From 7a4dbc6fa7671d689212bfae3aea1a76dc2573a2 Mon Sep 17 00:00:00 2001 From: Sauyon Lee Date: Tue, 12 Jan 2021 13:13:15 +0000 Subject: [PATCH 1/2] Autoformatter update --- ql/src/semmle/go/frameworks/BeegoOrm.qll | 16 +++++++--------- ql/src/semmle/go/frameworks/GoRestfulHttp.qll | 14 ++++++-------- .../frameworks/K8sIoApimachineryPkgRuntime.qll | 17 ++++++++--------- ql/src/semmle/go/frameworks/Revel.qll | 3 +-- .../security/CleartextLoggingCustomizations.qll | 3 +-- 5 files changed, 23 insertions(+), 30 deletions(-) diff --git a/ql/src/semmle/go/frameworks/BeegoOrm.qll b/ql/src/semmle/go/frameworks/BeegoOrm.qll index 209f40078fe..9ccf87a0e7c 100644 --- a/ql/src/semmle/go/frameworks/BeegoOrm.qll +++ b/ql/src/semmle/go/frameworks/BeegoOrm.qll @@ -73,9 +73,8 @@ module BeegoOrm { private class StringFieldSource extends StoredXss::Source { StringFieldSource() { exists(Method m | - m - .hasQualifiedName(packagePath(), ["JSONField", "JsonbField", "TextField"], - ["RawValue", "String", "Value"]) + m.hasQualifiedName(packagePath(), ["JSONField", "JsonbField", "TextField"], + ["RawValue", "String", "Value"]) | this = m.getACall().getResult() ) @@ -86,12 +85,11 @@ module BeegoOrm { SeterSource() { exists(Method impl | // All and One are exclusive to QuerySeter, QueryRow[s] are exclusive to RawSeter, the rest are common. - impl - .implements(packagePath(), ["QuerySeter", "RawSeter"], - [ - "All", "One", "Values", "ValuesList", "ValuesFlat", "RowsToMap", "RowsToStruct", - "QueryRow", "QueryRows" - ]) + impl.implements(packagePath(), ["QuerySeter", "RawSeter"], + [ + "All", "One", "Values", "ValuesList", "ValuesFlat", "RowsToMap", "RowsToStruct", + "QueryRow", "QueryRows" + ]) | this = FunctionOutput::parameter(0).getExitNode(impl.getACall()) ) diff --git a/ql/src/semmle/go/frameworks/GoRestfulHttp.qll b/ql/src/semmle/go/frameworks/GoRestfulHttp.qll index 080d808fcde..75a44366ba1 100644 --- a/ql/src/semmle/go/frameworks/GoRestfulHttp.qll +++ b/ql/src/semmle/go/frameworks/GoRestfulHttp.qll @@ -9,12 +9,11 @@ private module GoRestfulHttp { */ private class GoRestfulSourceMethod extends Method { GoRestfulSourceMethod() { - this - .hasQualifiedName(package("github.com/emicklei/go-restful", ""), "Request", - [ - "QueryParameters", "QueryParameter", "BodyParameter", "HeaderParameter", - "PathParameter", "PathParameters" - ]) + this.hasQualifiedName(package("github.com/emicklei/go-restful", ""), "Request", + [ + "QueryParameters", "QueryParameter", "BodyParameter", "HeaderParameter", "PathParameter", + "PathParameters" + ]) } } @@ -31,8 +30,7 @@ private module GoRestfulHttp { private class GoRestfulReadEntitySource extends UntrustedFlowSource::Range { GoRestfulReadEntitySource() { exists(DataFlow::MethodCallNode call | - call - .getTarget() + call.getTarget() .hasQualifiedName(package("github.com/emicklei/go-restful", ""), "Request", "ReadEntity") | this = FunctionOutput::parameter(0).getExitNode(call) diff --git a/ql/src/semmle/go/frameworks/K8sIoApimachineryPkgRuntime.qll b/ql/src/semmle/go/frameworks/K8sIoApimachineryPkgRuntime.qll index 2d4c9eb1b9e..4843cd2f693 100644 --- a/ql/src/semmle/go/frameworks/K8sIoApimachineryPkgRuntime.qll +++ b/ql/src/semmle/go/frameworks/K8sIoApimachineryPkgRuntime.qll @@ -12,15 +12,14 @@ module K8sIoApimachineryPkgRuntime { private class ConvertTypeToType extends TaintTracking::FunctionModel { ConvertTypeToType() { - this - .hasQualifiedName(packagePath(), - [ - "Convert_Slice_string_To_Pointer_int64", "Convert_Slice_string_To_int", - "Convert_Slice_string_To_int64", "Convert_Slice_string_To_string", - "Convert_runtime_Object_To_runtime_RawExtension", - "Convert_runtime_RawExtension_To_runtime_Object", "Convert_string_To_Pointer_int64", - "Convert_string_To_int64" - ]) + this.hasQualifiedName(packagePath(), + [ + "Convert_Slice_string_To_Pointer_int64", "Convert_Slice_string_To_int", + "Convert_Slice_string_To_int64", "Convert_Slice_string_To_string", + "Convert_runtime_Object_To_runtime_RawExtension", + "Convert_runtime_RawExtension_To_runtime_Object", "Convert_string_To_Pointer_int64", + "Convert_string_To_int64" + ]) } override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) { diff --git a/ql/src/semmle/go/frameworks/Revel.qll b/ql/src/semmle/go/frameworks/Revel.qll index 380251e4686..399968d1649 100644 --- a/ql/src/semmle/go/frameworks/Revel.qll +++ b/ql/src/semmle/go/frameworks/Revel.qll @@ -64,8 +64,7 @@ module Revel { private class UserControlledRequestMethod extends UntrustedFlowSource::Range, DataFlow::MethodCallNode { UserControlledRequestMethod() { - this - .getTarget() + this.getTarget() .hasQualifiedName(packagePath(), "Request", [ "FormValue", "PostFormValue", "GetQuery", "GetForm", "GetMultipartForm", "GetBody", diff --git a/ql/src/semmle/go/security/CleartextLoggingCustomizations.qll b/ql/src/semmle/go/security/CleartextLoggingCustomizations.qll index 1a6af789aaf..6d3bc2f7173 100644 --- a/ql/src/semmle/go/security/CleartextLoggingCustomizations.qll +++ b/ql/src/semmle/go/security/CleartextLoggingCustomizations.qll @@ -61,8 +61,7 @@ module CleartextLogging { ) or // avoid i18n strings - this - .(DataFlow::FieldReadNode) + this.(DataFlow::FieldReadNode) .getBase() .asExpr() .(Ident) From c11028229a59020b7074ac6636a15cce0e38d706 Mon Sep 17 00:00:00 2001 From: Sauyon Lee Date: Tue, 12 Jan 2021 13:15:31 +0000 Subject: [PATCH 2/2] Bump codeql version --- .github/workflows/codeqltest.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeqltest.yml b/.github/workflows/codeqltest.yml index a43a155a430..0c4c12c58c5 100644 --- a/.github/workflows/codeqltest.yml +++ b/.github/workflows/codeqltest.yml @@ -20,7 +20,7 @@ jobs: echo "Done" cd $HOME echo "Downloading CodeQL CLI..." - curl https://github.com/github/codeql-cli-binaries/releases/download/v2.4.0/codeql.zip -L -o codeql.zip + curl https://github.com/github/codeql-cli-binaries/releases/download/v2.4.1/codeql.zip -L -o codeql.zip echo "Done" echo "Unpacking CodeQL CLI..." unzip -q codeql.zip @@ -65,7 +65,7 @@ jobs: echo "Done" cd $HOME echo "Downloading CodeQL CLI..." - curl https://github.com/github/codeql-cli-binaries/releases/download/v2.4.0/codeql.zip -L -o codeql.zip + curl https://github.com/github/codeql-cli-binaries/releases/download/v2.4.1/codeql.zip -L -o codeql.zip echo "Done" echo "Unpacking CodeQL CLI..." unzip -q codeql.zip @@ -98,7 +98,7 @@ jobs: echo "Done" cd "$HOME" echo "Downloading CodeQL CLI..." - Invoke-WebRequest -Uri https://github.com/github/codeql-cli-binaries/releases/download/v2.4.0/codeql.zip -OutFile codeql.zip + Invoke-WebRequest -Uri https://github.com/github/codeql-cli-binaries/releases/download/v2.4.1/codeql.zip -OutFile codeql.zip echo "Done" echo "Unpacking CodeQL CLI..." Expand-Archive codeql.zip -DestinationPath $HOME