JS: Add template resolution logic

Author: asgerf

javascript/ql/src/semmle/javascript/frameworks/Templating.qll

@@ -137,6 +137,11 @@ module Templating {
 
     /** Gets a data flow node that refers to an object whose properties become variables in the template. */
     DataFlow::Node getTemplateParamsNode() { result = range.getTemplateParamsNode() }
+
+    /** Gets the template file instantiated here, if any. */
+    TemplateFile getTemplateFile() {
+      result = getTemplateFileNode().(TemplateFileReference).getTemplateFile()
+    }
   }
 
   /** Companion module to the `TemplateInstantiation` class. */
@@ -155,4 +160,181 @@ module Templating {
       abstract DataFlow::Node getTemplateParamsNode();
     }
   }
+
+  /** A file that can be referenced by a template instantiation. */
+  abstract class TemplateFile extends File { }
+
+  /** Any HTML file, seen as a possible target for template instantiation. */
+  private class TemplateFileByExtension extends TemplateFile {
+    TemplateFileByExtension() { getFileType().isHtml() }
+  }
+
+  /**
+   * A data flow node whose string value refers to a template file.
+   *
+   * This is similar to `PathExpr` with two main differences:
+   * - It is not used for import resolution, and so can be computed in a later stage.
+   * - The root folder is considered unknown, and so a heuristic is used to guess the most
+   *   likely template file being referenced.
+   */
+  abstract class TemplateFileReference extends DataFlow::Node {
+    /** Gets the value that identifies the template. Defaults to `getStringValue()`. */
+    string getValue() { result = getStringValue() }
+
+    /** Gets the template file referenced by this node. */
+    final TemplateFile getTemplateFile() {
+      result = this.getValue().(TemplateFileReferenceString).getTemplateFile()
+    }
+  }
+
+  /** Get file argument of a template instantiation, seen as a template file reference. */
+  private class DefaultTemplateFileReference extends TemplateFileReference {
+    DefaultTemplateFileReference() {
+      this = any(TemplateInstantiaton inst).getTemplateFileNode()
+    }
+  }
+
+  /**
+   * A string that refers to a template file, and should be resolved as such.
+   *
+   * The string must be normalized, with backslashes replaced by forward slashes.
+   *
+   * This is automatically populated for instances of `TemplateFileReference`, but additional subclasses
+   * may be added if other strings need to be resolved.
+   *
+   * This is similar to `PathString` with two main differences:
+   * - It is not used for import resolution, and so can be computed in a later stage.
+   * - The root folder is considered unknown, and so a heuristic is used to guess the most
+   *   likely template file being referenced.
+   */
+  abstract class TemplateFileReferenceString extends string {
+    bindingset[this]
+    TemplateFileReferenceString() { this = this }
+
+    /** Gets the folder in which this string occurs, used to determine which file it could refer to. */
+    abstract Folder getContextFolder();
+
+    /**
+     * Gets the base name of the string, similar to `Container.getBaseName`.
+     */
+    string getBaseName() { result = this.regexpReplaceAll(".*/", "") }
+
+    /**
+     * Gets the stem, similar to `Container.getStem`.
+     */
+    string getStem() { result = getBaseName().regexpCapture("(.*?)(?:\\.([^.]*))?", 1) }
+
+    /** Gets the template file referenced by this string. */
+    final TemplateFile getTemplateFile() { result = getBestMatchingTarget(this) }
+  }
+
+  /** The value of a template reference node, as a template reference string. */
+  private class DefaultTemplateReferenceString extends TemplateFileReferenceString {
+    TemplateFileReference r;
+
+    DefaultTemplateReferenceString() { this = r.getValue().replaceAll("\\", "/") }
+
+    override Folder getContextFolder() { result = r.getFile().getParentContainer() }
+  }
+
+  /**
+   * Gets a "fingerprint" for the given template file, which is used to references
+   * that might refer to it (for pruning purposes only).
+   */
+  pragma[nomagic]
+  private string getTemplateFileFingerprint(TemplateFile file) {
+    result = file.getStem()
+    or
+    file.getStem() = "index" and
+    result = file.getParentContainer().getBaseName()
+  }
+
+  /**
+   * Gets a "fingerprint" for the given string, which must match one of the fingerprints of
+   * the referenced file (for pruning purposes only).
+   */
+  pragma[nomagic]
+  private string getTemplateRefFingerprint(TemplateFileReferenceString ref) {
+    result = ref.getStem() and not result = ["index", ""]
+    or
+    ref.getStem() = ["index", ""] and
+    result = ref.regexpCapture("(?:.*)?/([^/]*)/(?:index|)(?:\\.[^.]*)?", 1)
+    or
+    // If the reference is just 'index', it could potentially refer to any template file
+    // called 'index' -- we can't use the parent directory to prune candidates early.
+    ref = "index" and result = "index"
+  }
+
+  /**
+   * Gets a template file that could potentially be the target of `ref`, based on
+   * them having the same fingerprint.
+   *
+   * This is only used to speed up `getAMatchingTarget` by pruning out pairs that can't match.
+   */
+  pragma[nomagic]
+  private TemplateFile getAPotentialTarget(TemplateFileReferenceString ref) {
+    getTemplateFileFingerprint(result) = getTemplateRefFingerprint(ref)
+  }
+
+  /**
+   * Gets a template file whose path matches the given `ref`.
+   *
+   * A file matches if all path components of `ref` are part of the suffix of the file path,
+   * and in case a file extension is mentioned in `ref`, this must match that of the file.
+   *
+   * For example, a file at `src/foo/views/bar/baz.html` would be matched by the following:
+   * - `bar.html`
+   * - `bar/baz.html`
+   * - `views/bar/baz.html`
+   * - `baz` (extension can be omitted)
+   * - `bar/baz`
+   *
+   * But would not be matched by:
+   * - `foo/baz.html` (folder does not match)
+   * - `baz.ejs` (extension does not match)
+   *
+   * Additionally, a file whose stem is `index` matches if `ref` would match the parent folder by
+   * the above rules. For example: `bar` matches `src/bar/index.html`.
+   */
+  pragma[nomagic]
+  private TemplateFile getAMatchingTarget(TemplateFileReferenceString ref) {
+    result = getAPotentialTarget(ref) and
+    result.getAbsolutePath() =
+      any(string s) + ref + ["", "/index"] + ["", "." + result.getExtension()]
+  }
+
+  /**
+   * Gets the length of the longest common prefix between `file` and `ref`.
+   *
+   * This is used to rank all the possible files that `ref` could refer to.
+   * Picking the one with the highest rank ensures that the file most closely related
+   * in the file hierarchy is picked.
+   *
+   * For example, given the files:
+   * ```
+   * A/components/foo.js
+   * A/views/list.html
+   * B/components/foo.js
+   * B/views/list.html
+   * ```
+   * The string `list` in `A/components/foo.js` will resolve to `A/views/list.html`,
+   * and vice versa in `B/components/foo.js`.
+   */
+  pragma[nomagic]
+  private int getRankOfMatchingTarget(TemplateFile file, TemplateFileReferenceString ref) {
+    file = getAMatchingTarget(ref) and
+    exists(string filePath, string refPath |
+      // Pad each file name to ensure they differ at some index, in case one was a prefix of the other
+      filePath = file.getRelativePath() + "!" and
+      refPath = ref.getContextFolder().getRelativePath() + "@" and
+      result = min(int i | filePath.charAt(i) != refPath.charAt(i))
+    )
+  }
+
+  /**
+   * Gets the template file referred to by `ref`.
+   */
+  private TemplateFile getBestMatchingTarget(TemplateFileReferenceString ref) {
+    result = max(getAMatchingTarget(ref) as f order by getRankOfMatchingTarget(f, ref))
+  }
 }