JS: Model Sails Action2 inputs as remote sources

Author: theinfosecguy

docs/codeql/reusables/supported-frameworks.rst

@@ -191,6 +191,7 @@ and the CodeQL library pack ``codeql/javascript-all`` (`changelog <https://githu
    react native, HTML framework
    request, Network communicator
    restify, Server
+   Sails.js Action2 controllers, Server
    sequelize, Database
    socket.io, Network communicator
    sqlite3, Database

javascript/ql/lib/change-notes/2026-07-07-sails-action2-inputs.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added support for treating declared `inputs` properties in Sails Action2 controller files as remote flow sources. This may improve results for security queries such as `js/path-injection`.

javascript/ql/lib/semmle/javascript/frameworks/HttpFrameworks.qll

@@ -7,4 +7,5 @@ import semmle.javascript.frameworks.Micro
 import semmle.javascript.frameworks.Restify
 import semmle.javascript.frameworks.Connect
 import semmle.javascript.frameworks.Fastify
+import semmle.javascript.frameworks.Sails
 import semmle.javascript.frameworks.Spife

javascript/ql/lib/semmle/javascript/frameworks/Sails.qll

@@ -0,0 +1,85 @@
+/**
+ * Provides classes for working with [Sails](https://sailsjs.com/) applications.
+ */
+
+import javascript
+import semmle.javascript.frameworks.HTTP
+private import DataFlow
+
+/**
+ * Provides classes for working with [Sails](https://sailsjs.com/) applications.
+ */
+module Sails {
+  /**
+   * A Sails Action2 action object exported from a module.
+   *
+   * For example:
+   *
+   * ```javascript
+   * module.exports = {
+   *   inputs: { filename: { type: "string" } },
+   *   fn(inputs, exits) { ... }
+   * };
+   * ```
+   */
+  private class Action2Action extends ObjectExpr {
+    Action2Action() {
+      exists(Module mod, DataFlow::FunctionNode fn |
+        mod.getABulkExportedNode().getALocalSource().asExpr() = this and
+        this.getFile().getRelativePath().regexpMatch("(^|.*/)api/controllers/.*") and
+        this.getPropertyByName("inputs").getInit() instanceof ObjectExpr and
+        fn = DataFlow::valueNode(this.getPropertyByName("fn").getInit()).getAFunctionValue()
+      )
+    }
+
+    /**
+     * Gets the `fn` function that handles the action.
+     */
+    DataFlow::FunctionNode getFunction() {
+      result = DataFlow::valueNode(this.getPropertyByName("fn").getInit()).getAFunctionValue()
+    }
+
+    /**
+     * Gets the name of an input declared by this action.
+     */
+    string getADeclaredInputName() {
+      result = this.getPropertyByName("inputs").getInit().(ObjectExpr).getAProperty().getName()
+    }
+  }
+
+  /**
+   * A Sails Action2 handler function.
+   */
+  private class Action2RouteHandler extends Http::Servers::StandardRouteHandler,
+    DataFlow::FunctionNode
+  {
+    Action2Action action;
+
+    Action2RouteHandler() { this = action.getFunction() }
+
+    /**
+     * Gets the parameter of the action handler that contains the validated action inputs.
+     */
+    DataFlow::ParameterNode getInputsParameter() { result = this.getParameter(0) }
+
+    /**
+     * Gets the name of an input declared by this action.
+     */
+    string getADeclaredInputName() { result = action.getADeclaredInputName() }
+  }
+
+  /**
+   * An access to a user-controlled Sails Action2 input.
+   */
+  private class Action2InputAccess extends Http::RequestInputAccess {
+    Action2RouteHandler rh;
+
+    Action2InputAccess() {
+      this = rh.getInputsParameter().getAPropertyRead(rh.getADeclaredInputName())
+    }
+
+    override Action2RouteHandler getRouteHandler() { result = rh }
+
+    override string getKind() { result = "parameter" }
+  }
+}

javascript/ql/test/library-tests/frameworks/Sails/src/api/controllers/attachments/assigned-action.js

@@ -0,0 +1,11 @@
+const action = {
+  inputs: {
+    name: { type: "string", required: true }
+  },
+
+  fn(inputs, exits) {
+    return exits.success(inputs.name);
+  }
+};
+
+module.exports = action;

javascript/ql/test/library-tests/frameworks/Sails/src/api/controllers/attachments/destructured-action.js

@@ -0,0 +1,9 @@
+module.exports = {
+  inputs: {
+    filename: { type: "string", required: true }
+  },
+
+  async fn({ filename }, exits) {
+    return exits.success(filename);
+  }
+};

javascript/ql/test/library-tests/frameworks/Sails/src/api/controllers/attachments/download-thumbnail.js

@@ -0,0 +1,14 @@
+module.exports = {
+  inputs: {
+    id: { type: "string", regex: /^[0-9]+$/, required: true },
+    filename: { type: "string", required: true }
+  },
+
+  async fn(inputs, exits) {
+    const id = inputs.id;
+    const filename = inputs.filename;
+    const notDeclared = inputs.notDeclared;
+
+    return exits.success({ id, filename, notDeclared });
+  }
+};

javascript/ql/test/library-tests/frameworks/Sails/src/api/helpers/read-thumbnail.js

@@ -0,0 +1,9 @@
+module.exports = {
+  inputs: {
+    filename: { type: "string", required: true }
+  },
+
+  async fn(inputs, exits) {
+    return exits.success(inputs.filename);
+  }
+};

javascript/ql/test/library-tests/frameworks/Sails/src/lib/machine.js

@@ -0,0 +1,9 @@
+module.exports = {
+  inputs: {
+    filename: { type: "string", required: true }
+  },
+
+  fn(inputs, exits) {
+    return exits.success(inputs.filename);
+  }
+};

javascript/ql/test/library-tests/frameworks/Sails/tests.expected

@@ -0,0 +1,9 @@
+test_routeHandler
+| src/api/controllers/attachments/assigned-action.js:6:5:8:3 | (inputs ... e);\\n  } |
+| src/api/controllers/attachments/destructured-action.js:6:11:8:3 | ({ file ... e);\\n  } |
+| src/api/controllers/attachments/download-thumbnail.js:7:11:13:3 | (inputs ... });\\n  } |
+test_requestInputAccess
+| src/api/controllers/attachments/assigned-action.js:7:26:7:36 | inputs.name | parameter |
+| src/api/controllers/attachments/destructured-action.js:6:14:6:21 | filename | parameter |
+| src/api/controllers/attachments/download-thumbnail.js:8:16:8:24 | inputs.id | parameter |
+| src/api/controllers/attachments/download-thumbnail.js:9:22:9:36 | inputs.filename | parameter |