Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
condition: node => {
// eval.(ctx, script, ...)
if (node.arguments.length < 2)
return false;
if (node.callee.type === Syntax.MemberExpression && INVOCATION_FUNC_NAME_RE.test(node.callee.property.name)) {
const obj = node.callee.object;
// obj.eval.(), obj[eval].(),
if (obj.type === Syntax.MemberExpression && (obj.property.value || obj.property.name) === 'eval')
return true;
// eval.()
if (obj.name === 'eval')
return true;
}
return false;
},
condition: node => {
if (node.callee.type === Syntax.MemberExpression && INVOCATION_FUNC_NAME_RE.test(node.callee.property.name)) {
// postMessage.(ctx, script, ...)
if (node.arguments.length < 2 && node.callee.property.name !== 'bind')
return false;
const obj = node.callee.object;
// obj.postMessage.(), obj[postMessage].(),
if (obj.type === Syntax.MemberExpression && (obj.property.value || obj.property.name) === 'postMessage')
return true;
// postMessage.()
if (obj.name === 'postMessage')
return true;
}
return false;
},
condition: node => {
// super.prop = value
if (node.left.type === Syntax.MemberExpression && node.left.object.type === Syntax.Super)
return false;
return node.operator === '=' &&
node.left.type === Syntax.MemberExpression && !node.left.computed &&
node.left.property.type === Syntax.Identifier &&
shouldInstrumentProperty(node.left.property.name);
},
condition: (node, parent) => {
if (node.name !== 'postMessage' || !parent)
return false;
// Skip: window.postMessage, postMessage.call
if (parent.type === Syntax.MemberExpression)
return false;
// Skip: class X { postMessage () {} }
if (parent.type === Syntax.MethodDefinition)
return false;
// Skip: class postMessage { x () {} }
if (parent.type === Syntax.ClassDeclaration)
return false;
// Skip: function postMessage () { ... }
if ((parent.type === Syntax.FunctionExpression || parent.type === Syntax.FunctionDeclaration) &&
parent.id === node)
return false;
// Skip: function (postMessage) { ... } || function func(postMessage) { ... } || postMessage => { ... }
// Skip: const location = value;
if (parent.type === Syntax.VariableDeclarator && parent.id === node)
return false;
// Skip: location = value || function x (location = value) { ... }
if ((parent.type === Syntax.AssignmentExpression || parent.type === Syntax.AssignmentPattern) &&
parent.left === node)
return false;
// Skip: function location() {}
if ((parent.type === Syntax.FunctionExpression || parent.type === Syntax.FunctionDeclaration) &&
parent.id === node)
return false;
// Skip: object.location || location.field
if (parent.type === Syntax.MemberExpression)
return false;
// Skip: { location: value }
if (parent.type === Syntax.Property && parent.key === node)
return false;
// Skip: location++ || location-- || ++location || --location
if (parent.type === Syntax.UpdateExpression && (parent.operator === '++' || parent.operator === '--'))
return false;
// Skip: function (location) { ... } || function func(location) { ... } || location => { ... }
if ((parent.type === Syntax.FunctionExpression || parent.type === Syntax.FunctionDeclaration ||
parent.type === Syntax.ArrowFunctionExpression) && parent.params.indexOf(node) !== -1)
return false;
// Skip already transformed: __get$Loc(location)
condition: (node, parent) => {
if (!parent)
return false;
// Skip: window.postMessage.field
if (parent.type === Syntax.MemberExpression && (parent.property === node || parent.object === node))
return false;
// Skip: window.postMessage()
if (parent.type === Syntax.CallExpression && parent.callee === node)
return false;
// Skip: window.postMessage = 1, window["postMessage"] = 1
if (parent.type === Syntax.AssignmentExpression && parent.left === node)
return false;
// Skip already transformed: __get$PostMessage(window.postMessage), __get$PostMessage(window["postMessage"])
if (parent.type === Syntax.CallExpression && parent.callee.type === Syntax.Identifier &&
parent.callee.name === INSTRUCTION.getPostMessage)
return false;
// window.postMessage
condition: node => {
const left = node.left;
// super[prop] = value
if (left.type === Syntax.MemberExpression && left.object.type === Syntax.Super)
return false;
if (node.operator === '=' && left.type === Syntax.MemberExpression && left.computed)
return left.property.type === Syntax.Literal ? shouldInstrumentProperty(left.property.value) : true;
return false;
},
condition: node => {
if (!node.arguments.length)
return false;
const callee = node.callee;
// eval()
if (callee.type === Syntax.Identifier && callee.name === 'eval')
return true;
// obj.eval(), obj['eval'](),
return callee.type === Syntax.MemberExpression &&
(callee.property.type === Syntax.Identifier && callee.property.name ||
callee.property.type === Syntax.Literal && callee.property.value) === 'eval';
},
return false;
// object[prop] = value
if (parent.type === Syntax.AssignmentExpression && parent.left === node)
return false;
// delete object[prop]
if (parent.type === Syntax.UnaryExpression && parent.operator === 'delete')
return false;
// object[prop]++ || object[prop]-- || ++object[prop] || --object[prop]
if (parent.type === Syntax.UpdateExpression && parent.operator === '++' || parent.operator === '--')
return false;
// object[prop]()
if (parent.type === Syntax.CallExpression && parent.callee === node)
return false;
// new (object[prop])() || new (object[prop])
if (parent.type === Syntax.NewExpression && parent.callee === node)
return false;
// for(object[prop] in source)
if (parent.type === Syntax.ForInStatement && parent.left === node)
return false;
return true;
},
// WARNING: this file is used by both the client and the server.
// Do not use any browser or node-specific API!
// -------------------------------------------------------------
import { createStringLiteral, createMethCallWrapper } from '../node-builder';
import { Syntax } from 'esotope-hammerhead';
import { shouldInstrumentMethod } from '../instrumented';
// Transform:
// obj.method(args...); obj[method](args...); -->
// _call$(obj, 'method', args...); _call$(obj, method, args...);
export default {
nodeReplacementRequireTransform: true,
nodeTypes: [Syntax.CallExpression],
condition: node => {
const callee = node.callee;
if (callee.type === Syntax.MemberExpression) {
if (callee.computed)
return callee.property.type === Syntax.Literal ? shouldInstrumentMethod(callee.property.value) : true;
return shouldInstrumentMethod(callee.property.name);
}
return false;
},
run: node => {
const callee = node.callee;