hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make header Get and Values calls into taint steps

Browse Source
This commit is contained in:
Sauyon Lee
2020-03-24 02:52:09 -07:00
parent 83a417f52e
commit 49aa43bd49
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ql/src/semmle/go/frameworks/HTTP.qll
View File

@@ -15,12 +15,20 @@ private module StdlibHttp {
}
}
private class HeaderGetCall extends UntrustedFlowSource::Range, DataFlow::MethodCallNode {
HeaderGetCall() { this.getTarget().hasQualifiedName("net/http", "Header", "Get") }
private class HeaderGet extends TaintTracking::FunctionModel, Method {
HeaderGet() { this.hasQualifiedName("net/http", "Header", "Get") }
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
inp.isReceiver() and outp.isResult()
}
}
private class HeaderValuesCall extends UntrustedFlowSource::Range, DataFlow::MethodCallNode {
HeaderValuesCall() { this.getTarget().hasQualifiedName("net/http", "Header", "Values") }
private class HeaderValues extends TaintTracking::FunctionModel, Method {
HeaderValues() { this.hasQualifiedName("net/http", "Header", "Values") }
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
inp.isReceiver() and outp.isResult()
}
}
private class StdlibResponseWriter extends HTTP::ResponseWriter::Range {