CodeQL query for Javascript project

[Sridharc20]

Hi everyone,

I’m working on developing CodeQL queries for JavaScript and would like your input. My goals are:
1. Check if a given OSS package is present in package.json.
2. Verify if the OSS package is actually imported in the code.
3. Generate a call graph.
4. Determine whether a sink function is reachable and executed.
5. Assess if the sink function is exploitable.

So far, I’ve been able to generate the call graph. I’d appreciate any guidance on whether the other checks are feasible with CodeQL, and suggestions on how to approach them.

[jketema]

Hi @Sridharc20,

Thanks for your question.

1. Check if a given OSS package is present in package.json.

This can be checked using the PackageJson class.

2. Verify if the OSS package is actually imported in the code.

This can be checked using the Import class.

4. Determine whether a sink function is reachable and executed.
5. Assess if the sink function is exploitable.

For these you would likely want to have a look a dataflow.

[sridhar-chandrashekar1]

I would like to automate this process, but I’ve found that generalizing a CodeQL query (source-to-sink) for any vulnerability is not feasible. For each vulnerability, I need to modify the CodeQL query accordingly. Any guidance on this would be greatly appreciated.

Essentially, my goal is to automate the following steps using CodeQL:

• Trace code paths to determine whether the vulnerable code is reachable from entry points (e.g., main functions, API endpoints, event handlers).
• Identify all potential entry points where execution begins or where external inputs are processed.
• Determine whether external inputs (such as user data, API requests, or file inputs) can reach the vulnerable code.

[jketema]

• Trace code paths to determine whether the vulnerable code is reachable from entry points (e.g., main functions, API endpoints, event handlers).

• Identify all potential entry points where execution begins or where external inputs are processed.

• Determine whether external inputs (such as user data, API requests, or file inputs) can reach the vulnerable code.

This is what the dataflow library is for. But it sound like you want to automate something on top of that? It is not clear to me what though.