getBinding().getBindingTarget().asDataFlowNode() = bindingTarget //and
-    //bindingTarget.getFile() instanceof JsView
+    bindingTarget = binding.getBindingTarget().asDataFlowNode() and
+    binding.getBindingPath() = this
   }
 
   override string getLiteralRepr() { result = bindingTarget.getALocalSource().getStringValue() }