Skip to content

Commit 12fe998

Browse files
authored
Merge pull request #16986 from owen-mc/go/mad-sources-revel-nethttp
Go: Convert Revel and net/http sources to MaD
2 parents 39f0288 + fc6b17a commit 12fe998

File tree

44 files changed

+325
-349
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+325
-349
lines changed
Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,46 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: packageGrouping
5+
data:
6+
- ["revel", "github.com/revel/revel"]
7+
- ["revel", "github.com/robfig/revel"]
8+
- addsTo:
9+
pack: codeql/go-all
10+
extensible: sourceModel
11+
data:
12+
- ["group:revel", "Controller", True, "Params", "", "", "", "remote", "manual"]
13+
- ["group:revel", "Request", True, "Header", "", "", "", "remote", "manual"]
14+
- ["group:revel", "Request", True, "ContentType", "", "", "", "remote", "manual"]
15+
- ["group:revel", "Request", True, "AcceptLanguages", "", "", "", "remote", "manual"]
16+
- ["group:revel", "Request", True, "Locale", "", "", "", "remote", "manual"]
17+
- ["group:revel", "Request", True, "URL", "", "", "", "remote", "manual"]
18+
- ["group:revel", "Request", True, "Form", "", "", "", "remote", "manual"]
19+
- ["group:revel", "Request", True, "MultipartForm", "", "", "", "remote", "manual"]
20+
- ["group:revel", "RouteMatch", True, "Params", "", "", "", "remote", "manual"]
21+
- ["group:revel", "Request", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
22+
- ["group:revel", "Request", True, "FormValue", "", "", "ReturnValue", "remote", "manual"]
23+
- ["group:revel", "Request", True, "GetBody", "", "", "ReturnValue", "remote", "manual"]
24+
- ["group:revel", "Request", True, "GetForm", "", "", "ReturnValue[0]", "remote", "manual"]
25+
- ["group:revel", "Request", True, "GetHttpHeader", "", "", "ReturnValue", "remote", "manual"]
26+
- ["group:revel", "Request", True, "GetMultipartForm", "", "", "ReturnValue[0]", "remote", "manual"]
27+
- ["group:revel", "Request", True, "GetQuery", "", "", "ReturnValue", "remote", "manual"]
28+
- ["group:revel", "Request", True, "GetRequestURI", "", "", "ReturnValue", "remote", "manual"]
29+
- ["group:revel", "Request", True, "MultipartReader", "", "", "ReturnValue[0]", "remote", "manual"]
30+
- ["group:revel", "Request", True, "PostFormValue", "", "", "ReturnValue", "remote", "manual"]
31+
- ["group:revel", "Request", True, "Referer", "", "", "ReturnValue", "remote", "manual"]
32+
- ["group:revel", "Request", True, "UserAgent", "", "", "ReturnValue", "remote", "manual"]
233
- addsTo:
334
pack: codeql/go-all
435
extensible: summaryModel
536
data:
6-
- ["github.com/revel/revel", "Params", True, "Bind", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
7-
- ["github.com/revel/revel", "Params", True, "BindJSON", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
8-
- ["github.com/revel/revel", "RevelHeader", True, "Add", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
9-
- ["github.com/revel/revel", "RevelHeader", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
10-
- ["github.com/revel/revel", "RevelHeader", True, "GetAll", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
11-
- ["github.com/revel/revel", "RevelHeader", True, "Set", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
12-
- ["github.com/revel/revel", "RevelHeader", True, "SetCookie", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
13-
- ["github.com/revel/revel", "ServerCookie", True, "GetValue", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
14-
- ["github.com/revel/revel", "ServerMultipartForm", True, "GetFiles", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
15-
- ["github.com/revel/revel", "ServerMultipartForm", True, "GetValues", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
16-
- ["github.com/robfig/revel", "Params", True, "Bind", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
17-
- ["github.com/robfig/revel", "Params", True, "BindJSON", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
18-
- ["github.com/robfig/revel", "RevelHeader", True, "Add", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
19-
- ["github.com/robfig/revel", "RevelHeader", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
20-
- ["github.com/robfig/revel", "RevelHeader", True, "GetAll", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
21-
- ["github.com/robfig/revel", "RevelHeader", True, "Set", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
22-
- ["github.com/robfig/revel", "RevelHeader", True, "SetCookie", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
23-
- ["github.com/robfig/revel", "ServerCookie", True, "GetValue", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
24-
- ["github.com/robfig/revel", "ServerMultipartForm", True, "GetFiles", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
25-
- ["github.com/robfig/revel", "ServerMultipartForm", True, "GetValues", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
37+
- ["group:revel", "Params", True, "Bind", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
38+
- ["group:revel", "Params", True, "BindJSON", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
39+
- ["group:revel", "RevelHeader", True, "Add", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
40+
- ["group:revel", "RevelHeader", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
41+
- ["group:revel", "RevelHeader", True, "GetAll", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
42+
- ["group:revel", "RevelHeader", True, "Set", "", "", "Argument[0..1]", "Argument[receiver]", "taint", "manual"]
43+
- ["group:revel", "RevelHeader", True, "SetCookie", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
44+
- ["group:revel", "ServerCookie", True, "GetValue", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
45+
- ["group:revel", "ServerMultipartForm", True, "GetFiles", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
46+
- ["group:revel", "ServerMultipartForm", True, "GetValues", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]

go/ql/lib/ext/net.http.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,11 @@ extensions:
3737
- ["net/http", "Request", True, "PostFormValue", "", "", "ReturnValue", "remote", "manual"]
3838
- ["net/http", "Request", True, "Referer", "", "", "ReturnValue", "remote", "manual"]
3939
- ["net/http", "Request", True, "UserAgent", "", "", "ReturnValue", "remote", "manual"]
40+
- ["net/http", "Request", True, "Body", "", "", "", "remote", "manual"]
41+
- ["net/http", "Request", True, "GetBody", "", "", "", "remote", "manual"]
42+
- ["net/http", "Request", True, "Form", "", "", "", "remote", "manual"]
43+
- ["net/http", "Request", True, "PostForm", "", "", "", "remote", "manual"]
44+
- ["net/http", "Request", True, "MultipartForm", "", "", "", "remote", "manual"]
45+
- ["net/http", "Request", True, "Header", "", "", "", "remote", "manual"]
46+
- ["net/http", "Request", True, "Trailer", "", "", "", "remote", "manual"]
47+
- ["net/http", "Request", True, "URL", "", "", "", "remote", "manual"]

go/ql/lib/semmle/go/frameworks/Revel.qll

Lines changed: 0 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,6 @@ module Revel {
1212
result = package(["github.com/revel", "github.com/robfig"] + "/revel", "")
1313
}
1414

15-
private class ControllerParams extends RemoteFlowSource::Range, DataFlow::FieldReadNode {
16-
ControllerParams() {
17-
exists(Field f |
18-
this.readsField(_, f) and
19-
f.hasQualifiedName(packagePath(), "Controller", "Params")
20-
)
21-
}
22-
}
23-
2415
private class ParamsFixedSanitizer extends TaintTracking::DefaultTaintSanitizer,
2516
DataFlow::FieldReadNode
2617
{
@@ -32,41 +23,6 @@ module Revel {
3223
}
3324
}
3425

35-
private class RouteMatchParams extends RemoteFlowSource::Range, DataFlow::FieldReadNode {
36-
RouteMatchParams() {
37-
exists(Field f |
38-
this.readsField(_, f) and
39-
f.hasQualifiedName(packagePath(), "RouteMatch", "Params")
40-
)
41-
}
42-
}
43-
44-
/** An access to an HTTP request field whose value may be controlled by an untrusted user. */
45-
private class UserControlledRequestField extends RemoteFlowSource::Range, DataFlow::FieldReadNode {
46-
UserControlledRequestField() {
47-
exists(string fieldName |
48-
this.getField().hasQualifiedName(packagePath(), "Request", fieldName)
49-
|
50-
fieldName in [
51-
"Header", "ContentType", "AcceptLanguages", "Locale", "URL", "Form", "MultipartForm"
52-
]
53-
)
54-
}
55-
}
56-
57-
private class UserControlledRequestMethod extends RemoteFlowSource::Range,
58-
DataFlow::MethodCallNode
59-
{
60-
UserControlledRequestMethod() {
61-
this.getTarget()
62-
.hasQualifiedName(packagePath(), "Request",
63-
[
64-
"FormValue", "PostFormValue", "GetQuery", "GetForm", "GetMultipartForm", "GetBody",
65-
"Cookie", "GetHttpHeader", "GetRequestURI", "MultipartReader", "Referer", "UserAgent"
66-
])
67-
}
68-
}
69-
7026
private string contentTypeFromFilename(DataFlow::Node filename) {
7127
if filename.getStringValue().regexpMatch("(?i).*\\.html?")
7228
then result = "text/html"

go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,6 @@ private import semmle.go.dataflow.internal.FlowSummaryImpl::Private
88

99
/** Provides models of commonly used functions in the `net/http` package. */
1010
module NetHttp {
11-
/** An access to an HTTP request field whose value may be controlled by an untrusted user. */
12-
private class UserControlledRequestField extends RemoteFlowSource::Range, DataFlow::FieldReadNode {
13-
UserControlledRequestField() {
14-
exists(string fieldName | this.getField().hasQualifiedName("net/http", "Request", fieldName) |
15-
fieldName =
16-
["Body", "GetBody", "Form", "PostForm", "MultipartForm", "Header", "Trailer", "URL"]
17-
)
18-
}
19-
}
20-
2111
/** The declaration of a variable which either is or has a field that implements the http.ResponseWriter type */
2212
private class StdlibResponseWriter extends Http::ResponseWriter::Range {
2313
SsaWithFields v;

go/ql/test/experimental/CWE-090/LDAPInjection.expected

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
edges
2-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:59:3:59:11 | untrusted | provenance | Src:MaD:757 |
3-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:61:3:61:51 | ...+... | provenance | Src:MaD:757 |
4-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:3:62:33 | slice literal | provenance | Src:MaD:757 |
5-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:24:62:32 | untrusted | provenance | Src:MaD:757 |
6-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:66:3:66:11 | untrusted | provenance | Src:MaD:757 |
7-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:68:3:68:51 | ...+... | provenance | Src:MaD:757 |
8-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:3:69:33 | slice literal | provenance | Src:MaD:757 |
9-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:24:69:32 | untrusted | provenance | Src:MaD:757 |
10-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:73:3:73:11 | untrusted | provenance | Src:MaD:757 |
11-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:75:3:75:51 | ...+... | provenance | Src:MaD:757 |
12-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:3:76:33 | slice literal | provenance | Src:MaD:757 |
13-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:24:76:32 | untrusted | provenance | Src:MaD:757 |
14-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:80:22:80:30 | untrusted | provenance | Src:MaD:757 |
15-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:81:25:81:33 | untrusted | provenance | Src:MaD:757 |
2+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:59:3:59:11 | untrusted | provenance | Src:MaD:770 |
3+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:61:3:61:51 | ...+... | provenance | Src:MaD:770 |
4+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:3:62:33 | slice literal | provenance | Src:MaD:770 |
5+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:24:62:32 | untrusted | provenance | Src:MaD:770 |
6+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:66:3:66:11 | untrusted | provenance | Src:MaD:770 |
7+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:68:3:68:51 | ...+... | provenance | Src:MaD:770 |
8+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:3:69:33 | slice literal | provenance | Src:MaD:770 |
9+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:24:69:32 | untrusted | provenance | Src:MaD:770 |
10+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:73:3:73:11 | untrusted | provenance | Src:MaD:770 |
11+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:75:3:75:51 | ...+... | provenance | Src:MaD:770 |
12+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:3:76:33 | slice literal | provenance | Src:MaD:770 |
13+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:24:76:32 | untrusted | provenance | Src:MaD:770 |
14+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:80:22:80:30 | untrusted | provenance | Src:MaD:770 |
15+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:81:25:81:33 | untrusted | provenance | Src:MaD:770 |
1616
| LDAPInjection.go:62:3:62:33 | slice literal [array] | LDAPInjection.go:62:3:62:33 | slice literal | provenance | |
1717
| LDAPInjection.go:62:24:62:32 | untrusted | LDAPInjection.go:62:3:62:33 | slice literal [array] | provenance | |
1818
| LDAPInjection.go:69:3:69:33 | slice literal [array] | LDAPInjection.go:69:3:69:33 | slice literal | provenance | |

go/ql/test/experimental/CWE-203/Timing.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
edges
2-
| timing.go:15:18:15:27 | selection of Header | timing.go:15:18:15:45 | call to Get | provenance | MaD:738 |
2+
| timing.go:15:18:15:27 | selection of Header | timing.go:15:18:15:45 | call to Get | provenance | Src:MaD:776 MaD:751 |
33
| timing.go:15:18:15:45 | call to Get | timing.go:17:31:17:42 | headerSecret | provenance | |
4-
| timing.go:28:18:28:27 | selection of Header | timing.go:28:18:28:45 | call to Get | provenance | MaD:738 |
4+
| timing.go:28:18:28:27 | selection of Header | timing.go:28:18:28:45 | call to Get | provenance | Src:MaD:776 MaD:751 |
55
| timing.go:28:18:28:45 | call to Get | timing.go:30:47:30:58 | headerSecret | provenance | |
6-
| timing.go:41:18:41:27 | selection of Header | timing.go:41:18:41:45 | call to Get | provenance | MaD:738 |
6+
| timing.go:41:18:41:27 | selection of Header | timing.go:41:18:41:45 | call to Get | provenance | Src:MaD:776 MaD:751 |
77
| timing.go:41:18:41:45 | call to Get | timing.go:42:25:42:36 | headerSecret | provenance | |
88
nodes
99
| timing.go:15:18:15:27 | selection of Header | semmle.label | selection of Header |

go/ql/test/experimental/CWE-287/ImproperLdapAuth.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
edges
2-
| ImproperLdapAuth.go:18:18:18:24 | selection of URL | ImproperLdapAuth.go:18:18:18:32 | call to Query | provenance | MaD:818 |
2+
| ImproperLdapAuth.go:18:18:18:24 | selection of URL | ImproperLdapAuth.go:18:18:18:32 | call to Query | provenance | Src:MaD:778 MaD:839 |
33
| ImproperLdapAuth.go:18:18:18:32 | call to Query | ImproperLdapAuth.go:28:23:28:34 | bindPassword | provenance | |
44
| ImproperLdapAuth.go:87:18:87:19 | "" | ImproperLdapAuth.go:97:23:97:34 | bindPassword | provenance | |
55
nodes

go/ql/test/experimental/CWE-369/DivideByZero.expected

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
edges
2-
| DivideByZero.go:10:12:10:16 | selection of URL | DivideByZero.go:10:12:10:24 | call to Query | provenance | MaD:818 |
2+
| DivideByZero.go:10:12:10:16 | selection of URL | DivideByZero.go:10:12:10:24 | call to Query | provenance | Src:MaD:778 MaD:839 |
33
| DivideByZero.go:10:12:10:24 | call to Query | DivideByZero.go:11:27:11:32 | param1 | provenance | |
44
| DivideByZero.go:11:2:11:33 | ... := ...[0] | DivideByZero.go:12:16:12:20 | value | provenance | |
55
| DivideByZero.go:11:27:11:32 | param1 | DivideByZero.go:11:2:11:33 | ... := ...[0] | provenance | Config |
6-
| DivideByZero.go:17:12:17:16 | selection of URL | DivideByZero.go:17:12:17:24 | call to Query | provenance | MaD:818 |
6+
| DivideByZero.go:17:12:17:16 | selection of URL | DivideByZero.go:17:12:17:24 | call to Query | provenance | Src:MaD:778 MaD:839 |
77
| DivideByZero.go:17:12:17:24 | call to Query | DivideByZero.go:18:11:18:24 | type conversion | provenance | |
88
| DivideByZero.go:18:11:18:24 | type conversion | DivideByZero.go:19:16:19:20 | value | provenance | |
9-
| DivideByZero.go:24:12:24:16 | selection of URL | DivideByZero.go:24:12:24:24 | call to Query | provenance | MaD:818 |
9+
| DivideByZero.go:24:12:24:16 | selection of URL | DivideByZero.go:24:12:24:24 | call to Query | provenance | Src:MaD:778 MaD:839 |
1010
| DivideByZero.go:24:12:24:24 | call to Query | DivideByZero.go:25:31:25:36 | param1 | provenance | |
1111
| DivideByZero.go:25:2:25:45 | ... := ...[0] | DivideByZero.go:26:16:26:20 | value | provenance | |
1212
| DivideByZero.go:25:31:25:36 | param1 | DivideByZero.go:25:2:25:45 | ... := ...[0] | provenance | Config |
13-
| DivideByZero.go:31:12:31:16 | selection of URL | DivideByZero.go:31:12:31:24 | call to Query | provenance | MaD:818 |
13+
| DivideByZero.go:31:12:31:16 | selection of URL | DivideByZero.go:31:12:31:24 | call to Query | provenance | Src:MaD:778 MaD:839 |
1414
| DivideByZero.go:31:12:31:24 | call to Query | DivideByZero.go:32:33:32:38 | param1 | provenance | |
1515
| DivideByZero.go:32:2:32:43 | ... := ...[0] | DivideByZero.go:33:16:33:20 | value | provenance | |
1616
| DivideByZero.go:32:33:32:38 | param1 | DivideByZero.go:32:2:32:43 | ... := ...[0] | provenance | Config |
17-
| DivideByZero.go:38:12:38:16 | selection of URL | DivideByZero.go:38:12:38:24 | call to Query | provenance | MaD:818 |
17+
| DivideByZero.go:38:12:38:16 | selection of URL | DivideByZero.go:38:12:38:24 | call to Query | provenance | Src:MaD:778 MaD:839 |
1818
| DivideByZero.go:38:12:38:24 | call to Query | DivideByZero.go:39:32:39:37 | param1 | provenance | |
1919
| DivideByZero.go:39:2:39:46 | ... := ...[0] | DivideByZero.go:40:16:40:20 | value | provenance | |
2020
| DivideByZero.go:39:32:39:37 | param1 | DivideByZero.go:39:2:39:46 | ... := ...[0] | provenance | Config |
21-
| DivideByZero.go:54:12:54:16 | selection of URL | DivideByZero.go:54:12:54:24 | call to Query | provenance | MaD:818 |
21+
| DivideByZero.go:54:12:54:16 | selection of URL | DivideByZero.go:54:12:54:24 | call to Query | provenance | Src:MaD:778 MaD:839 |
2222
| DivideByZero.go:54:12:54:24 | call to Query | DivideByZero.go:55:11:55:24 | type conversion | provenance | |
2323
| DivideByZero.go:55:11:55:24 | type conversion | DivideByZero.go:57:17:57:21 | value | provenance | |
2424
nodes

0 commit comments

Comments
 (0)