hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 14:23:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Restrict 'package' to real package paths

Browse Source
This commit is contained in:
Sauyon Lee
2021-03-05 03:40:59 -08:00
parent fecf265641
commit 8ad1010860
5 changed files with 18 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ql/src/semmle/go/Packages.qll
View File

@@ -32,9 +32,10 @@ class Package extends @package {
* For example, `package("github.com/go-pg/pg", "types")` gets an import path that can
* refer to `"github.com/go-pg/pg/types"`, but also to `"github.com/go-pg/pg/v10/types"`.
*/
bindingset[result, mod, path]
bindingset[mod, path]
string package(string mod, string path) {
// "\Q" and "\E" start and end a quoted section of a regular expression. Anything like "." or "*" that
// "*" that comes between them is not interpreted as it would normally be in a regular expression.
result.regexpMatch("\\Q" + mod + "\\E([/.]v[^/]+)?($|/)\\Q" + path + "\\E")
result.regexpMatch("\\Q" + mod + "\\E([/.]v[^/]+)?($|/)\\Q" + path + "\\E") and
result = any(Package p).getPath()
}

2
ql/test/library-tests/semmle/go/Packages/main.go
View File

@@ -4,6 +4,8 @@ import (
"fmt"
"github.com/nonexistent-test-pkg"
"github.com/nonexistent/test"
test2 "github.com/nonexistent/v2/test"
)
func main() {

22
ql/test/library-tests/semmle/go/Packages/package.ql
View File

@@ -3,16 +3,16 @@ import go
from string path
where
(
path = "PackageName/v2/test" or // OK
path = "PackageName/test" or // OK
path = "PackageName//v//test" or // NOT OK
path = "PackageName//v/test" or // NOT OK
path = "PackageName/v//test" or // NOT OK
path = "PackageName/v/asd/v2/test" or // NOT OK
path = "PackageName/v/test" or // NOT OK
path = "PackageName//v2//test" or // NOT OK
path = "PackageName//v2/test" or // NOT OK
path = "PackageName/v2//test" // NOT OK
path = "github.com/nonexistent/v2/test" or // OK
path = "github.com/nonexistent/test" or // OK
path = "github.com/nonexistent//v//test" or // NOT OK
path = "github.com/nonexistent//v/test" or // NOT OK
path = "github.com/nonexistent/v//test" or // NOT OK
path = "github.com/nonexistent/v/asd/v2/test" or // NOT OK
path = "github.com/nonexistent/v/test" or // NOT OK
path = "github.com/nonexistent//v2//test" or // NOT OK
path = "github.com/nonexistent//v2/test" or // NOT OK
path = "github.com/nonexistent/v2//test" // NOT OK
) and
path = package("PackageName", "test")
path = package("github.com/nonexistent", "test")
select path

1
ql/test/library-tests/semmle/go/Packages/vendor/github.com/nonexistent/test/stub.go generated vendored Normal file
View File

@@ -0,0 +1 @@
package test

1
ql/test/library-tests/semmle/go/Packages/vendor/github.com/nonexistent/v2/test/stub.go generated vendored Normal file
View File

@@ -0,0 +1 @@
package test