From 1cf626f7123b9a402b8d5d715f3e7e2006fae858 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 19 Apr 2023 10:50:50 +0100 Subject: [PATCH 1/2] Use latest patch version of Go 1.20 for tests --- .github/workflows/go-tests-other-os.yml | 4 ++-- .github/workflows/go-tests.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/go-tests-other-os.yml b/.github/workflows/go-tests-other-os.yml index 5660b2cc3fa..74dd3639704 100644 --- a/.github/workflows/go-tests-other-os.yml +++ b/.github/workflows/go-tests-other-os.yml @@ -15,7 +15,7 @@ jobs: - name: Set up Go 1.20 uses: actions/setup-go@v4 with: - go-version: 1.20.0 + go-version: '1.20' id: go - name: Check out code @@ -50,7 +50,7 @@ jobs: - name: Set up Go 1.20 uses: actions/setup-go@v4 with: - go-version: 1.20.0 + go-version: '1.20' id: go - name: Check out code diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml index 064c0896e14..e790554c625 100644 --- a/.github/workflows/go-tests.yml +++ b/.github/workflows/go-tests.yml @@ -23,7 +23,7 @@ jobs: - name: Set up Go 1.20 uses: actions/setup-go@v4 with: - go-version: 1.20.0 + go-version: '1.20' id: go - name: Check out code From 2914480ff65e494cdfbef5f177d592b35698b727 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 19 Apr 2023 10:29:27 +0100 Subject: [PATCH 2/2] Avoid platform-specific results These were introduced in https://github.com/github/codeql/pull/12750 but the relevant tests that should have caught it weren't run. --- .../dataflow/FlowSteps/LocalTaintStep.expected | 3 --- .../go/dataflow/FlowSteps/LocalTaintStep.ql | 14 +++++++++++++- .../go/frameworks/TaintSteps/TaintStep.expected | 6 +----- .../go/frameworks/TaintSteps/TaintStep.ql | 17 ++++++++++++++++- 4 files changed, 30 insertions(+), 10 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected b/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected index a5be0fa2d73..54091adf7d1 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected @@ -73,7 +73,6 @@ | file://:0:0:0:0 | parameter 0 of Store | file://:0:0:0:0 | [summary] to write: argument -1 in Store | | file://:0:0:0:0 | parameter 0 of StringBytePtr | file://:0:0:0:0 | [summary] to write: return (return[0]) in StringBytePtr | | file://:0:0:0:0 | parameter 0 of StringByteSlice | file://:0:0:0:0 | [summary] to write: return (return[0]) in StringByteSlice | -| file://:0:0:0:0 | parameter 0 of StringSlicePtr | file://:0:0:0:0 | [summary] to write: return (return[0]) in StringSlicePtr | | file://:0:0:0:0 | parameter 0 of Sub | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sub | | file://:0:0:0:0 | parameter 0 of Swap | file://:0:0:0:0 | [summary] to write: argument -1 in Swap | | file://:0:0:0:0 | parameter 0 of Swap | file://:0:0:0:0 | [summary] to write: argument -1 in Swap | @@ -184,7 +183,6 @@ | file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | | file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | | file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | -| file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | | file://:0:0:0:0 | parameter -1 of Interface | file://:0:0:0:0 | [summary] to write: return (return[0]) in Interface | | file://:0:0:0:0 | parameter -1 of InterfaceData | file://:0:0:0:0 | [summary] to write: return (return[0]) in InterfaceData | | file://:0:0:0:0 | parameter -1 of Key | file://:0:0:0:0 | [summary] to write: return (return[0]) in Key | @@ -203,7 +201,6 @@ | file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | | file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | | file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | -| file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | | file://:0:0:0:0 | parameter -1 of Open | file://:0:0:0:0 | [summary] to write: return (return[0]) in Open | | file://:0:0:0:0 | parameter -1 of Open | file://:0:0:0:0 | [summary] to write: return (return[0]) in Open | | file://:0:0:0:0 | parameter -1 of Open | file://:0:0:0:0 | [summary] to write: return (return[0]) in Open | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.ql b/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.ql index f9f3b594542..1f920b6b241 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.ql @@ -4,5 +4,17 @@ from DataFlow::Node nd, DataFlow::Node succ where TaintTracking::localTaintStep(nd, succ) and // exclude data-flow steps - not DataFlow::localFlowStep(nd, succ) + not DataFlow::localFlowStep(nd, succ) and + // Exclude results which only appear on unix to avoid platform-specific results + not exists(string pkg, string name | + nd.(DataFlow::SummarizedParameterNode) + .getCallable() + .asSummarizedCallable() + .asFunction() + .hasQualifiedName(pkg, name) + | + pkg = "syscall" and name = "StringSlicePtr" + or + pkg = ["os.dirEntry", "os.unixDirent"] and name = ["Info", "Name"] + ) select nd, succ diff --git a/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected b/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected index 4d86bb15d4a..325c5c60a36 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected +++ b/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected @@ -191,7 +191,6 @@ | file://:0:0:0:0 | parameter 0 of Store | file://:0:0:0:0 | [summary] to write: argument -1 in Store | | file://:0:0:0:0 | parameter 0 of StringBytePtr | file://:0:0:0:0 | [summary] to write: return (return[0]) in StringBytePtr | | file://:0:0:0:0 | parameter 0 of StringByteSlice | file://:0:0:0:0 | [summary] to write: return (return[0]) in StringByteSlice | -| file://:0:0:0:0 | parameter 0 of StringSlicePtr | file://:0:0:0:0 | [summary] to write: return (return[0]) in StringSlicePtr | | file://:0:0:0:0 | parameter 0 of Sub | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sub | | file://:0:0:0:0 | parameter 0 of Swap | file://:0:0:0:0 | [summary] to write: argument -1 in Swap | | file://:0:0:0:0 | parameter 0 of Swap | file://:0:0:0:0 | [summary] to write: argument -1 in Swap | @@ -338,6 +337,7 @@ | file://:0:0:0:0 | parameter 0 of Write | file://:0:0:0:0 | [summary] to write: argument -1 in Write | | file://:0:0:0:0 | parameter 0 of Write | file://:0:0:0:0 | [summary] to write: argument -1 in Write | | file://:0:0:0:0 | parameter 0 of Write | file://:0:0:0:0 | [summary] to write: argument -1 in Write | +| file://:0:0:0:0 | parameter 0 of Write | file://:0:0:0:0 | [summary] to write: argument -1 in Write | | file://:0:0:0:0 | parameter 0 of WriteAt | file://:0:0:0:0 | [summary] to write: argument -1 in WriteAt | | file://:0:0:0:0 | parameter 0 of WriteAt | file://:0:0:0:0 | [summary] to write: argument -1 in WriteAt | | file://:0:0:0:0 | parameter 0 of WriteAt | file://:0:0:0:0 | [summary] to write: argument -1 in WriteAt | @@ -537,7 +537,6 @@ | file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | | file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | | file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | -| file://:0:0:0:0 | parameter -1 of Info | file://:0:0:0:0 | [summary] to write: return (return[0]) in Info | | file://:0:0:0:0 | parameter -1 of Init | file://:0:0:0:0 | [summary] to write: return (return[0]) in Init | | file://:0:0:0:0 | parameter -1 of Interface | file://:0:0:0:0 | [summary] to write: return (return[0]) in Interface | | file://:0:0:0:0 | parameter -1 of InterfaceData | file://:0:0:0:0 | [summary] to write: return (return[0]) in InterfaceData | @@ -583,7 +582,6 @@ | file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | | file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | | file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | -| file://:0:0:0:0 | parameter -1 of Name | file://:0:0:0:0 | [summary] to write: return (return[0]) in Name | | file://:0:0:0:0 | parameter -1 of Next | file://:0:0:0:0 | [summary] to write: return (return[0]) in Next | | file://:0:0:0:0 | parameter -1 of Next | file://:0:0:0:0 | [summary] to write: return (return[0]) in Next | | file://:0:0:0:0 | parameter -1 of NextPart | file://:0:0:0:0 | [summary] to write: return (return[0]) in NextPart | @@ -673,8 +671,6 @@ | file://:0:0:0:0 | parameter -1 of Read | file://:0:0:0:0 | [summary] to write: argument 0 in Read | | file://:0:0:0:0 | parameter -1 of Read | file://:0:0:0:0 | [summary] to write: argument 0 in Read | | file://:0:0:0:0 | parameter -1 of Read | file://:0:0:0:0 | [summary] to write: argument 0 in Read | -| file://:0:0:0:0 | parameter -1 of Read | file://:0:0:0:0 | [summary] to write: argument 0 in Read | -| file://:0:0:0:0 | parameter -1 of Read | file://:0:0:0:0 | [summary] to write: argument 0 in Read | | file://:0:0:0:0 | parameter -1 of ReadAt | file://:0:0:0:0 | [summary] to write: argument 0 in ReadAt | | file://:0:0:0:0 | parameter -1 of ReadAt | file://:0:0:0:0 | [summary] to write: argument 0 in ReadAt | | file://:0:0:0:0 | parameter -1 of ReadAt | file://:0:0:0:0 | [summary] to write: argument 0 in ReadAt | diff --git a/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.ql b/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.ql index 2016803c693..0ff6ee875de 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.ql +++ b/go/ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.ql @@ -3,5 +3,20 @@ import go from DataFlow::Node pred, DataFlow::Node succ where TaintTracking::localTaintStep(pred, succ) and - not DataFlow::localFlowStep(pred, succ) + not DataFlow::localFlowStep(pred, succ) and + // Exclude results which only appear on unix to avoid platform-specific results + not exists(string pkg, string name | + pred.(DataFlow::SummarizedParameterNode) + .getCallable() + .asSummarizedCallable() + .asFunction() + .hasQualifiedName(pkg, name) + | + pkg = "syscall" and name = "StringSlicePtr" + or + pkg.matches("crypto/rand.%") and + name = "Read" + or + pkg = ["os.dirEntry", "os.unixDirent"] and name = ["Info", "Name"] + ) select pred, succ