From a7ecb50a34055d2deeda301ff387be7af5474a07 Mon Sep 17 00:00:00 2001 From: Max Schaefer Date: Fri, 6 Mar 2020 09:35:03 +0000 Subject: [PATCH] Add taint-tracking model for `append`. --- ql/src/semmle/go/frameworks/Stdlib.qll | 12 ++++++++++++ .../go/dataflow/FlowSteps/LocalTaintStep.expected | 6 ++++++ 2 files changed, 18 insertions(+) diff --git a/ql/src/semmle/go/frameworks/Stdlib.qll b/ql/src/semmle/go/frameworks/Stdlib.qll index 2db3187bda8..63d66ad5778 100644 --- a/ql/src/semmle/go/frameworks/Stdlib.qll +++ b/ql/src/semmle/go/frameworks/Stdlib.qll @@ -13,6 +13,18 @@ class StringMethod extends TaintTracking::FunctionModel, Method { } } +/** + * A model of the built-in `append` function, which propagates taint from its arguments to its + * result. + */ +private class AppendFunction extends TaintTracking::FunctionModel { + AppendFunction() { this = Builtin::append() } + + override predicate hasTaintFlow(DataFlow::FunctionInput inp, DataFlow::FunctionOutput outp) { + inp.isParameter(_) and outp.isResult() + } +} + /** * A model of the built-in `copy` function, which propagates taint from its second argument * to its first. diff --git a/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected b/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected index 41f7601cc38..405933d23b1 100644 --- a/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected +++ b/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected @@ -1,5 +1,11 @@ | main.go:26:11:26:17 | type assertion | main.go:26:2:26:17 | ... := ...[0] | | main.go:26:11:26:17 | type assertion | main.go:26:2:26:17 | ... := ...[1] | +| main.go:39:15:39:15 | s | main.go:39:8:39:25 | call to append | +| main.go:39:18:39:18 | 4 | main.go:39:8:39:25 | call to append | +| main.go:39:21:39:21 | 5 | main.go:39:8:39:25 | call to append | +| main.go:39:24:39:24 | 6 | main.go:39:8:39:25 | call to append | +| main.go:40:15:40:15 | s | main.go:40:8:40:23 | call to append | +| main.go:40:18:40:19 | s1 | main.go:40:8:40:23 | call to append | | main.go:42:10:42:11 | s4 | main.go:38:2:38:2 | definition of s | | strings.go:9:24:9:24 | s | strings.go:9:8:9:38 | call to Replace | | strings.go:9:32:9:34 | "_" | strings.go:9:8:9:38 | call to Replace |