hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Delete WriteNode.writesFieldOnSsaWithFields

Browse Source 
This can be easily expressed in terms of `WriteNode.writesFieldPreUpdate`.
This commit is contained in:
Owen Mansel-Chan
2025-09-25 17:09:08 +01:00
parent 489b8431ea
commit 2ffb638b7e
6 changed files with 6 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
go/ql/lib/semmle/go/controlflow/ControlFlowGraph.qll
View File

@@ -165,13 +165,6 @@ module ControlFlow {
this.writesFieldInsn(base.asInstruction(), f, rhs.asInstruction()) this.writesFieldInsn(base.asInstruction(), f, rhs.asInstruction())
} }
/**
* Holds if this node sets the value of field `f` on `v` to `rhs`.
*/
predicate writesFieldOnSsaWithFields(SsaWithFields v, Field f, DataFlow::Node rhs) {
this.writesFieldPreUpdate(v.getAUse(), f, rhs)
}
private predicate writesFieldInsn(IR::Instruction base, Field f, IR::Instruction rhs) { private predicate writesFieldInsn(IR::Instruction base, Field f, IR::Instruction rhs) {
exists(IR::FieldTarget trg | trg = super.getLhs() | exists(IR::FieldTarget trg | trg = super.getLhs() |
( (

2
go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll
View File

@@ -92,7 +92,7 @@ module OpenUrlRedirect {
PathAssignmentBarrier() { PathAssignmentBarrier() {
exists(Write w, SsaWithFields var | exists(Write w, SsaWithFields var |
hasHostnameSanitizingSubstring(w.getRhs()) and hasHostnameSanitizingSubstring(w.getRhs()) and
w.writesFieldOnSsaWithFields(var, any(Field f | f.getName() = "Path"), _) and w.writesFieldPreUpdate(var.getAUse(), any(Field f | f.getName() = "Path"), _) and
useIsDominated(var, w, this) useIsDominated(var, w, this)
) )
} }

2
go/ql/lib/semmle/go/security/RequestForgery.qll
View File

@@ -28,7 +28,7 @@ module RequestForgery {
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) { predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
// propagate to a URL when its host is assigned to // propagate to a URL when its host is assigned to
exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") | exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") |
w.writesFieldOnSsaWithFields(v, f, pred) and w.writesFieldPreUpdate(v.getAUse(), f, pred) and
succ = v.getAUse() succ = v.getAUse()
) )
} }

2
go/ql/lib/semmle/go/security/SafeUrlFlow.qll
View File

@@ -24,7 +24,7 @@ module SafeUrlFlow {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
// propagate to a URL when its host is assigned to // propagate to a URL when its host is assigned to
exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") | exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") |
w.writesFieldOnSsaWithFields(v, f, node1) and w.writesFieldPreUpdate(v.getAUse(), f, node1) and
node2 = v.getAUse() node2 = v.getAUse()
) )
} }

4
go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
View File

@@ -98,8 +98,8 @@ predicate hostCheckReachesSink(Flow::PathNode sink) {
Flow::flowPath(source, otherSink) and Flow::flowPath(source, otherSink) and
Config::writeIsSink(sink.getNode(), sinkWrite) and Config::writeIsSink(sink.getNode(), sinkWrite) and
Config::writeIsSink(otherSink.getNode(), otherSinkWrite) and Config::writeIsSink(otherSink.getNode(), otherSinkWrite) and
sinkWrite.writesFieldOnSsaWithFields(sinkAccessPath, _, sink.getNode()) and sinkWrite.writesFieldPreUpdate(sinkAccessPath.getAUse(), _, sink.getNode()) and
otherSinkWrite.writesFieldOnSsaWithFields(otherSinkAccessPath, _, otherSink.getNode()) and otherSinkWrite.writesFieldPreUpdate(otherSinkAccessPath.getAUse(), _, otherSink.getNode()) and
otherSinkAccessPath = sinkAccessPath.similar() otherSinkAccessPath = sinkAccessPath.similar()
) )
) )

2
go/ql/src/experimental/CWE-918/SSRF.qll
View File

@@ -23,7 +23,7 @@ module ServerSideRequestForgery {
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
// propagate to a URL when its host is assigned to // propagate to a URL when its host is assigned to
exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") | exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") |
w.writesFieldOnSsaWithFields(v, f, node1) and w.writesFieldPreUpdate(v.getAUse(), f, node1) and
node2 = v.getAUse() node2 = v.getAUse()
) )
} }