hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-24 08:07:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix alias use in HTML template escaping passthrough

Browse Source
This commit is contained in:
Owen Mansel-Chan
2024-08-20 16:04:47 +01:00
committed by Michael B. Gale
parent f6e577e791
commit 3a8a7ea67d
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
go/ql/lib/semmle/go/Types.qll
View File

@@ -1015,6 +1015,17 @@ class AliasType extends @typealias, CompositeType {
override Type getUnderlyingType() { result = this.getRhs().getUnderlyingType() }
}
/**
* Gets the non-alias type at the end of the alias chain starting at `t`.
*
* If `t` is not an alias type then `result` is `t`.
*/
Type unalias(Type t) {
not t instanceof AliasType and result = t
or
result = unalias(t.(AliasType).getRhs())
}
/**
* A type that implements the builtin interface `error`.
*/

4
go/ql/src/experimental/CWE-79/HTMLTemplateEscapingPassthrough.ql
View File

@@ -41,7 +41,7 @@ module UntrustedToPassthroughTypeConversionConfig implements DataFlow::ConfigSig
additional predicate isSinkToPassthroughType(DataFlow::TypeCastNode sink, PassthroughTypeName name) {
exists(Type typ |
typ = sink.getResultType() and
typ.getUnderlyingType*().hasQualifiedName("html/template", name)
unalias(typ).hasQualifiedName("html/template", name)
)
}
@@ -80,7 +80,7 @@ module PassthroughTypeConversionToTemplateExecutionCallConfig implements DataFlo
) {
exists(Type typ |
typ = source.getResultType() and
typ.getUnderlyingType*().hasQualifiedName("html/template", name)
unalias(typ).hasQualifiedName("html/template", name)
)
}