diff --git a/go/ql/test/TestUtilities/PrettyPrintModels.ql b/go/ql/test/TestUtilities/PrettyPrintModels.ql new file mode 100644 index 00000000000..f303f6abaaa --- /dev/null +++ b/go/ql/test/TestUtilities/PrettyPrintModels.ql @@ -0,0 +1,18 @@ +/** + * @kind test-postprocess + */ + +import codeql.dataflow.test.ProvenancePathGraph +import semmle.go.dataflow.ExternalFlow + +external predicate queryResults(string relation, int row, int column, string data); + +external predicate queryRelations(string relation); + +query predicate resultRelations(string relation) { queryRelations(relation) } + +module Res = TranslateProvenanceResults; + +from string relation, int row, int column, string data +where Res::results(relation, row, column, data) +select relation, row, column, data diff --git a/go/ql/test/query-tests/Security/CWE-022/TaintedPath.ql b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.ql deleted file mode 100644 index fb09146d5b1..00000000000 --- a/go/ql/test/query-tests/Security/CWE-022/TaintedPath.ql +++ /dev/null @@ -1,14 +0,0 @@ -/** - * @kind path-problem - */ - -import go -import semmle.go.security.TaintedPath -import codeql.dataflow.test.ProvenancePathGraph -import semmle.go.dataflow.ExternalFlow -import ShowProvenance - -from TaintedPath::Flow::PathNode source, TaintedPath::Flow::PathNode sink -where TaintedPath::Flow::flowPath(source, sink) -select sink.getNode(), source, sink, "This path depends on a $@.", source.getNode(), - "user-provided value" diff --git a/go/ql/test/query-tests/Security/CWE-022/TaintedPath.qlref b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.qlref new file mode 100644 index 00000000000..a9087948972 --- /dev/null +++ b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.qlref @@ -0,0 +1,2 @@ +query: Security/CWE-022/TaintedPath.ql +postprocess: TestUtilities/PrettyPrintModels.ql diff --git a/go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.qlref b/go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.qlref index d25a3dc696b..01c3e4f968a 100644 --- a/go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.qlref +++ b/go/ql/test/query-tests/Security/CWE-022/UnsafeUnzipSymlink.qlref @@ -1 +1,2 @@ -Security/CWE-022/UnsafeUnzipSymlink.ql +query: Security/CWE-022/UnsafeUnzipSymlink.ql +postprocess: TestUtilities/PrettyPrintModels.ql diff --git a/go/ql/test/query-tests/Security/CWE-022/ZipSlip.expected b/go/ql/test/query-tests/Security/CWE-022/ZipSlip.expected index 8ecda9edce7..bfcba5f4535 100644 --- a/go/ql/test/query-tests/Security/CWE-022/ZipSlip.expected +++ b/go/ql/test/query-tests/Security/CWE-022/ZipSlip.expected @@ -1,3 +1,8 @@ +#select +| UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | Unsanitized archive entry, which may contain '..', is used in a $@. | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | file system operation | +| ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:14:20:14:20 | p | Unsanitized archive entry, which may contain '..', is used in a $@. | ZipSlip.go:14:20:14:20 | p | file system operation | +| tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:16:14:16:34 | call to Dir | Unsanitized archive entry, which may contain '..', is used in a $@. | tarslip.go:16:14:16:34 | call to Dir | file system operation | +| tst.go:23:2:43:2 | range statement[1] | tst.go:23:2:43:2 | range statement[1] | tst.go:29:20:29:23 | path | Unsanitized archive entry, which may contain '..', is used in a $@. | tst.go:29:20:29:23 | path | file system operation | edges | UnsafeUnzipSymlinkGood.go:52:24:52:32 | definition of candidate | UnsafeUnzipSymlinkGood.go:61:53:61:61 | candidate | provenance | | | UnsafeUnzipSymlinkGood.go:61:53:61:61 | candidate | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | provenance | FunctionModel | @@ -7,10 +12,13 @@ edges | UnsafeUnzipSymlinkGood.go:76:70:76:80 | selection of Name | UnsafeUnzipSymlinkGood.go:52:24:52:32 | definition of candidate | provenance | | | ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:12:24:12:29 | selection of Name | provenance | | | ZipSlip.go:12:3:12:30 | ... := ...[0] | ZipSlip.go:14:20:14:20 | p | provenance | | -| ZipSlip.go:12:24:12:29 | selection of Name | ZipSlip.go:12:3:12:30 | ... := ...[0] | provenance | MaD:877 | +| ZipSlip.go:12:24:12:29 | selection of Name | ZipSlip.go:12:3:12:30 | ... := ...[0] | provenance | MaD:1 | | tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:16:23:16:33 | selection of Name | provenance | | -| tarslip.go:16:23:16:33 | selection of Name | tarslip.go:16:14:16:34 | call to Dir | provenance | MaD:892 | +| tarslip.go:16:23:16:33 | selection of Name | tarslip.go:16:14:16:34 | call to Dir | provenance | MaD:2 | | tst.go:23:2:43:2 | range statement[1] | tst.go:29:20:29:23 | path | provenance | | +models +| 1 | Summary: path/filepath; ; false; Abs; ; ; Argument[0]; ReturnValue[0]; taint; manual | +| 2 | Summary: path; ; false; Dir; ; ; Argument[0]; ReturnValue; taint; manual | nodes | UnsafeUnzipSymlinkGood.go:52:24:52:32 | definition of candidate | semmle.label | definition of candidate | | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | semmle.label | call to Join | @@ -28,8 +36,3 @@ nodes | tst.go:23:2:43:2 | range statement[1] | semmle.label | range statement[1] | | tst.go:29:20:29:23 | path | semmle.label | path | subpaths -#select -| UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | Unsanitized archive entry, which may contain '..', is used in a $@. | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | file system operation | -| ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:14:20:14:20 | p | Unsanitized archive entry, which may contain '..', is used in a $@. | ZipSlip.go:14:20:14:20 | p | file system operation | -| tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:16:14:16:34 | call to Dir | Unsanitized archive entry, which may contain '..', is used in a $@. | tarslip.go:16:14:16:34 | call to Dir | file system operation | -| tst.go:23:2:43:2 | range statement[1] | tst.go:23:2:43:2 | range statement[1] | tst.go:29:20:29:23 | path | Unsanitized archive entry, which may contain '..', is used in a $@. | tst.go:29:20:29:23 | path | file system operation | diff --git a/go/ql/test/query-tests/Security/CWE-022/ZipSlip.qlref b/go/ql/test/query-tests/Security/CWE-022/ZipSlip.qlref index 0ac6382f48a..5601b5782c2 100644 --- a/go/ql/test/query-tests/Security/CWE-022/ZipSlip.qlref +++ b/go/ql/test/query-tests/Security/CWE-022/ZipSlip.qlref @@ -1 +1,2 @@ -Security/CWE-022/ZipSlip.ql +query: Security/CWE-022/ZipSlip.ql +postprocess: TestUtilities/PrettyPrintModels.ql