hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix IncorrectIntegerConversion for use-use flow

Browse Source 
We were assuming that `sink` only had one successor, the TypeCastNode, but it
can now have an adjacent use as well.
This commit is contained in:
Owen Mansel-Chan
2023-11-30 21:23:22 +00:00
parent b2a9cecd69
commit 9068315f03
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll
View File

@@ -290,13 +290,17 @@ private predicate integerTypeBound(IntegerType it, int bitSize, int architecture
* the type assertion succeeded. If it is not checked then there will be a
* run-time panic if the type assertion fails, so we can assume it succeeded.
*/
class TypeAssertionCheck extends DataFlow::ExprNode, FlowStateTransformer {
class TypeAssertionCheck extends DataFlow::InstructionNode, FlowStateTransformer {
IntegerType it;
TypeAssertionCheck() {
exists(TypeAssertExpr tae |
this = DataFlow::exprNode(tae.getExpr()) and
it = tae.getTypeExpr().getType().getUnderlyingType()
exists(IR::Instruction evalAssert, TypeAssertExpr assert |
it = assert.getTypeExpr().getType().getUnderlyingType() and
evalAssert = IR::evalExprInstruction(assert)
|
if exists(IR::extractTupleElement(evalAssert, _))
then this.asInstruction() = IR::extractTupleElement(evalAssert, 0)
else this.asInstruction() = evalAssert
)
}

3
go/ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.ql
View File

@@ -18,7 +18,8 @@ import semmle.go.security.IncorrectIntegerConversionLib
import Flow::PathGraph
from
Flow::PathNode source, Flow::PathNode sink, DataFlow::CallNode call, DataFlow::Node sinkConverted
Flow::PathNode source, Flow::PathNode sink, DataFlow::CallNode call,
DataFlow::TypeCastNode sinkConverted
where
Flow::flowPath(source, sink) and
call.getResult(0) = source.getNode() and