Referencing APIs from the application’s own package in a JavaScript model pack

[hriggimmt]

Hi,

The application we’d like to analyse uses a custom HTTP framework that is implemented in the same package as the application itself. Application code imports the framework using a relative import:

Import { Router } from ‘../lib/httpframework/router’;

const router = new Router();
router.post(
    ‘/endpoint’,
    async (ctx) => {
        exec(ctx.querystring);   // shell injection
    } 
)

Using a model pack, we’d like to model request data passed to route handlers as a remote-flow source. Using the examples here, we could do that for an external framework like so:

extensions:
  - addsTo:
      pack: codeql/javascript-all
      extensible: sourceModel
    data:
      - [
          "external-framework-package",
          "Member[Router].Instance.Member[post].Argument[1].Parameter[0].Member[querystring]”,
          "remote",
        ]

Obviously however our router type is not from an external package - it's a local import.

Is it possible to reference a local type/API like this in a model pack?

Thanks!

[jketema]

Hi,

I'll have a ask internally. I'm not sure how soon I can get back to you though.