-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Expand file tree
/
Copy pathIncompatibleService.ql
More file actions
152 lines (143 loc) · 4.96 KB
/
IncompatibleService.ql
File metadata and controls
152 lines (143 loc) · 4.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
/**
* @name Incompatible dependency injection
* @description Dependency-injecting a service of the wrong kind causes an error at runtime.
* @kind problem
* @problem.severity error
* @precision high
* @id js/angular/incompatible-service
* @tags quality
* reliability
* correctness
* frameworks/angularjs
*/
import javascript
import AngularJS
/**
* Holds if `request` originates from a "service", "directive" or "filter" method call.
*/
predicate isServiceDirectiveOrFilterFunction(InjectableFunctionServiceRequest request) {
exists(InjectableFunction f | f = request.getAnInjectedFunction() |
exists(ServiceRecipeDefinition def | def.getAFactoryFunction() = f) or
exists(FactoryRecipeDefinition def | def.getAFactoryFunction() = f) or
exists(DirectiveDefinition def | def.getAFactoryFunction() = f) or
exists(FilterDefinition def | def.getAFactoryFunction() = f)
)
}
/**
* Holds if `request` originates from a "controller" method call.
*/
predicate isControllerFunction(InjectableFunctionServiceRequest request) {
exists(InjectableFunction f | f = request.getAnInjectedFunction() |
exists(ControllerDefinition def | def.getAFactoryFunction() = f)
)
}
/**
* Holds if `request` originates from a "run" method call.
*/
predicate isRunMethod(InjectableFunctionServiceRequest request) {
exists(InjectableFunction f | f = request.getAnInjectedFunction() |
exists(RunMethodDefinition def | def.getRunMethod() = f)
)
}
/**
* Holds if `request` originates from a "config" method call.
*/
predicate isConfigMethod(InjectableFunctionServiceRequest request) {
exists(InjectableFunction f | f = request.getAnInjectedFunction() |
exists(ConfigMethodDefinition def | def.getConfigMethod() = f)
)
}
/**
* Holds if `kind` is a service kind that is compatible with all requests.
*/
predicate isWildcardKind(string kind) {
kind = "type" or // builtins of kind "type" are usable everywhere
kind = "decorator" // a decorator is always allowed, its decoratee might not be
}
/**
* Holds if `request` is compatible with a service of kind `kind`.
* (see https://docs.angularjs.org/guide/di)
*/
predicate isCompatibleRequestedService(InjectableFunctionServiceRequest request, string kind) {
isWildcardKind(kind) and exists(request)
or
(
isServiceDirectiveOrFilterFunction(request) or
isRunMethod(request) or
isControllerFunction(request)
) and
kind = ["value", "service", "factory", "constant", "provider-value"]
or
isControllerFunction(request) and
kind = "controller-only"
or
isConfigMethod(request) and
(
kind = "constant" or
kind = "provider"
)
}
/**
* Gets the kind of a service named `serviceName`.
*/
string getServiceKind(InjectableFunctionServiceRequest request, string serviceName) {
exists(ServiceReference id | id = request.getAServiceDefinition(serviceName) |
id = getBuiltinServiceOfKind(result)
or
exists(CustomServiceDefinition custom |
id = custom.getServiceReference() and
(
custom instanceof ValueRecipeDefinition and result = "value"
or
custom instanceof ServiceRecipeDefinition and result = "service"
or
custom instanceof FactoryRecipeDefinition and result = "factory"
or
custom instanceof DecoratorRecipeDefinition and result = "decorator"
or
custom instanceof ConstantRecipeDefinition and result = "constant"
or
(
custom instanceof ProviderRecipeDefinition and
if serviceName.matches("%Provider")
then result = "provider"
else result = "provider-value"
)
)
)
)
}
from
InjectableFunctionServiceRequest request, string name, string componentDescriptionString,
string compatibleWithString, string kind
where
name = request.getAServiceName() and
name != "$provide" and
name != "$injector" and // special case: these services are always allowed
kind = getServiceKind(request, name) and
exists(request.getAServiceDefinition(name)) and // ignore unknown/undefined services
not isCompatibleRequestedService(request, kind) and
compatibleWithString =
concat(string compatibleKind |
isCompatibleRequestedService(request, compatibleKind) and
not isWildcardKind(compatibleKind)
|
"'" + compatibleKind + "'", ", " order by compatibleKind
).regexpReplaceAll(",(?=[^,]+$)", " or") and
(
isServiceDirectiveOrFilterFunction(request) and
componentDescriptionString = "Components such as services, directives, filters, and animations"
or
isControllerFunction(request) and
componentDescriptionString = "Controllers"
or
isRunMethod(request) and
componentDescriptionString = "Run methods"
or
isConfigMethod(request) and
componentDescriptionString = "Config methods"
)
select request,
"'" + name + "' is a dependency of kind '" + kind + "', and cannot be injected here. " +
componentDescriptionString + " can only be injected with dependencies of kind " +
compatibleWithString + "."