Global taint tracking in nodejs - no paths returned

[dvec01]

I have the following query:

/**
 * @name Command injection
 * @kind path-problem
 */

import javascript
import semmle.javascript.dataflow.TaintTracking
import DataFlow::PathGraph

class CommandInjectionConfig extends DataFlow::Configuration {
  CommandInjectionConfig() { this = "CommandInjection" }

  override predicate isSource(DataFlow::Node source) {
    exists(Function f | not f.inExternsFile() and f.getName() = "test" |
      f.getAParameter() = source.asExpr()
    )
  }

  override predicate isSink(DataFlow::Node sink) {
    DataFlow::moduleMember("child_process", "exec").getACall().getArgument(0) = sink
  }
}

from CommandInjectionConfig cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "This command depends on $@.", source.getNode(),
  source.getNode().getStringValue()

Running this on the following file returns no paths. However, the source and sinks are correct. Changing the isSink predicate to any() does not return any results either. What is wrong with the above configuration?

var cp = require('child_process');

function test(p) {
  cp.exec(p);
}

[rvermeulen]

Hi @dvec01,

Your configuration is fine.
In your select statement you are asking for the runtime value of the source using getStringValue().
That only works for constants and string literals.

If you change getStringValue() with toString() to get the string representation of the node, you will get the expected results.

[dvec01]

Thank you, that fixed it!