mirror of
https://github.com/github/codeql.git
synced 2026-04-26 17:25:19 +02:00
Merge branch 'main' into del-deps-sep-2024
This commit is contained in:
Erik Krogh Kristensen
4
cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md
Normal file
4
cpp/ql/lib/change-notes/2024-09-03-realloc-data-flow.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added a data flow model for `realloc`-like functions, which were previously modeled as a taint tracking functions. This change improves the precision of queries where flow through `realloc`-like functions might affect the results.
|
||||
@@ -5,13 +5,13 @@
|
||||
*/
|
||||
|
||||
import semmle.code.cpp.models.interfaces.Allocation
|
||||
import semmle.code.cpp.models.interfaces.Taint
|
||||
import semmle.code.cpp.models.interfaces.DataFlow
|
||||
|
||||
/**
|
||||
* An allocation function (such as `realloc`) that has an argument for the size
|
||||
* in bytes, and an argument for an existing pointer that is to be reallocated.
|
||||
*/
|
||||
private class ReallocAllocationFunction extends AllocationFunction, TaintFunction {
|
||||
private class ReallocAllocationFunction extends AllocationFunction, DataFlowFunction {
|
||||
int sizeArg;
|
||||
int reallocArg;
|
||||
|
||||
@@ -44,7 +44,7 @@ private class ReallocAllocationFunction extends AllocationFunction, TaintFunctio
|
||||
|
||||
override int getReallocPtrArg() { result = reallocArg }
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
|
||||
input.isParameterDeref(this.getReallocPtrArg()) and output.isReturnValueDeref()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -33,7 +33,7 @@ argHasPostUpdate
|
||||
| test.cpp:67:29:67:35 | source1 | ArgumentNode is missing PostUpdateNode. |
|
||||
| test.cpp:813:19:813:35 | * ... | ArgumentNode is missing PostUpdateNode. |
|
||||
| test.cpp:848:23:848:25 | rpx | ArgumentNode is missing PostUpdateNode. |
|
||||
| test.cpp:1057:19:1057:21 | * ... | ArgumentNode is missing PostUpdateNode. |
|
||||
| test.cpp:1065:19:1065:21 | * ... | ArgumentNode is missing PostUpdateNode. |
|
||||
postWithInFlow
|
||||
| BarrierGuard.cpp:49:6:49:6 | x [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| BarrierGuard.cpp:60:7:60:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
@@ -167,15 +167,15 @@ postWithInFlow
|
||||
| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1045:9:1045:11 | ref arg buf | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1051:5:1051:11 | content [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1052:9:1052:9 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1056:5:1056:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1056:6:1056:7 | pp [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1062:53:1062:53 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1072:3:1072:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1072:4:1072:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1073:3:1073:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1073:4:1073:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1059:5:1059:11 | content [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1060:9:1060:9 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1064:5:1064:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1064:6:1064:7 | pp [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1070:53:1070:53 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1080:3:1080:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1080:4:1080:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1081:3:1081:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
|
||||
| test.cpp:1081:4:1081:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
|
||||
viableImplInCallContextTooLarge
|
||||
uniqueParameterNodeAtPosition
|
||||
uniqueParameterNodePosition
|
||||
|
||||
@@ -202,12 +202,12 @@
|
||||
| test.cpp:489:23:489:29 | *content | test.cpp:490:8:490:17 | * ... |
|
||||
| test.cpp:489:23:489:29 | content | test.cpp:489:23:489:29 | content |
|
||||
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
|
||||
| test.cpp:1050:12:1050:12 | definition of a | test.cpp:1051:3:1051:3 | *a |
|
||||
| test.cpp:1051:3:1051:3 | *a | test.cpp:1052:8:1052:9 | *& ... |
|
||||
| test.cpp:1051:3:1051:3 | *a [post update] | test.cpp:1052:8:1052:9 | *& ... |
|
||||
| test.cpp:1051:3:1051:3 | a | test.cpp:1052:8:1052:9 | & ... |
|
||||
| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:8:1052:9 | & ... |
|
||||
| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
|
||||
| test.cpp:1051:15:1051:21 | *0 | test.cpp:1051:3:1051:21 | *... = ... |
|
||||
| test.cpp:1052:9:1052:9 | *a | test.cpp:1052:8:1052:9 | *& ... |
|
||||
| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |
|
||||
| test.cpp:1058:12:1058:12 | definition of a | test.cpp:1059:3:1059:3 | *a |
|
||||
| test.cpp:1059:3:1059:3 | *a | test.cpp:1060:8:1060:9 | *& ... |
|
||||
| test.cpp:1059:3:1059:3 | *a [post update] | test.cpp:1060:8:1060:9 | *& ... |
|
||||
| test.cpp:1059:3:1059:3 | a | test.cpp:1060:8:1060:9 | & ... |
|
||||
| test.cpp:1059:3:1059:3 | a [post update] | test.cpp:1060:8:1060:9 | & ... |
|
||||
| test.cpp:1059:15:1059:21 | 0 | test.cpp:1059:3:1059:21 | ... = ... |
|
||||
| test.cpp:1059:15:1059:21 | *0 | test.cpp:1059:3:1059:21 | *... = ... |
|
||||
| test.cpp:1060:9:1060:9 | *a | test.cpp:1060:8:1060:9 | *& ... |
|
||||
| test.cpp:1060:9:1060:9 | a | test.cpp:1060:8:1060:9 | & ... |
|
||||
|
||||
@@ -81,10 +81,10 @@ WARNING: module 'DataFlow' has been deprecated and may be removed in future (loc
|
||||
| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
|
||||
| test.cpp:488:24:488:30 | ref arg content | test.cpp:489:23:489:29 | content |
|
||||
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
|
||||
| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
|
||||
| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
|
||||
| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:9:1052:9 | a |
|
||||
| test.cpp:1051:3:1051:21 | ... = ... | test.cpp:1051:5:1051:11 | content [post update] |
|
||||
| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
|
||||
| test.cpp:1052:8:1052:9 | ref arg & ... | test.cpp:1052:9:1052:9 | a [inner post update] |
|
||||
| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |
|
||||
| test.cpp:1058:12:1058:12 | a | test.cpp:1059:3:1059:3 | a |
|
||||
| test.cpp:1058:12:1058:12 | a | test.cpp:1060:9:1060:9 | a |
|
||||
| test.cpp:1059:3:1059:3 | a [post update] | test.cpp:1060:9:1060:9 | a |
|
||||
| test.cpp:1059:3:1059:21 | ... = ... | test.cpp:1059:5:1059:11 | content [post update] |
|
||||
| test.cpp:1059:15:1059:21 | 0 | test.cpp:1059:3:1059:21 | ... = ... |
|
||||
| test.cpp:1060:8:1060:9 | ref arg & ... | test.cpp:1060:9:1060:9 | a [inner post update] |
|
||||
| test.cpp:1060:9:1060:9 | a | test.cpp:1060:8:1060:9 | & ... |
|
||||
|
||||
@@ -127,7 +127,7 @@ astFlow
|
||||
| test.cpp:842:11:842:16 | call to source | test.cpp:844:8:844:8 | y |
|
||||
| test.cpp:846:13:846:27 | call to indirect_source | test.cpp:848:23:848:25 | rpx |
|
||||
| test.cpp:860:54:860:59 | call to source | test.cpp:861:10:861:37 | static_local_pointer_dynamic |
|
||||
| test.cpp:1050:12:1050:12 | a | test.cpp:1052:8:1052:9 | & ... |
|
||||
| test.cpp:1058:12:1058:12 | a | test.cpp:1060:8:1060:9 | & ... |
|
||||
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
|
||||
| true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
|
||||
| true_upon_entry.cpp:33:11:33:16 | call to source | true_upon_entry.cpp:39:8:39:8 | x |
|
||||
@@ -313,7 +313,8 @@ irFlow
|
||||
| test.cpp:1021:18:1021:32 | *call to indirect_source | test.cpp:1027:19:1027:28 | *translated |
|
||||
| test.cpp:1021:18:1021:32 | *call to indirect_source | test.cpp:1031:19:1031:28 | *translated |
|
||||
| test.cpp:1045:14:1045:19 | call to source | test.cpp:1046:7:1046:10 | * ... |
|
||||
| test.cpp:1081:27:1081:34 | call to source | test.cpp:1081:27:1081:34 | call to source |
|
||||
| test.cpp:1052:13:1052:27 | *call to indirect_source | test.cpp:1054:7:1054:11 | * ... |
|
||||
| test.cpp:1089:27:1089:34 | call to source | test.cpp:1089:27:1089:34 | call to source |
|
||||
| true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
|
||||
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
|
||||
| true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
|
||||
|
||||
@@ -1046,6 +1046,14 @@ void memset_test(char* buf) { // $ ast-def=buf ir-def=*buf
|
||||
sink(*buf); // $ ir MISSING: ast
|
||||
}
|
||||
|
||||
void *realloc(void *, size_t);
|
||||
|
||||
void test_realloc() {
|
||||
int *src = indirect_source();
|
||||
int *dest = (int*)realloc(src, sizeof(int));
|
||||
sink(*dest); // $ ir, MISSING: ast
|
||||
}
|
||||
|
||||
void flow_out_of_address_with_local_flow() {
|
||||
MyStruct a;
|
||||
a.content = nullptr;
|
||||
|
||||
@@ -51,5 +51,5 @@ incorrectBaseType
|
||||
| test.cpp:848:23:848:25 | rpx | Expected 'Node.getType()' to be int, but it was int * |
|
||||
| test.cpp:854:10:854:36 | * ... | Expected 'Node.getType()' to be const int, but it was int |
|
||||
| test.cpp:867:10:867:30 | * ... | Expected 'Node.getType()' to be const int, but it was int |
|
||||
| test.cpp:1062:52:1062:53 | *& ... | Expected 'Node.getType()' to be char, but it was char * |
|
||||
| test.cpp:1070:52:1070:53 | *& ... | Expected 'Node.getType()' to be char, but it was char * |
|
||||
failures
|
||||
|
||||
@@ -54,5 +54,5 @@
|
||||
| test.cpp:796:12:796:12 | a | test.cpp:797:20:797:20 | a |
|
||||
| test.cpp:796:12:796:12 | a | test.cpp:797:31:797:31 | a |
|
||||
| test.cpp:796:12:796:12 | a | test.cpp:798:17:798:17 | a |
|
||||
| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
|
||||
| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
|
||||
| test.cpp:1058:12:1058:12 | a | test.cpp:1059:3:1059:3 | a |
|
||||
| test.cpp:1058:12:1058:12 | a | test.cpp:1060:9:1060:9 | a |
|
||||
|
||||
@@ -6597,38 +6597,45 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
|
||||
| taint.cpp:729:27:729:32 | endptr | taint.cpp:729:26:729:32 | & ... | |
|
||||
| taint.cpp:731:7:731:12 | ref arg endptr | taint.cpp:732:8:732:13 | endptr | |
|
||||
| taint.cpp:732:8:732:13 | endptr | taint.cpp:732:7:732:13 | * ... | TAINT |
|
||||
| taint.cpp:738:17:738:31 | call to indirect_source | taint.cpp:739:30:739:35 | source | |
|
||||
| taint.cpp:739:22:739:28 | call to realloc | taint.cpp:740:7:740:10 | dest | |
|
||||
| taint.cpp:739:30:739:35 | source | taint.cpp:739:22:739:28 | call to realloc | TAINT |
|
||||
| taint.cpp:743:40:743:45 | buffer | taint.cpp:744:5:744:10 | buffer | |
|
||||
| taint.cpp:743:40:743:45 | buffer | taint.cpp:745:27:745:32 | buffer | |
|
||||
| taint.cpp:744:4:744:10 | * ... | taint.cpp:744:3:744:10 | * ... | TAINT |
|
||||
| taint.cpp:744:5:744:10 | buffer | taint.cpp:744:4:744:10 | * ... | TAINT |
|
||||
| taint.cpp:744:14:744:19 | call to source | taint.cpp:744:3:744:21 | ... = ... | |
|
||||
| taint.cpp:745:19:745:25 | call to realloc | taint.cpp:743:40:743:45 | buffer | |
|
||||
| taint.cpp:745:19:745:25 | call to realloc | taint.cpp:745:3:745:37 | ... = ... | |
|
||||
| taint.cpp:745:19:745:25 | call to realloc | taint.cpp:746:10:746:15 | buffer | |
|
||||
| taint.cpp:745:27:745:32 | buffer | taint.cpp:745:19:745:25 | call to realloc | TAINT |
|
||||
| taint.cpp:746:9:746:15 | * ... | taint.cpp:746:8:746:15 | * ... | TAINT |
|
||||
| taint.cpp:746:10:746:15 | buffer | taint.cpp:746:9:746:15 | * ... | TAINT |
|
||||
| taint.cpp:751:31:751:34 | path | taint.cpp:751:31:751:34 | path | |
|
||||
| taint.cpp:751:31:751:34 | path | taint.cpp:752:10:752:13 | path | |
|
||||
| taint.cpp:751:31:751:34 | path | taint.cpp:753:10:753:13 | path | |
|
||||
| taint.cpp:751:43:751:46 | data | taint.cpp:751:43:751:46 | data | |
|
||||
| taint.cpp:751:43:751:46 | data | taint.cpp:753:22:753:25 | data | |
|
||||
| taint.cpp:752:10:752:13 | ref arg path | taint.cpp:751:31:751:34 | path | |
|
||||
| taint.cpp:752:10:752:13 | ref arg path | taint.cpp:753:10:753:13 | path | |
|
||||
| taint.cpp:752:16:752:19 | %s | taint.cpp:752:10:752:13 | ref arg path | TAINT |
|
||||
| taint.cpp:752:22:752:26 | abc | taint.cpp:752:10:752:13 | ref arg path | TAINT |
|
||||
| taint.cpp:753:10:753:13 | ref arg path | taint.cpp:751:31:751:34 | path | |
|
||||
| taint.cpp:753:16:753:19 | %s | taint.cpp:753:10:753:13 | ref arg path | TAINT |
|
||||
| taint.cpp:753:22:753:25 | data | taint.cpp:753:10:753:13 | ref arg path | TAINT |
|
||||
| taint.cpp:753:22:753:25 | ref arg data | taint.cpp:751:43:751:46 | data | |
|
||||
| taint.cpp:757:7:757:10 | path | taint.cpp:758:21:758:24 | path | |
|
||||
| taint.cpp:757:7:757:10 | path | taint.cpp:759:8:759:11 | path | |
|
||||
| taint.cpp:758:21:758:24 | ref arg path | taint.cpp:759:8:759:11 | path | |
|
||||
| taint.cpp:759:8:759:11 | path | taint.cpp:759:7:759:11 | * ... | |
|
||||
| taint.cpp:769:37:769:42 | call to source | taint.cpp:770:7:770:9 | obj | |
|
||||
| taint.cpp:739:17:739:31 | call to indirect_source | taint.cpp:740:30:740:35 | source | |
|
||||
| taint.cpp:740:22:740:28 | call to realloc | taint.cpp:741:7:741:10 | dest | |
|
||||
| taint.cpp:740:30:740:35 | source | taint.cpp:740:22:740:28 | call to realloc | TAINT |
|
||||
| taint.cpp:744:40:744:45 | buffer | taint.cpp:745:5:745:10 | buffer | |
|
||||
| taint.cpp:744:40:744:45 | buffer | taint.cpp:746:27:746:32 | buffer | |
|
||||
| taint.cpp:745:4:745:10 | * ... | taint.cpp:745:3:745:10 | * ... | TAINT |
|
||||
| taint.cpp:745:5:745:10 | buffer | taint.cpp:745:4:745:10 | * ... | TAINT |
|
||||
| taint.cpp:745:14:745:19 | call to source | taint.cpp:745:3:745:21 | ... = ... | |
|
||||
| taint.cpp:746:19:746:25 | call to realloc | taint.cpp:744:40:744:45 | buffer | |
|
||||
| taint.cpp:746:19:746:25 | call to realloc | taint.cpp:746:3:746:37 | ... = ... | |
|
||||
| taint.cpp:746:19:746:25 | call to realloc | taint.cpp:747:10:747:15 | buffer | |
|
||||
| taint.cpp:746:27:746:32 | buffer | taint.cpp:746:19:746:25 | call to realloc | TAINT |
|
||||
| taint.cpp:747:9:747:15 | * ... | taint.cpp:747:8:747:15 | * ... | TAINT |
|
||||
| taint.cpp:747:10:747:15 | buffer | taint.cpp:747:9:747:15 | * ... | TAINT |
|
||||
| taint.cpp:752:13:752:18 | call to malloc | taint.cpp:753:2:753:2 | a | |
|
||||
| taint.cpp:752:13:752:18 | call to malloc | taint.cpp:754:22:754:22 | a | |
|
||||
| taint.cpp:753:2:753:2 | a [post update] | taint.cpp:754:22:754:22 | a | |
|
||||
| taint.cpp:753:2:753:16 | ... = ... | taint.cpp:753:5:753:5 | x [post update] | |
|
||||
| taint.cpp:753:9:753:14 | call to source | taint.cpp:753:2:753:16 | ... = ... | |
|
||||
| taint.cpp:754:14:754:20 | call to realloc | taint.cpp:755:7:755:8 | a2 | |
|
||||
| taint.cpp:754:22:754:22 | a | taint.cpp:754:14:754:20 | call to realloc | TAINT |
|
||||
| taint.cpp:760:31:760:34 | path | taint.cpp:760:31:760:34 | path | |
|
||||
| taint.cpp:760:31:760:34 | path | taint.cpp:761:10:761:13 | path | |
|
||||
| taint.cpp:760:31:760:34 | path | taint.cpp:762:10:762:13 | path | |
|
||||
| taint.cpp:760:43:760:46 | data | taint.cpp:760:43:760:46 | data | |
|
||||
| taint.cpp:760:43:760:46 | data | taint.cpp:762:22:762:25 | data | |
|
||||
| taint.cpp:761:10:761:13 | ref arg path | taint.cpp:760:31:760:34 | path | |
|
||||
| taint.cpp:761:10:761:13 | ref arg path | taint.cpp:762:10:762:13 | path | |
|
||||
| taint.cpp:761:16:761:19 | %s | taint.cpp:761:10:761:13 | ref arg path | TAINT |
|
||||
| taint.cpp:761:22:761:26 | abc | taint.cpp:761:10:761:13 | ref arg path | TAINT |
|
||||
| taint.cpp:762:10:762:13 | ref arg path | taint.cpp:760:31:760:34 | path | |
|
||||
| taint.cpp:762:16:762:19 | %s | taint.cpp:762:10:762:13 | ref arg path | TAINT |
|
||||
| taint.cpp:762:22:762:25 | data | taint.cpp:762:10:762:13 | ref arg path | TAINT |
|
||||
| taint.cpp:762:22:762:25 | ref arg data | taint.cpp:760:43:760:46 | data | |
|
||||
| taint.cpp:766:7:766:10 | path | taint.cpp:767:21:767:24 | path | |
|
||||
| taint.cpp:766:7:766:10 | path | taint.cpp:768:8:768:11 | path | |
|
||||
| taint.cpp:767:21:767:24 | ref arg path | taint.cpp:768:8:768:11 | path | |
|
||||
| taint.cpp:768:8:768:11 | path | taint.cpp:768:7:768:11 | * ... | |
|
||||
| taint.cpp:778:37:778:42 | call to source | taint.cpp:779:7:779:9 | obj | |
|
||||
| vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 | |
|
||||
| vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 | |
|
||||
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v | |
|
||||
|
||||
@@ -732,6 +732,7 @@ void test_strtol(char *source) {
|
||||
sink(*endptr); // $ ast,ir
|
||||
}
|
||||
|
||||
void *malloc(size_t);
|
||||
void *realloc(void *, size_t);
|
||||
|
||||
void test_realloc() {
|
||||
@@ -746,6 +747,14 @@ void test_realloc_2_indirections(int **buffer) {
|
||||
sink(**buffer); // $ ir MISSING: ast
|
||||
}
|
||||
|
||||
void test_realloc_struct_field() {
|
||||
struct A { int x; };
|
||||
A* a = (A*)malloc(sizeof(A));
|
||||
a->x = source();
|
||||
A* a2 = (A*)realloc(a, sizeof(A));
|
||||
sink(a2->x); // $ ir MISSING: ast
|
||||
}
|
||||
|
||||
int sprintf(char *, const char *, ...);
|
||||
|
||||
void call_sprintf_twice(char* path, char* data) {
|
||||
|
||||
@@ -3075,6 +3075,7 @@ ContentApprox getContentApprox(Content c) {
|
||||
* ensuring that they are visible to the taint tracking / data flow library.
|
||||
*/
|
||||
private module SyntheticFields {
|
||||
private import semmle.code.csharp.dataflow.internal.ExternalFlow
|
||||
private import semmle.code.csharp.frameworks.system.threading.Tasks
|
||||
private import semmle.code.csharp.frameworks.system.runtime.CompilerServices
|
||||
}
|
||||
|
||||
@@ -431,6 +431,17 @@ Declaration interpretElement(
|
||||
)
|
||||
}
|
||||
|
||||
private predicate parseSynthField(AccessPathToken c, string name) {
|
||||
c.getName() = "SyntheticField" and name = c.getAnArgument()
|
||||
}
|
||||
|
||||
/**
|
||||
* An adapter class for adding synthetic fields from MaD.
|
||||
*/
|
||||
private class SyntheticFieldAdapter extends SyntheticField {
|
||||
SyntheticFieldAdapter() { parseSynthField(_, this) }
|
||||
}
|
||||
|
||||
cached
|
||||
private module Cached {
|
||||
/**
|
||||
|
||||
@@ -291,4 +291,42 @@ namespace My.Qltest
|
||||
|
||||
static void Sink(object o) { }
|
||||
}
|
||||
|
||||
// Test synthetic fields
|
||||
public class K {
|
||||
|
||||
public object MyField;
|
||||
|
||||
public void SetMySyntheticField(object o) => throw null;
|
||||
|
||||
public object GetMySyntheticField() => throw null;
|
||||
|
||||
public void SetMyNestedSyntheticField(object o) => throw null;
|
||||
|
||||
public object GetMyNestedSyntheticField() => throw null;
|
||||
|
||||
public void SetMyFieldOnSyntheticField(object o) => throw null;
|
||||
|
||||
public object GetMyFieldOnSyntheticField() => throw null;
|
||||
|
||||
public void M1() {
|
||||
var o = new object();
|
||||
SetMySyntheticField(o);
|
||||
Sink(GetMySyntheticField());
|
||||
}
|
||||
|
||||
public void M2() {
|
||||
var o = new object();
|
||||
SetMyNestedSyntheticField(o);
|
||||
Sink(GetMyNestedSyntheticField());
|
||||
}
|
||||
|
||||
public void M3() {
|
||||
var o = new object();
|
||||
SetMyFieldOnSyntheticField(o);
|
||||
Sink(GetMyFieldOnSyntheticField());
|
||||
}
|
||||
|
||||
static void Sink(object o) { }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -24,6 +24,12 @@ models
|
||||
| 23 | Summary: My.Qltest; I; false; GetFirst; (My.Qltest.MyInlineArray); ; Argument[0].Element; ReturnValue; value; manual |
|
||||
| 24 | Summary: My.Qltest; J; false; get_Prop1; (); ; Argument[this]; ReturnValue; value; manual |
|
||||
| 25 | Summary: My.Qltest; J; false; SetProp1; (System.Object); ; Argument[0]; Argument[this]; value; manual |
|
||||
| 26 | Summary: My.Qltest; K; false; SetMySyntheticField; (System.Object); ; Argument[0]; Argument[this].SyntheticField[My.Qltest.K.MySyntheticField]; value; manual |
|
||||
| 27 | Summary: My.Qltest; K; false; GetMySyntheticField; (); ; Argument[this].SyntheticField[My.Qltest.K.MySyntheticField]; ReturnValue; value; manual |
|
||||
| 28 | Summary: My.Qltest; K; false; SetMyNestedSyntheticField; (System.Object); ; Argument[0]; Argument[this].SyntheticField[My.Qltest.K.MySyntheticField1].SyntheticField[MySyntheticField1.MyNestedSyntheticField]; value; manual |
|
||||
| 29 | Summary: My.Qltest; K; false; GetMyNestedSyntheticField; (); ; Argument[this].SyntheticField[My.Qltest.K.MySyntheticField1].SyntheticField[MySyntheticField1.MyNestedSyntheticField]; ReturnValue; value; manual |
|
||||
| 30 | Summary: My.Qltest; K; false; SetMyFieldOnSyntheticField; (System.Object); ; Argument[0]; Argument[this].SyntheticField[My.Qltest.K.MySyntheticField2].Field[My.Qltest.K.MyField]; value; manual |
|
||||
| 31 | Summary: My.Qltest; K; false; GetMyFieldOnSyntheticField; (); ; Argument[this].SyntheticField[My.Qltest.K.MySyntheticField2].Field[My.Qltest.K.MyField]; ReturnValue; value; manual |
|
||||
edges
|
||||
| ExternalFlow.cs:9:20:9:23 | access to local variable arg1 : Object | ExternalFlow.cs:10:29:10:32 | access to local variable arg1 : Object | provenance | |
|
||||
| ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | ExternalFlow.cs:9:20:9:23 | access to local variable arg1 : Object | provenance | |
|
||||
@@ -121,6 +127,21 @@ edges
|
||||
| ExternalFlow.cs:279:13:279:23 | [post] this access : J | ExternalFlow.cs:281:18:281:21 | this access : J | provenance | |
|
||||
| ExternalFlow.cs:279:22:279:22 | access to local variable j : Object | ExternalFlow.cs:279:13:279:23 | [post] this access : J | provenance | MaD:25 |
|
||||
| ExternalFlow.cs:281:18:281:21 | this access : J | ExternalFlow.cs:281:18:281:27 | access to property Prop1 | provenance | MaD:24 |
|
||||
| ExternalFlow.cs:313:17:313:17 | access to local variable o : Object | ExternalFlow.cs:314:33:314:33 | access to local variable o : Object | provenance | |
|
||||
| ExternalFlow.cs:313:21:313:32 | object creation of type Object : Object | ExternalFlow.cs:313:17:313:17 | access to local variable o : Object | provenance | |
|
||||
| ExternalFlow.cs:314:13:314:34 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField] : Object | ExternalFlow.cs:315:18:315:38 | this access : K [synthetic My.Qltest.K.MySyntheticField] : Object | provenance | |
|
||||
| ExternalFlow.cs:314:33:314:33 | access to local variable o : Object | ExternalFlow.cs:314:13:314:34 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField] : Object | provenance | MaD:26 |
|
||||
| ExternalFlow.cs:315:18:315:38 | this access : K [synthetic My.Qltest.K.MySyntheticField] : Object | ExternalFlow.cs:315:18:315:38 | call to method GetMySyntheticField | provenance | MaD:27 |
|
||||
| ExternalFlow.cs:319:17:319:17 | access to local variable o : Object | ExternalFlow.cs:320:39:320:39 | access to local variable o : Object | provenance | |
|
||||
| ExternalFlow.cs:319:21:319:32 | object creation of type Object : Object | ExternalFlow.cs:319:17:319:17 | access to local variable o : Object | provenance | |
|
||||
| ExternalFlow.cs:320:13:320:40 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object | ExternalFlow.cs:321:18:321:44 | this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object | provenance | |
|
||||
| ExternalFlow.cs:320:39:320:39 | access to local variable o : Object | ExternalFlow.cs:320:13:320:40 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object | provenance | MaD:28 |
|
||||
| ExternalFlow.cs:321:18:321:44 | this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object | ExternalFlow.cs:321:18:321:44 | call to method GetMyNestedSyntheticField | provenance | MaD:29 |
|
||||
| ExternalFlow.cs:325:17:325:17 | access to local variable o : Object | ExternalFlow.cs:326:40:326:40 | access to local variable o : Object | provenance | |
|
||||
| ExternalFlow.cs:325:21:325:32 | object creation of type Object : Object | ExternalFlow.cs:325:17:325:17 | access to local variable o : Object | provenance | |
|
||||
| ExternalFlow.cs:326:13:326:41 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object | ExternalFlow.cs:327:18:327:45 | this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object | provenance | |
|
||||
| ExternalFlow.cs:326:40:326:40 | access to local variable o : Object | ExternalFlow.cs:326:13:326:41 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object | provenance | MaD:30 |
|
||||
| ExternalFlow.cs:327:18:327:45 | this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object | ExternalFlow.cs:327:18:327:45 | call to method GetMyFieldOnSyntheticField | provenance | MaD:31 |
|
||||
nodes
|
||||
| ExternalFlow.cs:9:20:9:23 | access to local variable arg1 : Object | semmle.label | access to local variable arg1 : Object |
|
||||
| ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
@@ -240,6 +261,24 @@ nodes
|
||||
| ExternalFlow.cs:279:22:279:22 | access to local variable j : Object | semmle.label | access to local variable j : Object |
|
||||
| ExternalFlow.cs:281:18:281:21 | this access : J | semmle.label | this access : J |
|
||||
| ExternalFlow.cs:281:18:281:27 | access to property Prop1 | semmle.label | access to property Prop1 |
|
||||
| ExternalFlow.cs:313:17:313:17 | access to local variable o : Object | semmle.label | access to local variable o : Object |
|
||||
| ExternalFlow.cs:313:21:313:32 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:314:13:314:34 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField] : Object | semmle.label | [post] this access : K [synthetic My.Qltest.K.MySyntheticField] : Object |
|
||||
| ExternalFlow.cs:314:33:314:33 | access to local variable o : Object | semmle.label | access to local variable o : Object |
|
||||
| ExternalFlow.cs:315:18:315:38 | call to method GetMySyntheticField | semmle.label | call to method GetMySyntheticField |
|
||||
| ExternalFlow.cs:315:18:315:38 | this access : K [synthetic My.Qltest.K.MySyntheticField] : Object | semmle.label | this access : K [synthetic My.Qltest.K.MySyntheticField] : Object |
|
||||
| ExternalFlow.cs:319:17:319:17 | access to local variable o : Object | semmle.label | access to local variable o : Object |
|
||||
| ExternalFlow.cs:319:21:319:32 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:320:13:320:40 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object | semmle.label | [post] this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object |
|
||||
| ExternalFlow.cs:320:39:320:39 | access to local variable o : Object | semmle.label | access to local variable o : Object |
|
||||
| ExternalFlow.cs:321:18:321:44 | call to method GetMyNestedSyntheticField | semmle.label | call to method GetMyNestedSyntheticField |
|
||||
| ExternalFlow.cs:321:18:321:44 | this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object | semmle.label | this access : K [synthetic My.Qltest.K.MySyntheticField1, synthetic MySyntheticField1.MyNestedSyntheticField] : Object |
|
||||
| ExternalFlow.cs:325:17:325:17 | access to local variable o : Object | semmle.label | access to local variable o : Object |
|
||||
| ExternalFlow.cs:325:21:325:32 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:326:13:326:41 | [post] this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object | semmle.label | [post] this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object |
|
||||
| ExternalFlow.cs:326:40:326:40 | access to local variable o : Object | semmle.label | access to local variable o : Object |
|
||||
| ExternalFlow.cs:327:18:327:45 | call to method GetMyFieldOnSyntheticField | semmle.label | call to method GetMyFieldOnSyntheticField |
|
||||
| ExternalFlow.cs:327:18:327:45 | this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object | semmle.label | this access : K [synthetic My.Qltest.K.MySyntheticField2, field MyField] : Object |
|
||||
subpaths
|
||||
| ExternalFlow.cs:84:29:84:32 | access to local variable objs : null [element] : Object | ExternalFlow.cs:84:35:84:35 | o : Object | ExternalFlow.cs:84:40:84:40 | access to parameter o : Object | ExternalFlow.cs:84:25:84:41 | call to method Map<Object,Object> : T[] [element] : Object |
|
||||
invalidModelRow
|
||||
@@ -269,3 +308,6 @@ invalidModelRow
|
||||
| ExternalFlow.cs:240:18:240:18 | access to local variable o | ExternalFlow.cs:238:21:238:28 | object creation of type HC : HC | ExternalFlow.cs:240:18:240:18 | access to local variable o | $@ | ExternalFlow.cs:238:21:238:28 | object creation of type HC : HC | object creation of type HC : HC |
|
||||
| ExternalFlow.cs:258:18:258:18 | access to local variable b | ExternalFlow.cs:256:20:256:31 | object creation of type Object : Object | ExternalFlow.cs:258:18:258:18 | access to local variable b | $@ | ExternalFlow.cs:256:20:256:31 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:281:18:281:27 | access to property Prop1 | ExternalFlow.cs:278:21:278:32 | object creation of type Object : Object | ExternalFlow.cs:281:18:281:27 | access to property Prop1 | $@ | ExternalFlow.cs:278:21:278:32 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:315:18:315:38 | call to method GetMySyntheticField | ExternalFlow.cs:313:21:313:32 | object creation of type Object : Object | ExternalFlow.cs:315:18:315:38 | call to method GetMySyntheticField | $@ | ExternalFlow.cs:313:21:313:32 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:321:18:321:44 | call to method GetMyNestedSyntheticField | ExternalFlow.cs:319:21:319:32 | object creation of type Object : Object | ExternalFlow.cs:321:18:321:44 | call to method GetMyNestedSyntheticField | $@ | ExternalFlow.cs:319:21:319:32 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
| ExternalFlow.cs:327:18:327:45 | call to method GetMyFieldOnSyntheticField | ExternalFlow.cs:325:21:325:32 | object creation of type Object : Object | ExternalFlow.cs:327:18:327:45 | call to method GetMyFieldOnSyntheticField | $@ | ExternalFlow.cs:325:21:325:32 | object creation of type Object : Object | object creation of type Object : Object |
|
||||
|
||||
@@ -37,6 +37,13 @@ extensions:
|
||||
- ["My.Qltest", "J", false, "SetProp1", "(System.Object)", "", "Argument[0]", "Argument[this]", "value", "manual"]
|
||||
- ["My.Qltest", "J", false, "get_Prop2", "()", "", "Argument[this]", "ReturnValue", "value", "df-generated"]
|
||||
- ["My.Qltest", "J", false, "SetProp2", "(System.Object)", "", "Argument[0]", "Argument[this]", "value", "manual"]
|
||||
- ["My.Qltest", "K", false, "SetMySyntheticField", "(System.Object)", "", "Argument[0]", "Argument[this].SyntheticField[My.Qltest.K.MySyntheticField]", "value", "manual"]
|
||||
- ["My.Qltest", "K", false, "GetMySyntheticField", "()", "", "Argument[this].SyntheticField[My.Qltest.K.MySyntheticField]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "K", false, "SetMyNestedSyntheticField", "(System.Object)", "", "Argument[0]", "Argument[this].SyntheticField[My.Qltest.K.MySyntheticField1].SyntheticField[MySyntheticField1.MyNestedSyntheticField]", "value", "manual"]
|
||||
- ["My.Qltest", "K", false, "GetMyNestedSyntheticField", "()", "", "Argument[this].SyntheticField[My.Qltest.K.MySyntheticField1].SyntheticField[MySyntheticField1.MyNestedSyntheticField]", "ReturnValue", "value", "manual"]
|
||||
- ["My.Qltest", "K", false, "SetMyFieldOnSyntheticField", "(System.Object)", "", "Argument[0]", "Argument[this].SyntheticField[My.Qltest.K.MySyntheticField2].Field[My.Qltest.K.MyField]", "value", "manual"]
|
||||
- ["My.Qltest", "K", false, "GetMyFieldOnSyntheticField", "()", "", "Argument[this].SyntheticField[My.Qltest.K.MySyntheticField2].Field[My.Qltest.K.MyField]", "ReturnValue", "value", "manual"]
|
||||
|
||||
- addsTo:
|
||||
pack: codeql/csharp-all
|
||||
extensible: neutralModel
|
||||
|
||||
@@ -1,166 +1,121 @@
|
||||
package,sink,source,summary,sink:command-injection,sink:credentials-key,sink:jwt,sink:log-injection,sink:path-injection,sink:regex-use[0],sink:regex-use[1],sink:regex-use[c],sink:request-forgery,sink:request-forgery[TCP Addr + Port],sink:url-redirection,sink:url-redirection[0],sink:url-redirection[receiver],sink:xpath-injection,source:remote,summary:taint,summary:value
|
||||
,,,8,,,,,,,,,,,,,,,,3,5
|
||||
archive/tar,,,5,,,,,,,,,,,,,,,,5,
|
||||
archive/zip,,,6,,,,,,,,,,,,,,,,6,
|
||||
bufio,,,17,,,,,,,,,,,,,,,,17,
|
||||
bytes,,,43,,,,,,,,,,,,,,,,43,
|
||||
clevergo.tech/clevergo,1,,,,,,,,,,,,,,,1,,,,
|
||||
compress/bzip2,,,1,,,,,,,,,,,,,,,,1,
|
||||
compress/flate,,,4,,,,,,,,,,,,,,,,4,
|
||||
compress/gzip,,,3,,,,,,,,,,,,,,,,3,
|
||||
compress/lzw,,,1,,,,,,,,,,,,,,,,1,
|
||||
compress/zlib,,,4,,,,,,,,,,,,,,,,4,
|
||||
container/heap,,,5,,,,,,,,,,,,,,,,5,
|
||||
container/list,,,20,,,,,,,,,,,,,,,,20,
|
||||
container/ring,,,5,,,,,,,,,,,,,,,,5,
|
||||
context,,,5,,,,,,,,,,,,,,,,5,
|
||||
crypto,,,1,,,,,,,,,,,,,,,,1,
|
||||
crypto/cipher,,,3,,,,,,,,,,,,,,,,3,
|
||||
crypto/rsa,,,2,,,,,,,,,,,,,,,,2,
|
||||
crypto/tls,,,3,,,,,,,,,,,,,,,,3,
|
||||
crypto/x509,,,1,,,,,,,,,,,,,,,,1,
|
||||
database/sql,,,7,,,,,,,,,,,,,,,,7,
|
||||
database/sql/driver,,,4,,,,,,,,,,,,,,,,4,
|
||||
encoding,,,4,,,,,,,,,,,,,,,,4,
|
||||
encoding/ascii85,,,2,,,,,,,,,,,,,,,,2,
|
||||
encoding/asn1,,,8,,,,,,,,,,,,,,,,8,
|
||||
encoding/base32,,,3,,,,,,,,,,,,,,,,3,
|
||||
encoding/base64,,,3,,,,,,,,,,,,,,,,3,
|
||||
encoding/binary,,,2,,,,,,,,,,,,,,,,2,
|
||||
encoding/csv,,,5,,,,,,,,,,,,,,,,5,
|
||||
encoding/gob,,,7,,,,,,,,,,,,,,,,7,
|
||||
encoding/hex,,,3,,,,,,,,,,,,,,,,3,
|
||||
encoding/json,,,14,,,,,,,,,,,,,,,,14,
|
||||
encoding/pem,,,3,,,,,,,,,,,,,,,,3,
|
||||
encoding/xml,,,23,,,,,,,,,,,,,,,,23,
|
||||
errors,,,3,,,,,,,,,,,,,,,,3,
|
||||
expvar,,,6,,,,,,,,,,,,,,,,6,
|
||||
fmt,3,,16,,,,3,,,,,,,,,,,,16,
|
||||
github.com/ChrisTrenkamp/goxpath,3,,,,,,,,,,,,,,,,3,,,
|
||||
github.com/Sirupsen/logrus,118,,,,,,118,,,,,,,,,,,,,
|
||||
github.com/antchfx/htmlquery,4,,,,,,,,,,,,,,,,4,,,
|
||||
github.com/antchfx/jsonquery,4,,,,,,,,,,,,,,,,4,,,
|
||||
github.com/antchfx/xmlquery,8,,,,,,,,,,,,,,,,8,,,
|
||||
github.com/antchfx/xpath,4,,,,,,,,,,,,,,,,4,,,
|
||||
github.com/appleboy/gin-jwt,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/astaxie/beego,16,6,7,,,,11,4,,,,,,1,,,,6,7,
|
||||
github.com/astaxie/beego/context,2,15,1,,,,,1,,,,,,1,,,,15,1,
|
||||
github.com/astaxie/beego/logs,22,,,,,,22,,,,,,,,,,,,,
|
||||
github.com/astaxie/beego/utils,1,,13,,,,1,,,,,,,,,,,,13,
|
||||
github.com/beego/beego,16,6,7,,,,11,4,,,,,,1,,,,6,7,
|
||||
github.com/beego/beego/context,2,15,1,,,,,1,,,,,,1,,,,15,1,
|
||||
github.com/beego/beego/core/logs,22,,,,,,22,,,,,,,,,,,,,
|
||||
github.com/beego/beego/core/utils,1,,13,,,,1,,,,,,,,,,,,13,
|
||||
github.com/beego/beego/logs,22,,,,,,22,,,,,,,,,,,,,
|
||||
github.com/beego/beego/server/web,16,6,7,,,,11,4,,,,,,1,,,,6,7,
|
||||
github.com/beego/beego/server/web/context,2,15,1,,,,,1,,,,,,1,,,,15,1,
|
||||
github.com/beego/beego/utils,1,,13,,,,1,,,,,,,,,,,,13,
|
||||
github.com/clevergo/clevergo,1,,,,,,,,,,,,,,,1,,,,
|
||||
github.com/codeskyblue/go-sh,4,,,4,,,,,,,,,,,,,,,,
|
||||
github.com/couchbase/gocb,,,18,,,,,,,,,,,,,,,,18,
|
||||
github.com/couchbaselabs/gocb,,,18,,,,,,,,,,,,,,,,18,
|
||||
github.com/crankycoder/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
github.com/cristalhq/jwt,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/davecgh/go-spew/spew,9,,,,,,9,,,,,,,,,,,,,
|
||||
github.com/dgrijalva/jwt-go,3,,9,,2,1,,,,,,,,,,,,,9,
|
||||
github.com/elazarl/goproxy,2,2,2,,,,2,,,,,,,,,,,2,2,
|
||||
github.com/emicklei/go-restful,,7,,,,,,,,,,,,,,,,7,,
|
||||
github.com/evanphx/json-patch,,,12,,,,,,,,,,,,,,,,12,
|
||||
github.com/form3tech-oss/jwt-go,2,,,,2,,,,,,,,,,,,,,,
|
||||
github.com/gin-gonic/gin,3,46,2,,,,,3,,,,,,,,,,46,2,
|
||||
github.com/go-chi/chi,,3,,,,,,,,,,,,,,,,3,,
|
||||
github.com/go-chi/jwtauth,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/go-jose/go-jose,2,,,,2,,,,,,,,,,,,,,,
|
||||
github.com/go-jose/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
|
||||
github.com/go-kit/kit/auth/jwt,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/go-pg/pg/orm,,,6,,,,,,,,,,,,,,,,6,
|
||||
github.com/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
github.com/gobwas/ws,,2,,,,,,,,,,,,,,,,2,,
|
||||
github.com/gofiber/fiber,5,,,,,,,4,,,,,,,,1,,,,
|
||||
github.com/gogf/gf-jwt,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/going/toolkit/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
github.com/golang-jwt/jwt,3,,11,,2,1,,,,,,,,,,,,,11,
|
||||
github.com/golang/glog,90,,,,,,90,,,,,,,,,,,,,
|
||||
github.com/golang/protobuf/proto,,,4,,,,,,,,,,,,,,,,4,
|
||||
github.com/gorilla/mux,,1,,,,,,,,,,,,,,,,1,,
|
||||
github.com/gorilla/websocket,,3,,,,,,,,,,,,,,,,3,,
|
||||
github.com/jbowtie/gokogiri/xml,4,,,,,,,,,,,,,,,,4,,,
|
||||
github.com/jbowtie/gokogiri/xpath,1,,,,,,,,,,,,,,,,1,,,
|
||||
github.com/json-iterator/go,,,4,,,,,,,,,,,,,,,,4,
|
||||
github.com/kataras/iris/context,6,,,,,,,6,,,,,,,,,,,,
|
||||
github.com/kataras/iris/middleware/jwt,2,,,,2,,,,,,,,,,,,,,,
|
||||
github.com/kataras/iris/server/web/context,6,,,,,,,6,,,,,,,,,,,,
|
||||
github.com/kataras/jwt,5,,,,5,,,,,,,,,,,,,,,
|
||||
github.com/labstack/echo,3,12,2,,,,,2,,,,,,1,,,,12,2,
|
||||
github.com/lestrrat-go/jwx,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/lestrrat-go/jwx/jwk,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/lestrrat-go/libxml2/parser,3,,,,,,,,,,,,,,,,3,,,
|
||||
github.com/lestrrat/go-jwx/jwk,1,,,,1,,,,,,,,,,,,,,,
|
||||
github.com/masterzen/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
github.com/moovweb/gokogiri/xml,4,,,,,,,,,,,,,,,,4,,,
|
||||
github.com/moovweb/gokogiri/xpath,1,,,,,,,,,,,,,,,,1,,,
|
||||
github.com/ory/fosite/token/jwt,2,,,,2,,,,,,,,,,,,,,,
|
||||
github.com/revel/revel,2,23,10,,,,,1,,,,,,1,,,,23,10,
|
||||
github.com/robfig/revel,2,23,10,,,,,1,,,,,,1,,,,23,10,
|
||||
github.com/santhosh-tekuri/xpathparser,2,,,,,,,,,,,,,,,,2,,,
|
||||
github.com/sendgrid/sendgrid-go/helpers/mail,,,1,,,,,,,,,,,,,,,,1,
|
||||
github.com/sirupsen/logrus,118,,,,,,118,,,,,,,,,,,,,
|
||||
github.com/spf13/afero,34,,,,,,,34,,,,,,,,,,,,
|
||||
github.com/square/go-jose,2,,,,2,,,,,,,,,,,,,,,
|
||||
github.com/square/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
|
||||
github.com/valyala/fasthttp,35,50,5,,,,,8,,,,17,8,2,,,,50,5,
|
||||
go.uber.org/zap,33,,11,,,,33,,,,,,,,,,,,11,
|
||||
golang.org/x/crypto/ssh,4,,,4,,,,,,,,,,,,,,,,
|
||||
golang.org/x/net/context,,,5,,,,,,,,,,,,,,,,5,
|
||||
golang.org/x/net/html,,,16,,,,,,,,,,,,,,,,16,
|
||||
golang.org/x/net/websocket,,2,,,,,,,,,,,,,,,,2,,
|
||||
google.golang.org/protobuf/internal/encoding/text,,,1,,,,,,,,,,,,,,,,1,
|
||||
google.golang.org/protobuf/internal/impl,,,2,,,,,,,,,,,,,,,,2,
|
||||
google.golang.org/protobuf/proto,,,8,,,,,,,,,,,,,,,,8,
|
||||
google.golang.org/protobuf/reflect/protoreflect,,,1,,,,,,,,,,,,,,,,1,
|
||||
gopkg.in/couchbase/gocb,,,18,,,,,,,,,,,,,,,,18,
|
||||
gopkg.in/glog,90,,,,,,90,,,,,,,,,,,,,
|
||||
gopkg.in/go-jose/go-jose,2,,,,2,,,,,,,,,,,,,,,
|
||||
gopkg.in/go-jose/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
|
||||
gopkg.in/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
gopkg.in/macaron,1,12,1,,,,,,,,,,,,,1,,12,1,
|
||||
gopkg.in/square/go-jose,2,,,,2,,,,,,,,,,,,,,,
|
||||
gopkg.in/square/go-jose/jwt,1,,4,,,1,,,,,,,,,,,,,4,
|
||||
gopkg.in/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
gopkg.in/yaml,,,9,,,,,,,,,,,,,,,,9,
|
||||
html,,,2,,,,,,,,,,,,,,,,2,
|
||||
html/template,,,6,,,,,,,,,,,,,,,,6,
|
||||
io,,,19,,,,,,,,,,,,,,,,19,
|
||||
io/fs,,,12,,,,,,,,,,,,,,,,12,
|
||||
io/ioutil,5,,2,,,,,5,,,,,,,,,,,2,
|
||||
k8s.io/api/core,,,10,,,,,,,,,,,,,,,,10,
|
||||
k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,47,
|
||||
k8s.io/klog,90,,,,,,90,,,,,,,,,,,,,
|
||||
launchpad.net/xmlpath,2,,,,,,,,,,,,,,,,2,,,
|
||||
log,20,,3,,,,20,,,,,,,,,,,,3,
|
||||
math/big,,,1,,,,,,,,,,,,,,,,1,
|
||||
mime,,,5,,,,,,,,,,,,,,,,5,
|
||||
mime/multipart,,,8,,,,,,,,,,,,,,,,8,
|
||||
mime/quotedprintable,,,1,,,,,,,,,,,,,,,,1,
|
||||
net,,,20,,,,,,,,,,,,,,,,20,
|
||||
net/http,2,16,22,,,,,1,,,,,,,1,,,16,22,
|
||||
net/http/httputil,,,10,,,,,,,,,,,,,,,,10,
|
||||
net/mail,,,6,,,,,,,,,,,,,,,,6,
|
||||
net/textproto,,,19,,,,,,,,,,,,,,,,19,
|
||||
net/url,,,23,,,,,,,,,,,,,,,,23,
|
||||
nhooyr.io/websocket,,2,,,,,,,,,,,,,,,,2,,
|
||||
os,27,,4,1,,,,26,,,,,,,,,,,4,
|
||||
os/exec,2,,,2,,,,,,,,,,,,,,,,
|
||||
path,,,5,,,,,,,,,,,,,,,,5,
|
||||
path/filepath,,,13,,,,,,,,,,,,,,,,13,
|
||||
reflect,,,37,,,,,,,,,,,,,,,,37,
|
||||
regexp,10,,20,,,,,,3,3,4,,,,,,,,20,
|
||||
sort,,,1,,,,,,,,,,,,,,,,1,
|
||||
strconv,,,9,,,,,,,,,,,,,,,,9,
|
||||
strings,,,34,,,,,,,,,,,,,,,,34,
|
||||
sync,,,10,,,,,,,,,,,,,,,,10,
|
||||
sync/atomic,,,24,,,,,,,,,,,,,,,,24,
|
||||
syscall,5,,8,5,,,,,,,,,,,,,,,8,
|
||||
text/scanner,,,3,,,,,,,,,,,,,,,,3,
|
||||
text/tabwriter,,,1,,,,,,,,,,,,,,,,1,
|
||||
text/template,,,6,,,,,,,,,,,,,,,,6,
|
||||
package,sink,source,summary,sink:command-injection,sink:credentials-key,sink:jwt,sink:path-injection,sink:regex-use[0],sink:regex-use[1],sink:regex-use[c],sink:request-forgery,sink:request-forgery[TCP Addr + Port],sink:url-redirection,sink:url-redirection[0],sink:url-redirection[receiver],sink:xpath-injection,source:environment,source:file,source:remote,summary:taint,summary:value
|
||||
,,,8,,,,,,,,,,,,,,,,,3,5
|
||||
archive/tar,,,5,,,,,,,,,,,,,,,,,5,
|
||||
archive/zip,,,6,,,,,,,,,,,,,,,,,6,
|
||||
bufio,,,17,,,,,,,,,,,,,,,,,17,
|
||||
bytes,,,43,,,,,,,,,,,,,,,,,43,
|
||||
clevergo.tech/clevergo,1,,,,,,,,,,,,,,1,,,,,,
|
||||
compress/bzip2,,,1,,,,,,,,,,,,,,,,,1,
|
||||
compress/flate,,,4,,,,,,,,,,,,,,,,,4,
|
||||
compress/gzip,,,3,,,,,,,,,,,,,,,,,3,
|
||||
compress/lzw,,,1,,,,,,,,,,,,,,,,,1,
|
||||
compress/zlib,,,4,,,,,,,,,,,,,,,,,4,
|
||||
container/heap,,,5,,,,,,,,,,,,,,,,,5,
|
||||
container/list,,,20,,,,,,,,,,,,,,,,,20,
|
||||
container/ring,,,5,,,,,,,,,,,,,,,,,5,
|
||||
context,,,5,,,,,,,,,,,,,,,,,5,
|
||||
crypto,,,10,,,,,,,,,,,,,,,,,10,
|
||||
database/sql,,,11,,,,,,,,,,,,,,,,,11,
|
||||
encoding,,,77,,,,,,,,,,,,,,,,,77,
|
||||
errors,,,3,,,,,,,,,,,,,,,,,3,
|
||||
expvar,,,6,,,,,,,,,,,,,,,,,6,
|
||||
fmt,,,16,,,,,,,,,,,,,,,,,16,
|
||||
github.com/ChrisTrenkamp/goxpath,3,,,,,,,,,,,,,,,3,,,,,
|
||||
github.com/antchfx/htmlquery,4,,,,,,,,,,,,,,,4,,,,,
|
||||
github.com/antchfx/jsonquery,4,,,,,,,,,,,,,,,4,,,,,
|
||||
github.com/antchfx/xmlquery,8,,,,,,,,,,,,,,,8,,,,,
|
||||
github.com/antchfx/xpath,4,,,,,,,,,,,,,,,4,,,,,
|
||||
github.com/appleboy/gin-jwt,1,,,,1,,,,,,,,,,,,,,,,
|
||||
github.com/astaxie/beego,7,21,21,,,,5,,,,,,2,,,,,,21,21,
|
||||
github.com/beego/beego,14,42,42,,,,10,,,,,,4,,,,,,42,42,
|
||||
github.com/caarlos0/env,,5,2,,,,,,,,,,,,,,5,,,1,1
|
||||
github.com/clevergo/clevergo,1,,,,,,,,,,,,,,1,,,,,,
|
||||
github.com/codeskyblue/go-sh,4,,,4,,,,,,,,,,,,,,,,,
|
||||
github.com/couchbase/gocb,,,18,,,,,,,,,,,,,,,,,18,
|
||||
github.com/couchbaselabs/gocb,,,18,,,,,,,,,,,,,,,,,18,
|
||||
github.com/crankycoder/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
github.com/cristalhq/jwt,1,,,,1,,,,,,,,,,,,,,,,
|
||||
github.com/dgrijalva/jwt-go,3,,9,,2,1,,,,,,,,,,,,,,9,
|
||||
github.com/elazarl/goproxy,,2,2,,,,,,,,,,,,,,,,2,2,
|
||||
github.com/emicklei/go-restful,,7,,,,,,,,,,,,,,,,,7,,
|
||||
github.com/evanphx/json-patch,,,12,,,,,,,,,,,,,,,,,12,
|
||||
github.com/form3tech-oss/jwt-go,2,,,,2,,,,,,,,,,,,,,,,
|
||||
github.com/gin-gonic/gin,3,46,2,,,,3,,,,,,,,,,,,46,2,
|
||||
github.com/go-chi/chi,,3,,,,,,,,,,,,,,,,,3,,
|
||||
github.com/go-chi/jwtauth,1,,,,1,,,,,,,,,,,,,,,,
|
||||
github.com/go-jose/go-jose,3,,4,,2,1,,,,,,,,,,,,,,4,
|
||||
github.com/go-kit/kit/auth/jwt,1,,,,1,,,,,,,,,,,,,,,,
|
||||
github.com/go-pg/pg/orm,,,6,,,,,,,,,,,,,,,,,6,
|
||||
github.com/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
github.com/gobuffalo/envy,,7,,,,,,,,,,,,,,,7,,,,
|
||||
github.com/gobwas/ws,,2,,,,,,,,,,,,,,,,,2,,
|
||||
github.com/gofiber/fiber,5,,,,,,4,,,,,,,,1,,,,,,
|
||||
github.com/gogf/gf-jwt,1,,,,1,,,,,,,,,,,,,,,,
|
||||
github.com/going/toolkit/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
github.com/golang-jwt/jwt,3,,11,,2,1,,,,,,,,,,,,,,11,
|
||||
github.com/golang/protobuf/proto,,,4,,,,,,,,,,,,,,,,,4,
|
||||
github.com/gorilla/mux,,1,,,,,,,,,,,,,,,,,1,,
|
||||
github.com/gorilla/websocket,,3,,,,,,,,,,,,,,,,,3,,
|
||||
github.com/hashicorp/go-envparse,,1,,,,,,,,,,,,,,,1,,,,
|
||||
github.com/jbowtie/gokogiri/xml,4,,,,,,,,,,,,,,,4,,,,,
|
||||
github.com/jbowtie/gokogiri/xpath,1,,,,,,,,,,,,,,,1,,,,,
|
||||
github.com/joho/godotenv,,4,,,,,,,,,,,,,,,4,,,,
|
||||
github.com/json-iterator/go,,,4,,,,,,,,,,,,,,,,,4,
|
||||
github.com/kataras/iris/context,6,,,,,,6,,,,,,,,,,,,,,
|
||||
github.com/kataras/iris/middleware/jwt,2,,,,2,,,,,,,,,,,,,,,,
|
||||
github.com/kataras/iris/server/web/context,6,,,,,,6,,,,,,,,,,,,,,
|
||||
github.com/kataras/jwt,5,,,,5,,,,,,,,,,,,,,,,
|
||||
github.com/kelseyhightower/envconfig,,6,,,,,,,,,,,,,,,6,,,,
|
||||
github.com/labstack/echo,3,12,2,,,,2,,,,,,1,,,,,,12,2,
|
||||
github.com/lestrrat-go/jwx,2,,,,2,,,,,,,,,,,,,,,,
|
||||
github.com/lestrrat-go/libxml2/parser,3,,,,,,,,,,,,,,,3,,,,,
|
||||
github.com/lestrrat/go-jwx/jwk,1,,,,1,,,,,,,,,,,,,,,,
|
||||
github.com/masterzen/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
github.com/moovweb/gokogiri/xml,4,,,,,,,,,,,,,,,4,,,,,
|
||||
github.com/moovweb/gokogiri/xpath,1,,,,,,,,,,,,,,,1,,,,,
|
||||
github.com/ory/fosite/token/jwt,2,,,,2,,,,,,,,,,,,,,,,
|
||||
github.com/revel/revel,2,23,10,,,,1,,,,,,1,,,,,,23,10,
|
||||
github.com/robfig/revel,2,23,10,,,,1,,,,,,1,,,,,,23,10,
|
||||
github.com/santhosh-tekuri/xpathparser,2,,,,,,,,,,,,,,,2,,,,,
|
||||
github.com/sendgrid/sendgrid-go/helpers/mail,,,1,,,,,,,,,,,,,,,,,1,
|
||||
github.com/spf13/afero,34,,,,,,34,,,,,,,,,,,,,,
|
||||
github.com/square/go-jose,3,,4,,2,1,,,,,,,,,,,,,,4,
|
||||
github.com/valyala/fasthttp,35,50,5,,,,8,,,,17,8,2,,,,,,50,5,
|
||||
go.uber.org/zap,,,11,,,,,,,,,,,,,,,,,11,
|
||||
golang.org/x/crypto/ssh,4,,,4,,,,,,,,,,,,,,,,,
|
||||
golang.org/x/net/context,,,5,,,,,,,,,,,,,,,,,5,
|
||||
golang.org/x/net/html,,,16,,,,,,,,,,,,,,,,,16,
|
||||
golang.org/x/net/websocket,,2,,,,,,,,,,,,,,,,,2,,
|
||||
google.golang.org/protobuf/internal/encoding/text,,,1,,,,,,,,,,,,,,,,,1,
|
||||
google.golang.org/protobuf/internal/impl,,,2,,,,,,,,,,,,,,,,,2,
|
||||
google.golang.org/protobuf/proto,,,8,,,,,,,,,,,,,,,,,8,
|
||||
google.golang.org/protobuf/reflect/protoreflect,,,1,,,,,,,,,,,,,,,,,1,
|
||||
gopkg.in/couchbase/gocb,,,18,,,,,,,,,,,,,,,,,18,
|
||||
gopkg.in/go-jose/go-jose,3,,4,,2,1,,,,,,,,,,,,,,4,
|
||||
gopkg.in/go-xmlpath/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
gopkg.in/macaron,1,12,1,,,,,,,,,,,,1,,,,12,1,
|
||||
gopkg.in/square/go-jose,3,,4,,2,1,,,,,,,,,,,,,,4,
|
||||
gopkg.in/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
gopkg.in/yaml,,,9,,,,,,,,,,,,,,,,,9,
|
||||
html,,,8,,,,,,,,,,,,,,,,,8,
|
||||
io,5,4,34,,,,5,,,,,,,,,,,4,,34,
|
||||
k8s.io/api/core,,,10,,,,,,,,,,,,,,,,,10,
|
||||
k8s.io/apimachinery/pkg/runtime,,,47,,,,,,,,,,,,,,,,,47,
|
||||
launchpad.net/xmlpath,2,,,,,,,,,,,,,,,2,,,,,
|
||||
log,,,3,,,,,,,,,,,,,,,,,3,
|
||||
math/big,,,1,,,,,,,,,,,,,,,,,1,
|
||||
mime,,,14,,,,,,,,,,,,,,,,,14,
|
||||
net,2,16,100,,,,1,,,,,,,1,,,,,16,100,
|
||||
nhooyr.io/websocket,,2,,,,,,,,,,,,,,,,,2,,
|
||||
os,29,10,6,3,,,26,,,,,,,,,,7,3,,6,
|
||||
path,,,18,,,,,,,,,,,,,,,,,18,
|
||||
reflect,,,37,,,,,,,,,,,,,,,,,37,
|
||||
regexp,10,,20,,,,,3,3,4,,,,,,,,,,20,
|
||||
sort,,,1,,,,,,,,,,,,,,,,,1,
|
||||
strconv,,,9,,,,,,,,,,,,,,,,,9,
|
||||
strings,,,34,,,,,,,,,,,,,,,,,34,
|
||||
sync,,,34,,,,,,,,,,,,,,,,,34,
|
||||
syscall,5,2,8,5,,,,,,,,,,,,,2,,,8,
|
||||
text/scanner,,,3,,,,,,,,,,,,,,,,,3,
|
||||
text/tabwriter,,,1,,,,,,,,,,,,,,,,,1,
|
||||
text/template,,,6,,,,,,,,,,,,,,,,,6,
|
||||
|
||||
|
@@ -7,31 +7,39 @@ Go framework & library support
|
||||
:widths: auto
|
||||
|
||||
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total)
|
||||
`Afero <https://github.com/spf13/afero>`_,``github.com/spf13/afero*``,,,34
|
||||
`CleverGo <https://github.com/clevergo/clevergo>`_,"``clevergo.tech/clevergo*``, ``github.com/clevergo/clevergo*``",,,2
|
||||
`Couchbase official client(gocb) <https://github.com/couchbase/gocb>`_,"``github.com/couchbase/gocb*``, ``gopkg.in/couchbase/gocb*``",,36,
|
||||
`Couchbase unofficial client <http://www.github.com/couchbase/go-couchbase>`_,``github.com/couchbaselabs/gocb*``,,18,
|
||||
`Echo <https://echo.labstack.com/>`_,``github.com/labstack/echo*``,12,2,3
|
||||
`Fiber <https://github.com/gofiber/fiber>`_,``github.com/gofiber/fiber*``,,,5
|
||||
`Fosite <https://github.com/ory/fosite>`_,``github.com/ory/fosite*``,,,2
|
||||
`Gin <https://github.com/gin-gonic/gin>`_,``github.com/gin-gonic/gin*``,46,2,3
|
||||
`Glog <https://github.com/golang/glog>`_,"``github.com/golang/glog*``, ``gopkg.in/glog*``, ``k8s.io/klog*``",,,
|
||||
`Go JOSE <https://github.com/go-jose/go-jose>`_,"``github.com/go-jose/go-jose*``, ``github.com/square/go-jose*``, ``gopkg.in/square/go-jose*``, ``gopkg.in/go-jose/go-jose*``",,16,12
|
||||
`Go kit <https://gokit.io/>`_,``github.com/go-kit/kit*``,,,1
|
||||
`Go-spew <https://github.com/davecgh/go-spew>`_,``github.com/davecgh/go-spew/spew*``,,,
|
||||
`Gokogiri <https://github.com/moovweb/gokogiri>`_,"``github.com/jbowtie/gokogiri*``, ``github.com/moovweb/gokogiri*``",,,10
|
||||
`Iris <https://www.iris-go.com/>`_,``github.com/kataras/iris*``,,,14
|
||||
`Kubernetes <https://kubernetes.io/>`_,"``k8s.io/api*``, ``k8s.io/apimachinery*``",,57,
|
||||
`Logrus <https://github.com/sirupsen/logrus>`_,"``github.com/Sirupsen/logrus*``, ``github.com/sirupsen/logrus*``",,,
|
||||
`Macaron <https://gopkg.in/macaron.v1>`_,``gopkg.in/macaron*``,12,1,1
|
||||
`Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",46,20,4
|
||||
`SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
|
||||
`Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",16,584,74
|
||||
`Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",32,587,51
|
||||
`XPath <https://github.com/antchfx/xpath>`_,``github.com/antchfx/xpath*``,,,4
|
||||
`appleboy/gin-jwt <https://github.com/appleboy/gin-jwt>`_,``github.com/appleboy/gin-jwt*``,,,1
|
||||
`beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",63,63,123
|
||||
`beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",63,63,21
|
||||
`chi <https://go-chi.io/>`_,``github.com/go-chi/chi*``,3,,
|
||||
`cristalhq/jwt <https://github.com/cristalhq/jwt>`_,``github.com/cristalhq/jwt*``,,,1
|
||||
`fasthttp <https://github.com/valyala/fasthttp>`_,``github.com/valyala/fasthttp*``,50,5,35
|
||||
`gf-jwt <https://github.com/gogf/gf-jwt>`_,``github.com/gogf/gf-jwt*``,,,1
|
||||
`go-pg <https://pg.uptrace.dev/>`_,``github.com/go-pg/pg*``,,6,
|
||||
`go-restful <https://github.com/emicklei/go-restful>`_,``github.com/emicklei/go-restful*``,7,,
|
||||
`go-sh <https://github.com/codeskyblue/go-sh>`_,``github.com/codeskyblue/go-sh*``,,,4
|
||||
`golang.org/x/crypto/ssh <https://pkg.go.dev/golang.org/x/crypto/ssh>`_,``golang.org/x/crypto/ssh*``,,,4
|
||||
`golang.org/x/net <https://pkg.go.dev/golang.org/x/net>`_,``golang.org/x/net*``,2,21,
|
||||
`goproxy <https://github.com/elazarl/goproxy>`_,``github.com/elazarl/goproxy*``,2,2,2
|
||||
`goproxy <https://github.com/elazarl/goproxy>`_,``github.com/elazarl/goproxy*``,2,2,
|
||||
`gorilla/mux <https://github.com/gorilla/mux>`_,``github.com/gorilla/mux*``,1,,
|
||||
`gorilla/websocket <https://github.com/gorilla/websocket>`_,``github.com/gorilla/websocket*``,3,,
|
||||
`goxpath <https://github.com/ChrisTrenkamp/goxpath/wiki>`_,``github.com/ChrisTrenkamp/goxpath*``,,,3
|
||||
@@ -51,7 +59,7 @@ Go framework & library support
|
||||
`xmlquery <https://github.com/antchfx/xmlquery>`_,``github.com/antchfx/xmlquery*``,,,8
|
||||
`xpathparser <https://github.com/santhosh-tekuri/xpathparser>`_,``github.com/santhosh-tekuri/xpathparser*``,,,2
|
||||
`yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
|
||||
`zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,33
|
||||
Others,"``clevergo.tech/clevergo``, ``github.com/Sirupsen/logrus``, ``github.com/clevergo/clevergo``, ``github.com/codeskyblue/go-sh``, ``github.com/davecgh/go-spew/spew``, ``github.com/gofiber/fiber``, ``github.com/golang/glog``, ``github.com/sirupsen/logrus``, ``github.com/spf13/afero``, ``golang.org/x/crypto/ssh``, ``gopkg.in/glog``, ``k8s.io/klog``",,,564
|
||||
Totals,,267,906,943
|
||||
`zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,
|
||||
Others,"``github.com/caarlos0/env``, ``github.com/gobuffalo/envy``, ``github.com/hashicorp/go-envparse``, ``github.com/joho/godotenv``, ``github.com/kelseyhightower/envconfig``",23,2,
|
||||
Totals,,306,911,268
|
||||
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Local source models for reading and parsing environment variables have been added for the following libraries:
|
||||
* os
|
||||
* syscall
|
||||
* github.com/caarlos0/env
|
||||
* github.com/gobuffalo/envy
|
||||
* github.com/hashicorp/go-envparse
|
||||
* github.com/joho/godotenv
|
||||
* github.com/kelseyhightower/envconfig
|
||||
* Local source models have been added for the APIs which open files in the `io/fs`, `io/ioutil` and `os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
|
||||
@@ -1,17 +1,5 @@
|
||||
## 1.1.5
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Local source models for reading and parsing environment variables have been added for the following libraries:
|
||||
- os
|
||||
- syscall
|
||||
- github.com/caarlos0/env
|
||||
- github.com/gobuffalo/envy
|
||||
- github.com/hashicorp/go-envparse
|
||||
- github.com/joho/godotenv
|
||||
- github.com/kelseyhightower/envconfig
|
||||
* Local source models have been added for the APIs which open files in the `io/fs`, `io/ioutil` and `os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* Fixed an issue where `io/ioutil.WriteFile`'s non-path arguments incorrectly generated `go/path-injection` alerts when untrusted data was written to a file, or controlled the file's mode.
|
||||
|
||||
@@ -82,14 +82,14 @@ java.beans,,,193,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,193,
|
||||
java.io,66,1,256,,,,,,,,,22,,,,,,,,,,,,,,,44,,,,,,,,,,,,,,,,,,,,,,1,,249,7
|
||||
java.lang,38,3,756,,13,,,,,,1,,,,,,,,,,,,8,,,,11,,,4,,,1,,,,,,,,,,,,,,,3,,,681,75
|
||||
java.math,,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9
|
||||
java.net,23,3,278,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,,,,,,,,,,,,,,3,274,4
|
||||
java.nio,47,,361,,,,,,,,,5,,,,,,,,,,,,,,,41,,,,,,,,,1,,,,,,,,,,,,,,,259,102
|
||||
java.net,23,3,279,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,,,,,,,,,,,,,,3,275,4
|
||||
java.nio,47,,373,,,,,,,,,5,,,,,,,,,,,,,,,41,,,,,,,,,1,,,,,,,,,,,,,,,267,106
|
||||
java.rmi,,,71,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,71,
|
||||
java.security,21,,543,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,539,4
|
||||
java.security,21,,547,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,543,4
|
||||
java.sql,15,1,303,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,9,,,,,,,,,1,,,,303,
|
||||
java.text,,,134,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,134,
|
||||
java.time,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35,88
|
||||
java.util,48,2,1218,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,2,,,704,514
|
||||
java.util,48,2,1221,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,2,,,705,516
|
||||
javafx.scene.web,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
|
||||
javax.accessibility,,,31,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,31,
|
||||
javax.activation,2,,7,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,7,
|
||||
@@ -102,7 +102,7 @@ javax.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
|
||||
javax.lang.model.element,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,
|
||||
javax.lang.model.type,,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,
|
||||
javax.lang.model.util,,,68,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,68,
|
||||
javax.management,2,,799,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,798,1
|
||||
javax.management,2,,802,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,801,1
|
||||
javax.naming,7,,324,,,,,,,,,,,,,,,,,6,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,318,6
|
||||
javax.net,4,,86,,,,2,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,86,
|
||||
javax.portlet,1,,61,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,61,
|
||||
@@ -192,6 +192,7 @@ org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,57,
|
||||
org.apache.ibatis.mapping,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
|
||||
org.apache.log4j,11,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
|
||||
org.apache.logging.log4j,359,,8,,,,,,,,,,,,,,,,,,,,359,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,4
|
||||
org.apache.shiro.authc,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
|
||||
org.apache.shiro.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
|
||||
org.apache.shiro.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
|
||||
org.apache.shiro.mgt,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
|
||||
|
||||
|
@@ -18,10 +18,10 @@ Java framework & library support
|
||||
`Google Guava <https://guava.dev/>`_,``com.google.common.*``,,730,43,9,,,,,
|
||||
JBoss Logging,``org.jboss.logging``,,,324,,,,,,
|
||||
`JSON-java <https://github.com/stleary/JSON-java>`_,``org.json``,,236,,,,,,,
|
||||
Java Standard Library,``java.*``,10,4264,259,99,,9,,,26
|
||||
Java extensions,"``javax.*``, ``jakarta.*``",69,3257,90,10,4,2,1,1,4
|
||||
Java Standard Library,``java.*``,10,4284,259,99,,9,,,26
|
||||
Java extensions,"``javax.*``, ``jakarta.*``",69,3260,90,10,4,2,1,1,4
|
||||
Kotlin Standard Library,``kotlin*``,,1849,16,14,,,,,2
|
||||
`Spring <https://spring.io/>`_,``org.springframework.*``,38,486,143,26,,28,14,,35
|
||||
Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.google.gson``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.mongodb``, ``com.opensymphony.xwork2``, ``com.rabbitmq.client``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.text``, ``groovy.util``, ``hudson``, ``io.jsonwebtoken``, ``io.netty.bootstrap``, ``io.netty.buffer``, ``io.netty.channel``, ``io.netty.handler.codec``, ``io.netty.handler.ssl``, ``io.netty.handler.stream``, ``io.netty.resolver``, ``io.netty.util``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.struts.beanvalidation.validation.interceptor``, ``org.apache.struts2``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.cargo.container.installer``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.eclipse.jetty.client``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.hibernate``, ``org.influxdb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.jooq``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.w3c.dom``, ``org.xml.sax``, ``org.xmlpull.v1``, ``org.yaml.snakeyaml``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.awt``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.management.spi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.nio.ch``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``, ``sun.util.logging.internal``",132,10603,908,140,6,22,18,,208
|
||||
Totals,,311,25147,2635,404,16,128,33,1,409
|
||||
Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.fasterxml.jackson.core``, ``com.fasterxml.jackson.databind``, ``com.google.gson``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.mongodb``, ``com.opensymphony.xwork2``, ``com.rabbitmq.client``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``freemarker.cache``, ``freemarker.template``, ``groovy.lang``, ``groovy.text``, ``groovy.util``, ``hudson``, ``io.jsonwebtoken``, ``io.netty.bootstrap``, ``io.netty.buffer``, ``io.netty.channel``, ``io.netty.handler.codec``, ``io.netty.handler.ssl``, ``io.netty.handler.stream``, ``io.netty.resolver``, ``io.netty.util``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``okhttp3``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.struts.beanvalidation.validation.interceptor``, ``org.apache.struts2``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.apache.velocity.app``, ``org.apache.velocity.runtime``, ``org.codehaus.cargo.container.installer``, ``org.codehaus.groovy.control``, ``org.dom4j``, ``org.eclipse.jetty.client``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.hibernate``, ``org.influxdb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.jooq``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.slf4j``, ``org.thymeleaf``, ``org.w3c.dom``, ``org.xml.sax``, ``org.xmlpull.v1``, ``org.yaml.snakeyaml``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``retrofit2``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.awt``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.management.spi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.nio.ch``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``, ``sun.util.logging.internal``",133,10603,908,140,6,22,18,,208
|
||||
Totals,,312,25170,2635,404,16,128,33,1,409
|
||||
|
||||
|
||||
@@ -298,7 +298,7 @@ signature module InputSig<LocationSig Location> {
|
||||
/** Extra data-flow steps needed for lambda flow analysis. */
|
||||
predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue);
|
||||
|
||||
predicate knownSourceModel(Node sink, string model);
|
||||
predicate knownSourceModel(Node source, string model);
|
||||
|
||||
predicate knownSinkModel(Node sink, string model);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user