From 62ccceb543600f54ccd87124ddefe9dbc26e9fa2 Mon Sep 17 00:00:00 2001 From: Slavomir Date: Wed, 1 Jul 2020 12:16:40 +0300 Subject: [PATCH] Apply suggestions from code review Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com> --- ql/src/experimental/Unsafe/WrongUsageOfUnsafe.qhelp | 4 ++-- ql/src/experimental/Unsafe/WrongUsageOfUnsafe.ql | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.qhelp b/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.qhelp index afe4e52de95..9c2ab6b3686 100644 --- a/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.qhelp +++ b/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.qhelp @@ -5,7 +5,7 @@

The package `unsafe` provides operations that step outside the type safety - guarantees normally provided inside Golang programs. This leaves room for + guarantees normally provided inside Go programs. This leaves room for errors in the usage of the `unsafe` package that are not caught by the compiler.

@@ -16,7 +16,7 @@

- The basic recomendation is to avoid usage of the package `unsafe`. If that is + The basic recommendation is to avoid usage of the package `unsafe`. If that is not an option, you should always check the size of types you cast your data to/from to make sure they won't result in reading outside of the intended bounds.

diff --git a/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.ql b/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.ql index 9fd294f8b12..2c66c35eee5 100644 --- a/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.ql +++ b/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.ql @@ -105,7 +105,7 @@ predicate castTypeToArray(DataFlow::PathNode source, DataFlow::PathNode sink, st cfg.isSource(source.getNode(), castLittle) and cfg.isSink(sink.getNode(), castBig) and arrTo = getFinalType(castBig.getTypeExpr().getType()) and - not (typeFrom instanceof ArrayType or typeFrom.getUnderlyingType() instanceof ArrayType) and + not typeFrom.getUnderlyingType() instanceof ArrayType and not typeFrom instanceof PointerType and not castLittle.getOperand().getChildExpr(0).(IndexExpr).getBase().getType() instanceof ArrayType and typeFrom = getFinalType(castLittle.getOperand().getType()) and