mirror of
https://github.com/github/codeql.git
synced 2026-05-02 12:15:17 +02:00
beautify names
This commit is contained in:
@@ -9,13 +9,13 @@
|
||||
*/
|
||||
|
||||
import go
|
||||
import SSRF.SSRF
|
||||
import SSRF
|
||||
import DataFlow::PathGraph
|
||||
|
||||
from
|
||||
SSRF::Configuration cfg, DataFlow::PathNode source,
|
||||
ServerSideRequestForgery::Configuration cfg, DataFlow::PathNode source,
|
||||
DataFlow::PathNode sink, DataFlow::Node request
|
||||
where
|
||||
cfg.hasFlowPath(source, sink) and
|
||||
request = sink.getNode().(SSRF::Sink).getARequest()
|
||||
request = sink.getNode().(ServerSideRequestForgery::Sink).getARequest()
|
||||
select request, source, sink, "The URL of this request depends on a user-provided value"
|
||||
|
||||
@@ -9,9 +9,9 @@ import go
|
||||
* Provides a taint-tracking configuration for reasoning about request forgery
|
||||
* (SSRF) vulnerabilities.
|
||||
*/
|
||||
module SSRF {
|
||||
module ServerSideRequestForgery {
|
||||
import semmle.go.frameworks.Gin
|
||||
import SSRF.validator
|
||||
import validator
|
||||
import semmle.go.security.UrlConcatenation
|
||||
import semmle.go.dataflow.barrierguardutil.RegexpCheck
|
||||
import semmle.go.dataflow.Properties
|
||||
|
||||
@@ -5,7 +5,7 @@ import (
|
||||
"github.com/go-playground/validator"
|
||||
)
|
||||
|
||||
func handler(w http.ResponseWriter, req *http.Request) {
|
||||
func goodHandler(w http.ResponseWriter, req *http.Request) {
|
||||
validate := validator.New()
|
||||
target := req.FormValue("target")
|
||||
if validate.Var(target, "alphanum")
|
||||
|
||||
@@ -1 +1 @@
|
||||
SSRF/SSRF.ql
|
||||
CWE-918/SSRF.ql
|
||||
|
||||
Reference in New Issue
Block a user