hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 00:35:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10026 from pwntester/patch-2

Browse Source 
Go: Partial URLs should not sanitize against SSRF
This commit is contained in:
Owen Mansel-Chan
2023-04-14 13:52:11 +01:00
committed by GitHub
parent cece307c60 352866b52d
commit 8a4ca7fb84
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
go/ql/lib/change-notes/2023-04-14-partial-URLs-should-not-sanitize-against-SSRF.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Taking a slice is now considered a sanitizer for `SafeUrlFlow`.

5
go/ql/lib/semmle/go/security/SafeUrlFlowCustomizations.qll
View File

@@ -35,4 +35,9 @@ module SafeUrlFlow {
private class UnsafeUrlMethodEdge extends SanitizerEdge {
UnsafeUrlMethodEdge() { this = any(UnsafeUrlMethod um).getACall().getReceiver() }
}
/** Any slicing of the URL, considered as a sanitizer for safe URL flow. */
private class StringSlicingEdge extends SanitizerEdge {
StringSlicingEdge() { this = any(DataFlow::SliceNode sn) }
}
}