Merge branch 'standard-lib-pt-22' into from-331-to-337

ql/src/semmle/go/frameworks/Stdlib.qll

@@ -35,6 +35,8 @@ import semmle.go.frameworks.stdlib.PathFilepath
 import semmle.go.frameworks.stdlib.Reflect
 import semmle.go.frameworks.stdlib.Strconv
 import semmle.go.frameworks.stdlib.Strings
+import semmle.go.frameworks.stdlib.Sync
+import semmle.go.frameworks.stdlib.SyncAtomic
 import semmle.go.frameworks.stdlib.TextScanner
 import semmle.go.frameworks.stdlib.TextTabwriter
 import semmle.go.frameworks.stdlib.TextTemplate

ql/src/semmle/go/frameworks/stdlib/Sync.qll

@@ -0,0 +1,44 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `sync` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `sync` package. */
+module Sync {
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Map).Load(key interface{}) (value interface{}, ok bool)
+      this.hasQualifiedName("sync", "Map", "Load") and
+      (inp.isReceiver() and outp.isResult(0))
+      or
+      // signature: func (*Map).LoadOrStore(key interface{}, value interface{}) (actual interface{}, loaded bool)
+      this.hasQualifiedName("sync", "Map", "LoadOrStore") and
+      (
+        inp.isReceiver() and outp.isResult(0)
+        or
+        inp.isParameter(_) and
+        (outp.isReceiver() or outp.isResult(0))
+      )
+      or
+      // signature: func (*Map).Store(key interface{}, value interface{})
+      this.hasQualifiedName("sync", "Map", "Store") and
+      (inp.isParameter(_) and outp.isReceiver())
+      or
+      // signature: func (*Pool).Get() interface{}
+      this.hasQualifiedName("sync", "Pool", "Get") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (*Pool).Put(x interface{})
+      this.hasQualifiedName("sync", "Pool", "Put") and
+      (inp.isParameter(0) and outp.isReceiver())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/src/semmle/go/frameworks/stdlib/SyncAtomic.qll

@@ -0,0 +1,85 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `sync/atomic` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `sync/atomic` package. */
+module SyncAtomic {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func AddUintptr(addr *uintptr, delta uintptr) (new uintptr)
+      hasQualifiedName("sync/atomic", "AddUintptr") and
+      (
+        inp.isParameter(1) and
+        (outp.isParameter(0) or outp.isResult())
+      )
+      or
+      // signature: func CompareAndSwapPointer(addr *unsafe.Pointer, old unsafe.Pointer, new unsafe.Pointer) (swapped bool)
+      hasQualifiedName("sync/atomic", "CompareAndSwapPointer") and
+      (inp.isParameter(2) and outp.isParameter(0))
+      or
+      // signature: func CompareAndSwapUintptr(addr *uintptr, old uintptr, new uintptr) (swapped bool)
+      hasQualifiedName("sync/atomic", "CompareAndSwapUintptr") and
+      (inp.isParameter(2) and outp.isParameter(0))
+      or
+      // signature: func LoadPointer(addr *unsafe.Pointer) (val unsafe.Pointer)
+      hasQualifiedName("sync/atomic", "LoadPointer") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func LoadUintptr(addr *uintptr) (val uintptr)
+      hasQualifiedName("sync/atomic", "LoadUintptr") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      // signature: func StorePointer(addr *unsafe.Pointer, val unsafe.Pointer)
+      hasQualifiedName("sync/atomic", "StorePointer") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func StoreUintptr(addr *uintptr, val uintptr)
+      hasQualifiedName("sync/atomic", "StoreUintptr") and
+      (inp.isParameter(1) and outp.isParameter(0))
+      or
+      // signature: func SwapPointer(addr *unsafe.Pointer, new unsafe.Pointer) (old unsafe.Pointer)
+      hasQualifiedName("sync/atomic", "SwapPointer") and
+      (
+        inp.isParameter(1) and outp.isParameter(0)
+        or
+        inp.isParameter(0) and outp.isResult()
+      )
+      or
+      // signature: func SwapUintptr(addr *uintptr, new uintptr) (old uintptr)
+      hasQualifiedName("sync/atomic", "SwapUintptr") and
+      (
+        inp.isParameter(1) and outp.isParameter(0)
+        or
+        inp.isParameter(0) and outp.isResult()
+      )
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (*Value).Load() (x interface{})
+      this.hasQualifiedName("sync/atomic", "Value", "Load") and
+      (inp.isReceiver() and outp.isResult())
+      or
+      // signature: func (*Value).Store(x interface{})
+      this.hasQualifiedName("sync/atomic", "Value", "Store") and
+      (inp.isParameter(0) and outp.isReceiver())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Sync.go

@@ -0,0 +1,125 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import "sync"
+
+func TaintStepTest_SyncMapLoad_B0I0O0(sourceCQL interface{}) interface{} {
+	fromMap656 := sourceCQL.(sync.Map)
+	intoInterface414, _ := fromMap656.Load(nil)
+	return intoInterface414
+}
+
+func TaintStepTest_SyncMapLoadOrStore_B0I0O0(sourceCQL interface{}) interface{} {
+	fromMap518 := sourceCQL.(sync.Map)
+	intoInterface650, _ := fromMap518.LoadOrStore(nil, nil)
+	return intoInterface650
+}
+
+func TaintStepTest_SyncMapLoadOrStore_B1I0O0(sourceCQL interface{}) interface{} {
+	fromInterface784 := sourceCQL.(interface{})
+	var intoMap957 sync.Map
+	intoMap957.LoadOrStore(fromInterface784, nil)
+	return intoMap957
+}
+
+func TaintStepTest_SyncMapLoadOrStore_B1I0O1(sourceCQL interface{}) interface{} {
+	fromInterface520 := sourceCQL.(interface{})
+	var mediumObjCQL sync.Map
+	intoInterface443, _ := mediumObjCQL.LoadOrStore(fromInterface520, nil)
+	return intoInterface443
+}
+
+func TaintStepTest_SyncMapLoadOrStore_B1I1O0(sourceCQL interface{}) interface{} {
+	fromInterface127 := sourceCQL.(interface{})
+	var intoMap483 sync.Map
+	intoMap483.LoadOrStore(nil, fromInterface127)
+	return intoMap483
+}
+
+func TaintStepTest_SyncMapLoadOrStore_B1I1O1(sourceCQL interface{}) interface{} {
+	fromInterface989 := sourceCQL.(interface{})
+	var mediumObjCQL sync.Map
+	intoInterface982, _ := mediumObjCQL.LoadOrStore(nil, fromInterface989)
+	return intoInterface982
+}
+
+func TaintStepTest_SyncMapStore_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface417 := sourceCQL.(interface{})
+	var intoMap584 sync.Map
+	intoMap584.Store(fromInterface417, nil)
+	return intoMap584
+}
+
+func TaintStepTest_SyncMapStore_B0I1O0(sourceCQL interface{}) interface{} {
+	fromInterface991 := sourceCQL.(interface{})
+	var intoMap881 sync.Map
+	intoMap881.Store(nil, fromInterface991)
+	return intoMap881
+}
+
+func TaintStepTest_SyncPoolGet_B0I0O0(sourceCQL interface{}) interface{} {
+	fromPool186 := sourceCQL.(sync.Pool)
+	intoInterface284 := fromPool186.Get()
+	return intoInterface284
+}
+
+func TaintStepTest_SyncPoolPut_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface908 := sourceCQL.(interface{})
+	var intoPool137 sync.Pool
+	intoPool137.Put(fromInterface908)
+	return intoPool137
+}
+
+func RunAllTaints_Sync() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_SyncMapLoad_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_SyncMapLoadOrStore_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_SyncMapLoadOrStore_B1I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_SyncMapLoadOrStore_B1I0O1(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_SyncMapLoadOrStore_B1I1O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_SyncMapLoadOrStore_B1I1O1(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_SyncMapStore_B0I0O0(source)
+		sink(6, out)
+	}
+	{
+		source := newSource(7)
+		out := TaintStepTest_SyncMapStore_B0I1O0(source)
+		sink(7, out)
+	}
+	{
+		source := newSource(8)
+		out := TaintStepTest_SyncPoolGet_B0I0O0(source)
+		sink(8, out)
+	}
+	{
+		source := newSource(9)
+		out := TaintStepTest_SyncPoolPut_B0I0O0(source)
+		sink(9, out)
+	}
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/SyncAtomic.go

@@ -0,0 +1,173 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"sync/atomic"
+	"unsafe"
+)
+
+func TaintStepTest_SyncAtomicAddUintptr_B0I0O0(sourceCQL interface{}) interface{} {
+	fromUintptr656 := sourceCQL.(uintptr)
+	var intoUintptr414 *uintptr
+	atomic.AddUintptr(intoUintptr414, fromUintptr656)
+	return intoUintptr414
+}
+
+func TaintStepTest_SyncAtomicAddUintptr_B0I0O1(sourceCQL interface{}) interface{} {
+	fromUintptr518 := sourceCQL.(uintptr)
+	intoUintptr650 := atomic.AddUintptr(nil, fromUintptr518)
+	return intoUintptr650
+}
+
+func TaintStepTest_SyncAtomicCompareAndSwapPointer_B0I0O0(sourceCQL interface{}) interface{} {
+	fromPointer784 := sourceCQL.(unsafe.Pointer)
+	var intoPointer957 *unsafe.Pointer
+	atomic.CompareAndSwapPointer(intoPointer957, nil, fromPointer784)
+	return intoPointer957
+}
+
+func TaintStepTest_SyncAtomicCompareAndSwapUintptr_B0I0O0(sourceCQL interface{}) interface{} {
+	fromUintptr520 := sourceCQL.(uintptr)
+	var intoUintptr443 *uintptr
+	atomic.CompareAndSwapUintptr(intoUintptr443, 0, fromUintptr520)
+	return intoUintptr443
+}
+
+func TaintStepTest_SyncAtomicLoadPointer_B0I0O0(sourceCQL interface{}) interface{} {
+	fromPointer127 := sourceCQL.(*unsafe.Pointer)
+	intoPointer483 := atomic.LoadPointer(fromPointer127)
+	return intoPointer483
+}
+
+func TaintStepTest_SyncAtomicLoadUintptr_B0I0O0(sourceCQL interface{}) interface{} {
+	fromUintptr989 := sourceCQL.(*uintptr)
+	intoUintptr982 := atomic.LoadUintptr(fromUintptr989)
+	return intoUintptr982
+}
+
+func TaintStepTest_SyncAtomicStorePointer_B0I0O0(sourceCQL interface{}) interface{} {
+	fromPointer417 := sourceCQL.(unsafe.Pointer)
+	var intoPointer584 *unsafe.Pointer
+	atomic.StorePointer(intoPointer584, fromPointer417)
+	return intoPointer584
+}
+
+func TaintStepTest_SyncAtomicStoreUintptr_B0I0O0(sourceCQL interface{}) interface{} {
+	fromUintptr991 := sourceCQL.(uintptr)
+	var intoUintptr881 *uintptr
+	atomic.StoreUintptr(intoUintptr881, fromUintptr991)
+	return intoUintptr881
+}
+
+func TaintStepTest_SyncAtomicSwapPointer_B0I0O0(sourceCQL interface{}) interface{} {
+	fromPointer186 := sourceCQL.(unsafe.Pointer)
+	var intoPointer284 *unsafe.Pointer
+	atomic.SwapPointer(intoPointer284, fromPointer186)
+	return intoPointer284
+}
+
+func TaintStepTest_SyncAtomicSwapPointer_B1I0O0(sourceCQL interface{}) interface{} {
+	fromPointer908 := sourceCQL.(*unsafe.Pointer)
+	intoPointer137 := atomic.SwapPointer(fromPointer908, nil)
+	return intoPointer137
+}
+
+func TaintStepTest_SyncAtomicSwapUintptr_B0I0O0(sourceCQL interface{}) interface{} {
+	fromUintptr494 := sourceCQL.(uintptr)
+	var intoUintptr873 *uintptr
+	atomic.SwapUintptr(intoUintptr873, fromUintptr494)
+	return intoUintptr873
+}
+
+func TaintStepTest_SyncAtomicSwapUintptr_B1I0O0(sourceCQL interface{}) interface{} {
+	fromUintptr599 := sourceCQL.(*uintptr)
+	intoUintptr409 := atomic.SwapUintptr(fromUintptr599, 0)
+	return intoUintptr409
+}
+
+func TaintStepTest_SyncAtomicValueLoad_B0I0O0(sourceCQL interface{}) interface{} {
+	fromValue246 := sourceCQL.(atomic.Value)
+	intoInterface898 := fromValue246.Load()
+	return intoInterface898
+}
+
+func TaintStepTest_SyncAtomicValueStore_B0I0O0(sourceCQL interface{}) interface{} {
+	fromInterface598 := sourceCQL.(interface{})
+	var intoValue631 atomic.Value
+	intoValue631.Store(fromInterface598)
+	return intoValue631
+}
+
+func RunAllTaints_SyncAtomic() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_SyncAtomicAddUintptr_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_SyncAtomicAddUintptr_B0I0O1(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_SyncAtomicCompareAndSwapPointer_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_SyncAtomicCompareAndSwapUintptr_B0I0O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_SyncAtomicLoadPointer_B0I0O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_SyncAtomicLoadUintptr_B0I0O0(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_SyncAtomicStorePointer_B0I0O0(source)
+		sink(6, out)
+	}
+	{
+		source := newSource(7)
+		out := TaintStepTest_SyncAtomicStoreUintptr_B0I0O0(source)
+		sink(7, out)
+	}
+	{
+		source := newSource(8)
+		out := TaintStepTest_SyncAtomicSwapPointer_B0I0O0(source)
+		sink(8, out)
+	}
+	{
+		source := newSource(9)
+		out := TaintStepTest_SyncAtomicSwapPointer_B1I0O0(source)
+		sink(9, out)
+	}
+	{
+		source := newSource(10)
+		out := TaintStepTest_SyncAtomicSwapUintptr_B0I0O0(source)
+		sink(10, out)
+	}
+	{
+		source := newSource(11)
+		out := TaintStepTest_SyncAtomicSwapUintptr_B1I0O0(source)
+		sink(11, out)
+	}
+	{
+		source := newSource(12)
+		out := TaintStepTest_SyncAtomicValueLoad_B0I0O0(source)
+		sink(12, out)
+	}
+	{
+		source := newSource(13)
+		out := TaintStepTest_SyncAtomicValueStore_B0I0O0(source)
+		sink(13, out)
+	}
+}