Track Hapi request aliases before property reads

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 8390a2d1-70e3-4a01-84d3-3e5747d5da0b

Author: jacknojo

javascript/ql/lib/semmle/javascript/frameworks/Hapi.qll

@@ -106,7 +106,7 @@ module Hapi {
     RouteHandler rh, string property, DataFlow::TypeTracker t
   ) {
     t.start() and
-    result = rh.getRequestParameter().getAPropertyRead(property)
+    result = rh.getARequestSource().ref().getAPropertyRead(property)
     or
     exists(DataFlow::TypeTracker t2 | result = requestInputRef(rh, property, t2).track(t2, t))
   }
@@ -132,15 +132,15 @@ module Hapi {
           // `request.payload` is an object, so prefer a property read if possible.
           if exists(requestInputRef(rh, "payload").getAPropertyRead())
           then this = requestInputRef(rh, "payload").getAPropertyRead()
-          else this = rh.getRequestParameter().getAPropertyRead("payload")
+          else this = rh.getARequestSource().ref().getAPropertyRead("payload")
         )
         or
         kind = "parameter" and
         exists(string property | property = ["query", "params"] |
           // These are objects, so prefer a property read if possible.
           if exists(requestInputRef(rh, property).getAPropertyRead())
           then this = requestInputRef(rh, property).getAPropertyRead()
-          else this = rh.getRequestParameter().getAPropertyRead(property)
+          else this = rh.getARequestSource().ref().getAPropertyRead(property)
         )
         or
         exists(DataFlow::PropRead url |

javascript/ql/test/library-tests/frameworks/hapi/src/hapi.js

@@ -20,7 +20,7 @@ server2.ext('onPreResponse', function handler3(request, reply) { // HTTP::RouteH
 function handler4(request, reply){
   request.rawPayload;
   request.payload.foo;
-  request.query.bar;
+  getRequest(request).query.bar;
   request.url.path;
   request.headers.baz;
   request.state.token;
@@ -34,3 +34,7 @@ function getHandler() {
     return function (req, h){}
 }
 server2.route({handler: getHandler()});
+
+function getRequest(request) {
+  return request;
+}

javascript/ql/test/library-tests/frameworks/hapi/tests.expected

@@ -24,11 +24,16 @@ test_RequestExpr
 | src/hapi.js:20:19:20:25 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:21:3:21:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:22:3:22:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
-| src/hapi.js:23:3:23:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:23:3:23:21 | getRequest(request) | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:23:14:23:20 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:24:3:24:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:25:3:25:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:26:3:26:9 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:34:22:34:24 | req | src/hapi.js:34:12:34:30 | function (req, h){} |
+| src/hapi.js:38:1:40:1 | return of function getRequest | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:38:21:38:27 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:38:21:38:27 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:39:10:39:16 | request | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapiglue.js:13:32:13:38 | request | src/hapiglue.js:13:14:15:5 | functio ... n\\n    } |
 | src/hapiglue.js:13:32:13:38 | request | src/hapiglue.js:13:14:15:5 | functio ... n\\n    } |
 | src/hapiglue.js:14:9:14:15 | request | src/hapiglue.js:13:14:15:5 | functio ... n\\n    } |
@@ -102,7 +107,7 @@ test_ServerDefinition
 test_RequestInputAccess
 | src/hapi.js:21:3:21:20 | request.rawPayload | body | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:22:3:22:21 | request.payload.foo | body | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
-| src/hapi.js:23:3:23:19 | request.query.bar | parameter | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
+| src/hapi.js:23:3:23:31 | getRequ ... ery.bar | parameter | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:24:3:24:18 | request.url.path | url | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:25:3:25:21 | request.headers.baz | header | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
 | src/hapi.js:26:3:26:21 | request.state.token | cookie | src/hapi.js:20:1:27:1 | functio ... oken;\\n} |
@@ -174,10 +179,15 @@ test_RouteHandler_getARequestExpr
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:20:19:20:25 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:21:3:21:9 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:22:3:22:9 | request |
-| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:23:3:23:9 | request |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:23:3:23:21 | getRequest(request) |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:23:14:23:20 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:24:3:24:9 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:25:3:25:9 | request |
 | src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:26:3:26:9 | request |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:38:1:40:1 | return of function getRequest |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:38:21:38:27 | request |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:38:21:38:27 | request |
+| src/hapi.js:20:1:27:1 | functio ... oken;\\n} | src/hapi.js:39:10:39:16 | request |
 | src/hapi.js:34:12:34:30 | function (req, h){} | src/hapi.js:34:22:34:24 | req |
 | src/hapiglue.js:13:14:15:5 | functio ... n\\n    } | src/hapiglue.js:13:32:13:38 | request |
 | src/hapiglue.js:13:14:15:5 | functio ... n\\n    } | src/hapiglue.js:13:32:13:38 | request |