hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 19:55:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Include changes from review

Browse Source
This commit is contained in:
Porcupiney Hairs
2023-05-12 01:59:42 +05:30
parent ec424d7e51
commit 2c518c1fa6
3 changed files with 38 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
go/ql/src/experimental/CWE-134/DsnInjectionCustomizations.qll
View File

@@ -27,7 +27,7 @@ private class DecodeFunctionModel extends TaintTracking::FunctionModel {
DecodeFunctionModel() {
// This matches any function with a name like `Decode`,`Unmarshal` or `Parse`.
// This is done to allow taints stored in encoded forms, such as in toml or json to flow freely.
this.getName().matches("(?i).*(parse|decode|unmarshal).*")
this.getName().regexpMatch("(?i).*(parse|decode|unmarshal).*")
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -38,9 +38,6 @@ private class DecodeFunctionModel extends TaintTracking::FunctionModel {
/** A model of `flag.Parse`, propagating tainted input passed via CLI flags to `Parse`'s result. */
private class FlagSetFunctionModel extends TaintTracking::FunctionModel {
FunctionInput inp;
FunctionOutput outp;
FlagSetFunctionModel() { this.hasQualifiedName("flag", "Parse") }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

18
go/ql/test/experimental/CWE-134/Dsn.go
View File

@@ -51,6 +51,24 @@ func bad2(w http.ResponseWriter, req *http.Request) interface{} {
return db
}
type Config struct {
dsn string
}
func NewConfig() *Config { return &Config{dsn: ""} }
func (Config) Parse([]string) error { return nil }
func RegexFuncModelTest(w http.ResponseWriter, req *http.Request) (interface{}, error) {
cfg := NewConfig()
err := cfg.Parse(os.Args[1:]) // This is bad. `name` can be something like `test?allowAllFiles=true&` which will allow an attacker to access local files.
if err != nil {
return nil, err
}
dbDSN := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8", "username", "password", "127.0.0.1", 3306, cfg.dsn)
db, _ := sql.Open("mysql", dbDSN)
return db, nil
}
func main() {
bad2(nil, nil)
good()

19
go/ql/test/experimental/CWE-134/DsnInjectionLocal.expected
View File

@@ -1,8 +1,27 @@
edges
| Dsn.go:26:11:26:17 | selection of Args | Dsn.go:29:29:29:33 | dbDSN |
| Dsn.go:62:2:62:4 | definition of cfg [pointer] | Dsn.go:63:9:63:11 | cfg [pointer] |
| Dsn.go:62:2:62:4 | definition of cfg [pointer] | Dsn.go:67:102:67:104 | cfg [pointer] |
| Dsn.go:63:9:63:11 | cfg [pointer] | Dsn.go:63:9:63:11 | implicit dereference |
| Dsn.go:63:9:63:11 | implicit dereference | Dsn.go:62:2:62:4 | definition of cfg [pointer] |
| Dsn.go:63:9:63:11 | implicit dereference | Dsn.go:63:9:63:11 | implicit dereference |
| Dsn.go:63:9:63:11 | implicit dereference | Dsn.go:68:29:68:33 | dbDSN |
| Dsn.go:63:19:63:25 | selection of Args | Dsn.go:63:9:63:11 | implicit dereference |
| Dsn.go:63:19:63:25 | selection of Args | Dsn.go:68:29:68:33 | dbDSN |
| Dsn.go:67:102:67:104 | cfg [pointer] | Dsn.go:67:102:67:104 | implicit dereference |
| Dsn.go:67:102:67:104 | implicit dereference | Dsn.go:63:9:63:11 | implicit dereference |
| Dsn.go:67:102:67:104 | implicit dereference | Dsn.go:68:29:68:33 | dbDSN |
nodes
| Dsn.go:26:11:26:17 | selection of Args | semmle.label | selection of Args |
| Dsn.go:29:29:29:33 | dbDSN | semmle.label | dbDSN |
| Dsn.go:62:2:62:4 | definition of cfg [pointer] | semmle.label | definition of cfg [pointer] |
| Dsn.go:63:9:63:11 | cfg [pointer] | semmle.label | cfg [pointer] |
| Dsn.go:63:9:63:11 | implicit dereference | semmle.label | implicit dereference |
| Dsn.go:63:19:63:25 | selection of Args | semmle.label | selection of Args |
| Dsn.go:67:102:67:104 | cfg [pointer] | semmle.label | cfg [pointer] |
| Dsn.go:67:102:67:104 | implicit dereference | semmle.label | implicit dereference |
| Dsn.go:68:29:68:33 | dbDSN | semmle.label | dbDSN |
subpaths
#select
| Dsn.go:29:29:29:33 | dbDSN | Dsn.go:26:11:26:17 | selection of Args | Dsn.go:29:29:29:33 | dbDSN | This query depends on a $@. | Dsn.go:26:11:26:17 | selection of Args | user-provided value |
| Dsn.go:68:29:68:33 | dbDSN | Dsn.go:63:19:63:25 | selection of Args | Dsn.go:68:29:68:33 | dbDSN | This query depends on a $@. | Dsn.go:63:19:63:25 | selection of Args | user-provided value |