hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update rules

Browse Source
This commit is contained in:
Yunus AYDIN
2023-12-13 20:01:53 +03:00
parent 5148054612
commit a09505afc2
3 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
go/ql/src/experimental/CWE-525/WebCacheDeception.ql
View File

@@ -14,5 +14,4 @@ import go
import WebCacheDeceptionLib
from WebCacheDeception::Sink httpHandleFuncCall
select httpHandleFuncCall, "$@ is used as wildcard endpoint.", httpHandleFuncCall.getNode(),
"Web Cache Deception"
select httpHandleFuncCall, httpHandleFuncCall + " is used as wildcard endpoint."

4
go/ql/src/experimental/CWE-525/WebCacheDeceptionLib.qll
View File

@@ -26,7 +26,7 @@ module WebCacheDeception {
i.getPath() = "github.com/gofiber/fiber" or
i.getPath() = "github.com/gofiber/fiber/v2"
|
exists(DataFlow::MethodCallNode m |
exists(DataFlow::CallNode m |
m.getCall().getArgument(0).toString().matches("%/*%") and
this = m.getArgument(0)
)
@@ -40,7 +40,7 @@ module WebCacheDeception {
i.getPath() = "github.com/go-chi/chi/v5" or
i.getPath() = "github.com/go-chi/chi/v5/middleware"
|
exists(DataFlow::MethodCallNode m |
exists(DataFlow::CallNode m |
m.getCall().getArgument(0).toString().matches("%/*%") and
this = m.getArgument(0)
)

8
go/ql/test/experimental/CWE-525/WebCacheDeception.expected
View File

@@ -1,4 +1,4 @@
edges
nodes
subpaths
#select
| WebCacheDeceptionBad.go:82:18:82:31 | "/adminusers/" | "/adminusers/" is used as wildcard endpoint. |
| WebCacheDeceptionFiber.go:15:10:15:17 | "/api/*" | "/api/*" is used as wildcard endpoint. |
| WebCacheDeceptionFiber.go:20:11:20:18 | "/api/*" | "/api/*" is used as wildcard endpoint. |
| WebCacheDeceptionGoChi.go:13:8:13:11 | "/*" | "/*" is used as wildcard endpoint. |