Merge pull request #2 from adrienpessu/copilot/modify-vue-qll-for-maintenance

Move Vue Composition API flow models into Vue.qll

Author: adrienpessu

javascript/ql/lib/change-notes/2026-07-16-vue-router-useRoute-query.md

@@ -2,3 +2,4 @@
 category: minorAnalysis
 ---
 * The query parameter of Vue Router's `useRoute()` Composition API is now recognized as a client-side remote flow source.
+* Added flow models for Vue's `ref`, `shallowRef`, `toRef`, `reactive`, and `computed` Composition API helpers.

javascript/ql/lib/ext/vue.model.yml

@@ -35,6 +35,43 @@ module Vue {
     result = any(GlobalVueEntryPoint e).getANode()
   }
 
+  /** Models data flow through Vue Composition API helpers. */
+  overlay[local?]
+  private class VueCompositionApiSummary extends DataFlow::SummarizedCallable::Range {
+    string name;
+
+    VueCompositionApiSummary() {
+      name = ["ref", "shallowRef", "toRef", "reactive", "computed"] and
+      this = "vue." + name
+    }
+
+    override predicate propagatesFlow(string input, string output, boolean preservesValue) {
+      name = ["ref", "shallowRef"] and
+      input = "Argument[0]" and
+      output = "ReturnValue.Member[value]" and
+      preservesValue = true
+      or
+      name = "toRef" and
+      input = "Argument[0]" and
+      output = "ReturnValue.Member[value]" and
+      preservesValue = false
+      or
+      name = "reactive" and
+      input = "Argument[0]" and
+      output = "ReturnValue" and
+      preservesValue = false
+      or
+      name = "computed" and
+      input = "Argument[0].ReturnValue" and
+      output = "ReturnValue.Member[value]" and
+      preservesValue = true
+    }
+
+    override DataFlow::InvokeNode getACall() {
+      result = API::moduleImport("vue").getMember(name).getACall()
+    }
+  }
+
   /**
    * Gets a reference to the 'Vue' object.
    */

javascript/ql/lib/semmle/javascript/frameworks/Vue.qll

@@ -248,3 +248,13 @@ threatModelSource
 | single-file-component-6.vue:5:11:5:15 | input | view-component-input |
 | single-file-component-7.vue:5:11:5:15 | input | view-component-input |
 | single-file-component-8.vue:5:11:5:15 | input | view-component-input |
+compositionApiDataFlow
+| tst.js:119:14:119:26 | source("ref") | tst.js:119:6:119:33 | Vue.ref ... ).value |
+| tst.js:120:21:120:40 | source("shallowRef") | tst.js:120:6:120:47 | Vue.sha ... ).value |
+| tst.js:123:25:123:42 | source("computed") | tst.js:123:6:123:49 | Vue.com ... ).value |
+compositionApiTaintFlow
+| tst.js:119:14:119:26 | source("ref") | tst.js:119:6:119:33 | Vue.ref ... ).value |
+| tst.js:120:21:120:40 | source("shallowRef") | tst.js:120:6:120:47 | Vue.sha ... ).value |
+| tst.js:121:16:121:30 | source("toRef") | tst.js:121:6:121:37 | Vue.toR ... ).value |
+| tst.js:122:19:122:36 | source("reactive") | tst.js:122:6:122:37 | Vue.rea ... tive")) |
+| tst.js:123:25:123:42 | source("computed") | tst.js:123:6:123:49 | Vue.com ... ).value |

javascript/ql/test/library-tests/frameworks/Vue/tests.expected

@@ -1,6 +1,24 @@
 import javascript
 import semmle.javascript.security.dataflow.DomBasedXssCustomizations
 
+module TestConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source.(DataFlow::CallNode).getCalleeName() = "source"
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    sink = any(DataFlow::CallNode call | call.getCalleeName() = "sink").getAnArgument()
+  }
+}
+
+module TestDataFlow = DataFlow::Global<TestConfig>;
+
+module TestTaintFlow = TaintTracking::Global<TestConfig>;
+
+query predicate compositionApiDataFlow = TestDataFlow::flow/2;
+
+query predicate compositionApiTaintFlow = TestTaintFlow::flow/2;
+
 query predicate component_getAPropertyValue(Vue::Component c, string name, DataFlow::Node prop) {
   c.getAPropertyValue(name) = prop
 }

javascript/ql/test/library-tests/frameworks/Vue/tests.ql

@@ -115,3 +115,9 @@ let subclass2 = base.extend({
 		fromSubclass2: 100
 	}
 });
+
+sink(Vue.ref(source("ref")).value);
+sink(Vue.shallowRef(source("shallowRef")).value);
+sink(Vue.toRef(source("toRef")).value);
+sink(Vue.reactive(source("reactive")));
+sink(Vue.computed(() => source("computed")).value);