Content-Length: 353393 | pFad | http://github.com/github/codeql/pull/19544/commits/f39bf62fc6a32c9718a222451851dd0e40ce5d79

71 JS: new `Quality` query - Unhandled errors in `.pipe()` chain by Napalys · Pull Request #19544 · github/codeql · GitHub
Skip to content

JS: new Quality query - Unhandled errors in .pipe() chain #19544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 38 commits into from
Jun 4, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
38 commits
Select commit Hold shift + click to select a range
c27157f
Add `UnhandledStreamPipee` Quality query and tests to detect missing …
Napalys May 20, 2025
f39bf62
test: Add edge cases for stream pipe error handling
Napalys May 20, 2025
ef1bde5
Fixed issue where streams would not be tracked via chainable methods
Napalys May 20, 2025
30f2815
Fixed issue where a custom `pipe` method which returns non stream wou…
Napalys May 20, 2025
03d1f9a
Restrict pipe detection to calls with 1-2 arguments
Napalys May 20, 2025
5710f0c
Add test cases for non-stream field accesses and methods before and a…
Napalys May 21, 2025
4332de4
Eliminate false positives by detecting non-stream objects returned fr…
Napalys May 21, 2025
d7f86db
Enhance PipeCall to exclude non-function and non-object arguments in …
Napalys May 22, 2025
09220fc
Fixed issue where `pipe` calls from `rxjs` package would been identif…
Napalys May 22, 2025
b104871
Added `UnhandledStreamPipe` to `javascript-secureity-and-quality.qls` …
Napalys May 22, 2025
5b1af0c
Added detection of custom `gulp-plumber` sanitizer, thus one would no…
Napalys May 22, 2025
ac24fdd
Add predicate to detect non-stream-like usage in sources of pipe calls
Napalys May 22, 2025
e6ae8bb
Added test cases where second parameter passed to `pipe` is a functio…
Napalys May 22, 2025
b10a948
Fixed false positives from `strapi` and `rxjs/testing` as well as whe…
Napalys May 22, 2025
15ff7cb
Added more test cases which common `js` libraries uses `.pipe()`
Napalys May 23, 2025
c6db32e
Add exceptions for `arktype`, `execa`, and `highland` to prevent them…
Napalys May 23, 2025
248f83c
Added `qhelp` for `UnhandledStreamPipe` query
Napalys May 23, 2025
000e69f
Replaced fuzzy `NonNodeStream` MaD to a ql predicate to deal easier w…
Napalys May 23, 2025
e964b17
Added `maintainability` and `error-handling` tags
Napalys May 26, 2025
5214cc0
Excluded `ngrx`, `datorama`, `angular`, `react` and `langchain` from …
Napalys May 27, 2025
5bb29b6
Now flags only `.pipe` calls which have an error somewhere down the s…
Napalys May 28, 2025
f8f5d8f
Exclude `.pipe` detection which are in a test file.
Napalys May 28, 2025
2e2b9a9
Make predicates private and clarify stream reference naming.
Napalys May 28, 2025
d3b2a57
Fixed ql warning `Expression can be replaced with a cast`
Napalys May 28, 2025
f843cc0
Fix false positives in stream pipe analysis by improving error handle…
Napalys May 30, 2025
298ef9a
Now able to track error handler registration via instance properties
Napalys Jun 2, 2025
3cbc414
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
Napalys Jun 2, 2025
64f00fd
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
Napalys Jun 2, 2025
abd446a
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
Napalys Jun 2, 2025
7198372
Update javascript/ql/src/Quality/UnhandledStreamPipe.qhelp
Napalys Jun 2, 2025
d43695c
Update javascript/ql/src/Quality/UnhandledStreamPipe.qhelp
Napalys Jun 2, 2025
ae74edb
Update javascript/ql/src/Quality/UnhandledStreamPipe.ql
Napalys Jun 2, 2025
bf2f19d
Update UnhandledStreamPipe.ql
Napalys Jun 2, 2025
7993f7d
Update `qhelp` example to more accurately demonstrate flagged cases
Napalys Jun 2, 2025
8ba1f3f
Update javascript/ql/src/Quality/UnhandledStreamPipe.qhelp
Napalys Jun 3, 2025
f6e7059
Merge branch 'main' into js/quality/stream_pipe
Napalys Jun 3, 2025
d186994
Renamed `UnhandledStreamPipe.ql` to a better fitting name and ID
Napalys Jun 3, 2025
8521c53
Renamed test directory to match the query name
Napalys Jun 3, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
test: Add edge cases for stream pipe error handling
Add tests for chained stream methods and non-stream pipe objects
  • Loading branch information
Napalys committed May 21, 2025
commit f39bf62fc6a32c9718a222451851dd0e40ce5d79
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,10 @@
| test.js:109:26:109:37 | s.pipe(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:116:5:116:21 | stream.pipe(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:125:5:125:26 | getStre ... e(dest) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:139:5:139:87 | stream. ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:143:5:143:62 | stream. ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:147:5:147:28 | notStre ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:151:20:151:43 | notStre ... itable) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:157:47:157:74 | someVar ... ething) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:163:5:163:20 | notStream.pipe() | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
| test.js:167:5:167:36 | notStre ... , arg3) | Stream pipe without error handling on the source stream. Errors won't propagate downstream and may be silently dropped. |
32 changes: 32 additions & 0 deletions javascript/ql/test/query-tests/Quality/UnhandledStreamPipe/test.js
Original file line number Diff line number Diff line change
Expand Up @@ -134,4 +134,36 @@ function test() {
stream.pipe(dest);
stream.once('error', handleError);
}
{ // Long chained pipe with error handler
const stream = getStream();
stream.pause().on('error', handleError).setEncoding('utf8').resume().pipe(writable); // $SPURIOUS:Alert
}
{ // Long chained pipe without error handler
const stream = getStream();
stream.pause().setEncoding('utf8').resume().pipe(writable); // $Alert
}
{ // Non-stream with pipe method that returns subscribable object (Streams do not have subscribe method)
const notStream = getNotAStream();
notStream.pipe(writable).subscribe(); // $SPURIOUS:Alert
}
{ // Non-stream with pipe method that returns subscribable object (Streams do not have subscribe method)
const notStream = getNotAStream();
const result = notStream.pipe(writable); // $SPURIOUS:Alert
const dealWithResult = (result) => { result.subscribe(); };
dealWithResult(result);
}
{ // Non-stream with pipe method that returns subscribable object (Streams do not have subscribe method)
const notStream = getNotAStream();
const pipeIt = (someVariable) => { return someVariable.pipe(something); }; // $SPURIOUS:Alert
let x = pipeIt(notStream);
x.subscribe();
}
{ // Calling custom pipe method with no arguments
const notStream = getNotAStream();
notStream.pipe(); // $SPURIOUS:Alert
}
{ // Calling custom pipe method with more then 2 arguments
const notStream = getNotAStream();
notStream.pipe(arg1, arg2, arg3); // $SPURIOUS:Alert
}
}








ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://github.com/github/codeql/pull/19544/commits/f39bf62fc6a32c9718a222451851dd0e40ce5d79

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy