codeql/javascript/ql/src/experimental/semmle/javascript/frameworks/GoogleGenAI.qll at 0b7133c4ce28c1dd46eca96b9fcc0bdc93165469 · BazookaMusic/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
/**
 * Provides classes modeling security-relevant aspects of the `@google/genai` package.
 * See https://github.com/googleapis/js-genai
 */

private import javascript

module GoogleGenAI {
  /** Gets a reference to the `GoogleGenAI` client instance. */
  API::Node clientRef() {
    // import { GoogleGenAI } from '@google/genai'; const ai = new GoogleGenAI(...)
    result =
      API::moduleImport("@google/genai").getMember("GoogleGenAI").getInstance()
  }

  /** Gets a reference to a sink for prompt content in the Google GenAI SDK. */
  API::Node getContentNode() {
    exists(API::Node params |
      // ai.models.generateContent({ contents, config })
      // ai.models.generateContentStream({ contents, config })
      params =
        clientRef()
            .getMember("models")
            .getMember(["generateContent", "generateContentStream"])
            .getParameter(0)
    |
      // config.systemInstruction
      result = params.getMember("config").getMember("systemInstruction")
      or
      // contents: [{ role: "model", parts: [{ text: "..." }] }]
      // Gemini uses "model" role instead of "assistant"
      exists(API::Node msg |
        msg = params.getMember("contents").getArrayElement() and
        msg.getMember("role").asSink().mayHaveStringValue("model")
      |
        result = msg.getMember("parts").getArrayElement().getMember("text")
      )
    )
    or
    // ai.models.generateImages({ prompt, config })
    result =
      clientRef()
          .getMember("models")
          .getMember("generateImages")
          .getParameter(0)
          .getMember("prompt")
    or
    // ai.models.editImage({ prompt, referenceImages, config })
    result =
      clientRef()
          .getMember("models")
          .getMember("editImage")
          .getParameter(0)
          .getMember("prompt")
    or
    // ai.chats.create({ config: { systemInstruction: ... } })
    result =
      clientRef()
          .getMember("chats")
          .getMember("create")
          .getParameter(0)
          .getMember("config")
          .getMember("systemInstruction")
    or
    // chat.sendMessage({ config: { systemInstruction: ... } })
    result =
      clientRef()
          .getMember("chats")
          .getMember("create")
          .getReturn()
          .getMember("sendMessage")
          .getParameter(0)
          .getMember("config")
          .getMember("systemInstruction")
    or
    // ai.live.connect({ config: { systemInstruction: ... } })
    result =
      clientRef()
          .getMember("live")
          .getMember("connect")
          .getParameter(0)
          .getMember("config")
          .getMember("systemInstruction")
  }
}