DataFlow::globalVarRef(<name>) does not resolve document.defaultView (Window alias)

[Eliav2]

Description
DataFlow::globalVarRef("history") (and similar globalVarRef("window")) misses flows where the global Window object is accessed via document.defaultView. Some bundlers/runtime environments reference the window object as document.defaultView, so calls like document.defaultView.history.pushState(...) are not recognized as flowing from the global history.

Repro (minimal JS):

// Common patterns CodeQL handles:
history.pushState({}, "", "/ok");
window.history.pushState({}, "", "/ok2");

// Missed pattern:
document.defaultView.history.pushState({}, "", "/missed");

Typical QL snippet

import javascript, DataFlow

predicate isSink(DataFlow::Node sink) {
  exists(DataFlow::MethodCallNode call |
    call = DataFlow::globalVarRef("history").getAMemberCall(["pushState", "replaceState"]) and
    sink = call.getArgument(2)
  )
}

Expected
Flows where the receiver is document.defaultView.history should be treated equivalently to window.history/history, i.e., the third argument should be identified as a sink.

Actual
document.defaultView.history.pushState(...) is not matched; globalVarRef("history") does not cover the document.defaultView alias to Window.

Why this matters
Some bundlers / frameworks generate code that references the Window via document.defaultView. Analyses relying on globalVarRef currently miss those navigation calls, reducing coverage.

Suggested direction
Enhance globalVarRef (or provide an additional utility) to recognize document.defaultView as an alias of the global Window, so document.defaultView.history is resolved consistently with window.history.

[jketema]

Hi @Eliav2,

Thanks for pointing this out, we believe this should be relatively straightforward to fix.

[Eliav2]

i was able to handle it by extending DataFlow::globalVarRef like so

DataFlow::SourceNode extendedGlobalVarRef(string name) {
  // Standard cases handled by globalVarRef
  result = DataFlow::globalVarRef(name)
  or
  // Extended case: document.defaultView.name
  // document.defaultView is the window object, so document.defaultView.name is equivalent to window.name
  result = DOM::documentRef().getAPropertyRead("defaultView").getAPropertyRead(name)
}

then used it inside my queries extendedGlobalVarRef("history") instead of DataFlow::globalVarRef("history").

But I believe that the correct fix is to extend globalObjectRef predicate in javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll file.
If you want, I can open a PR on it (after reading the contribution guide).

[jketema]

If you're willing to open a PR that would be nice. Ideally that should come with a test.

What I got internally is:

We can add globalVarRef("document").getAPropertyRead("defaultView") as a case here

That seems to match what you write above.

[Eliav2]

No problem. Would open PR soon