mirror of
https://github.com/github/codeql.git
synced 2026-05-03 04:39:29 +02:00
Add taint-tracking for encoding/xml
This commit is contained in:
Slavomir
@@ -26,6 +26,7 @@ import semmle.go.frameworks.stdlib.EncodingGob
|
||||
import semmle.go.frameworks.stdlib.EncodingHex
|
||||
import semmle.go.frameworks.stdlib.EncodingJson
|
||||
import semmle.go.frameworks.stdlib.EncodingPem
|
||||
import semmle.go.frameworks.stdlib.EncodingXml
|
||||
import semmle.go.frameworks.stdlib.Path
|
||||
import semmle.go.frameworks.stdlib.PathFilepath
|
||||
import semmle.go.frameworks.stdlib.Reflect
|
||||
|
||||
130
ql/src/semmle/go/frameworks/stdlib/EncodingXml.qll
Normal file
130
ql/src/semmle/go/frameworks/stdlib/EncodingXml.qll
Normal file
@@ -0,0 +1,130 @@
|
||||
/**
|
||||
* Provides classes modeling security-relevant aspects of the `encoding/xml` package.
|
||||
*/
|
||||
|
||||
import go
|
||||
|
||||
/** Provides models of commonly used functions in the `encoding/xml` package. */
|
||||
module EncodingXml {
|
||||
private class FunctionModels extends TaintTracking::FunctionModel {
|
||||
FunctionInput inp;
|
||||
FunctionOutput outp;
|
||||
|
||||
FunctionModels() {
|
||||
// signature: func CopyToken(t Token) Token
|
||||
hasQualifiedName("encoding/xml", "CopyToken") and
|
||||
(inp.isParameter(0) and outp.isResult())
|
||||
or
|
||||
// signature: func Escape(w io.Writer, s []byte)
|
||||
hasQualifiedName("encoding/xml", "Escape") and
|
||||
(inp.isParameter(1) and outp.isParameter(0))
|
||||
or
|
||||
// signature: func EscapeText(w io.Writer, s []byte) error
|
||||
hasQualifiedName("encoding/xml", "EscapeText") and
|
||||
(inp.isParameter(1) and outp.isParameter(0))
|
||||
or
|
||||
// signature: func Marshal(v interface{}) ([]byte, error)
|
||||
hasQualifiedName("encoding/xml", "Marshal") and
|
||||
(inp.isParameter(0) and outp.isResult(0))
|
||||
or
|
||||
// signature: func MarshalIndent(v interface{}, prefix string, indent string) ([]byte, error)
|
||||
hasQualifiedName("encoding/xml", "MarshalIndent") and
|
||||
(inp.isParameter(_) and outp.isResult(0))
|
||||
or
|
||||
// signature: func NewDecoder(r io.Reader) *Decoder
|
||||
hasQualifiedName("encoding/xml", "NewDecoder") and
|
||||
(inp.isParameter(0) and outp.isResult())
|
||||
or
|
||||
// signature: func NewEncoder(w io.Writer) *Encoder
|
||||
hasQualifiedName("encoding/xml", "NewEncoder") and
|
||||
(inp.isResult() and outp.isParameter(0))
|
||||
or
|
||||
// signature: func NewTokenDecoder(t TokenReader) *Decoder
|
||||
hasQualifiedName("encoding/xml", "NewTokenDecoder") and
|
||||
(inp.isParameter(0) and outp.isResult())
|
||||
or
|
||||
// signature: func Unmarshal(data []byte, v interface{}) error
|
||||
hasQualifiedName("encoding/xml", "Unmarshal") and
|
||||
(inp.isParameter(0) and outp.isParameter(1))
|
||||
}
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
input = inp and output = outp
|
||||
}
|
||||
}
|
||||
|
||||
private class MethodModels extends TaintTracking::FunctionModel, Method {
|
||||
FunctionInput inp;
|
||||
FunctionOutput outp;
|
||||
|
||||
MethodModels() {
|
||||
// signature: func (CharData).Copy() CharData
|
||||
this.hasQualifiedName("encoding/xml", "CharData", "Copy") and
|
||||
(inp.isReceiver() and outp.isResult())
|
||||
or
|
||||
// signature: func (Comment).Copy() Comment
|
||||
this.hasQualifiedName("encoding/xml", "Comment", "Copy") and
|
||||
(inp.isReceiver() and outp.isResult())
|
||||
or
|
||||
// signature: func (*Decoder).Decode(v interface{}) error
|
||||
this.hasQualifiedName("encoding/xml", "Decoder", "Decode") and
|
||||
(inp.isReceiver() and outp.isParameter(0))
|
||||
or
|
||||
// signature: func (*Decoder).DecodeElement(v interface{}, start *StartElement) error
|
||||
this.hasQualifiedName("encoding/xml", "Decoder", "DecodeElement") and
|
||||
(inp.isReceiver() and outp.isParameter(0))
|
||||
or
|
||||
// signature: func (*Decoder).RawToken() (Token, error)
|
||||
this.hasQualifiedName("encoding/xml", "Decoder", "RawToken") and
|
||||
(inp.isReceiver() and outp.isResult(0))
|
||||
or
|
||||
// signature: func (*Decoder).Token() (Token, error)
|
||||
this.hasQualifiedName("encoding/xml", "Decoder", "Token") and
|
||||
(inp.isReceiver() and outp.isResult(0))
|
||||
or
|
||||
// signature: func (Directive).Copy() Directive
|
||||
this.hasQualifiedName("encoding/xml", "Directive", "Copy") and
|
||||
(inp.isReceiver() and outp.isResult())
|
||||
or
|
||||
// signature: func (*Encoder).Encode(v interface{}) error
|
||||
this.hasQualifiedName("encoding/xml", "Encoder", "Encode") and
|
||||
(inp.isParameter(0) and outp.isReceiver())
|
||||
or
|
||||
// signature: func (*Encoder).EncodeElement(v interface{}, start StartElement) error
|
||||
this.hasQualifiedName("encoding/xml", "Encoder", "EncodeElement") and
|
||||
(inp.isParameter(0) and outp.isReceiver())
|
||||
or
|
||||
// signature: func (*Encoder).EncodeToken(t Token) error
|
||||
this.hasQualifiedName("encoding/xml", "Encoder", "EncodeToken") and
|
||||
(inp.isParameter(0) and outp.isReceiver())
|
||||
or
|
||||
// signature: func (*Encoder).Indent(prefix string, indent string)
|
||||
this.hasQualifiedName("encoding/xml", "Encoder", "Indent") and
|
||||
(inp.isParameter(_) and outp.isReceiver())
|
||||
or
|
||||
// signature: func (ProcInst).Copy() ProcInst
|
||||
this.hasQualifiedName("encoding/xml", "ProcInst", "Copy") and
|
||||
(inp.isReceiver() and outp.isResult())
|
||||
or
|
||||
// signature: func (StartElement).Copy() StartElement
|
||||
this.hasQualifiedName("encoding/xml", "StartElement", "Copy") and
|
||||
(inp.isReceiver() and outp.isResult())
|
||||
or
|
||||
// signature: func (Marshaler).MarshalXML(e *Encoder, start StartElement) error
|
||||
this.implements("encoding/xml", "Marshaler", "MarshalXML") and
|
||||
(inp.isReceiver() and outp.isParameter(0))
|
||||
or
|
||||
// signature: func (TokenReader).Token() (Token, error)
|
||||
this.implements("encoding/xml", "TokenReader", "Token") and
|
||||
(inp.isReceiver() and outp.isResult(0))
|
||||
or
|
||||
// signature: func (Unmarshaler).UnmarshalXML(d *Decoder, start StartElement) error
|
||||
this.implements("encoding/xml", "Unmarshaler", "UnmarshalXML") and
|
||||
(inp.isParameter(0) and outp.isReceiver())
|
||||
}
|
||||
|
||||
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
|
||||
input = inp and output = outp
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,333 @@
|
||||
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/xml"
|
||||
"io"
|
||||
)
|
||||
|
||||
func TaintStepTest_EncodingXmlCopyToken_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromToken656 := sourceCQL.(xml.Token)
|
||||
intoToken414 := xml.CopyToken(fromToken656)
|
||||
return intoToken414
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEscape_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromByte518 := sourceCQL.([]byte)
|
||||
var intoWriter650 io.Writer
|
||||
xml.Escape(intoWriter650, fromByte518)
|
||||
return intoWriter650
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEscapeText_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromByte784 := sourceCQL.([]byte)
|
||||
var intoWriter957 io.Writer
|
||||
xml.EscapeText(intoWriter957, fromByte784)
|
||||
return intoWriter957
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlMarshal_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromInterface520 := sourceCQL.(interface{})
|
||||
intoByte443, _ := xml.Marshal(fromInterface520)
|
||||
return intoByte443
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlMarshalIndent_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromInterface127 := sourceCQL.(interface{})
|
||||
intoByte483, _ := xml.MarshalIndent(fromInterface127, "", "")
|
||||
return intoByte483
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlMarshalIndent_B0I1O0(sourceCQL interface{}) interface{} {
|
||||
fromString989 := sourceCQL.(string)
|
||||
intoByte982, _ := xml.MarshalIndent(nil, fromString989, "")
|
||||
return intoByte982
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlMarshalIndent_B0I2O0(sourceCQL interface{}) interface{} {
|
||||
fromString417 := sourceCQL.(string)
|
||||
intoByte584, _ := xml.MarshalIndent(nil, "", fromString417)
|
||||
return intoByte584
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlNewDecoder_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromReader991 := sourceCQL.(io.Reader)
|
||||
intoDecoder881 := xml.NewDecoder(fromReader991)
|
||||
return intoDecoder881
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlNewEncoder_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromEncoder186 := sourceCQL.(*xml.Encoder)
|
||||
var intoWriter284 io.Writer
|
||||
intermediateCQL := xml.NewEncoder(intoWriter284)
|
||||
link(fromEncoder186, intermediateCQL)
|
||||
return intoWriter284
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlNewTokenDecoder_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromTokenReader908 := sourceCQL.(xml.TokenReader)
|
||||
intoDecoder137 := xml.NewTokenDecoder(fromTokenReader908)
|
||||
return intoDecoder137
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlUnmarshal_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromByte494 := sourceCQL.([]byte)
|
||||
var intoInterface873 interface{}
|
||||
xml.Unmarshal(fromByte494, intoInterface873)
|
||||
return intoInterface873
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlCharDataCopy_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromCharData599 := sourceCQL.(xml.CharData)
|
||||
intoCharData409 := fromCharData599.Copy()
|
||||
return intoCharData409
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlCommentCopy_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromComment246 := sourceCQL.(xml.Comment)
|
||||
intoComment898 := fromComment246.Copy()
|
||||
return intoComment898
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlDecoderDecode_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromDecoder598 := sourceCQL.(xml.Decoder)
|
||||
var intoInterface631 interface{}
|
||||
fromDecoder598.Decode(intoInterface631)
|
||||
return intoInterface631
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlDecoderDecodeElement_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromDecoder165 := sourceCQL.(xml.Decoder)
|
||||
var intoInterface150 interface{}
|
||||
fromDecoder165.DecodeElement(intoInterface150, nil)
|
||||
return intoInterface150
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlDecoderRawToken_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromDecoder340 := sourceCQL.(xml.Decoder)
|
||||
intoToken471, _ := fromDecoder340.RawToken()
|
||||
return intoToken471
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlDecoderToken_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromDecoder290 := sourceCQL.(xml.Decoder)
|
||||
intoToken758, _ := fromDecoder290.Token()
|
||||
return intoToken758
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlDirectiveCopy_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromDirective396 := sourceCQL.(xml.Directive)
|
||||
intoDirective707 := fromDirective396.Copy()
|
||||
return intoDirective707
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEncoderEncode_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromInterface912 := sourceCQL.(interface{})
|
||||
var intoEncoder718 xml.Encoder
|
||||
intoEncoder718.Encode(fromInterface912)
|
||||
return intoEncoder718
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEncoderEncodeElement_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromInterface972 := sourceCQL.(interface{})
|
||||
var intoEncoder633 xml.Encoder
|
||||
intoEncoder633.EncodeElement(fromInterface972, xml.StartElement{})
|
||||
return intoEncoder633
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEncoderEncodeToken_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromToken316 := sourceCQL.(xml.Token)
|
||||
var intoEncoder145 xml.Encoder
|
||||
intoEncoder145.EncodeToken(fromToken316)
|
||||
return intoEncoder145
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEncoderIndent_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromString817 := sourceCQL.(string)
|
||||
var intoEncoder474 xml.Encoder
|
||||
intoEncoder474.Indent(fromString817, "")
|
||||
return intoEncoder474
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlEncoderIndent_B0I1O0(sourceCQL interface{}) interface{} {
|
||||
fromString832 := sourceCQL.(string)
|
||||
var intoEncoder378 xml.Encoder
|
||||
intoEncoder378.Indent("", fromString832)
|
||||
return intoEncoder378
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlProcInstCopy_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromProcInst541 := sourceCQL.(xml.ProcInst)
|
||||
intoProcInst139 := fromProcInst541.Copy()
|
||||
return intoProcInst139
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlStartElementCopy_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromStartElement814 := sourceCQL.(xml.StartElement)
|
||||
intoStartElement768 := fromStartElement814.Copy()
|
||||
return intoStartElement768
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlMarshalerMarshalXML_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromMarshaler468 := sourceCQL.(xml.Marshaler)
|
||||
var intoEncoder736 *xml.Encoder
|
||||
fromMarshaler468.MarshalXML(intoEncoder736, xml.StartElement{})
|
||||
return intoEncoder736
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlTokenReaderToken_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromTokenReader516 := sourceCQL.(xml.TokenReader)
|
||||
intoToken246, _ := fromTokenReader516.Token()
|
||||
return intoToken246
|
||||
}
|
||||
|
||||
func TaintStepTest_EncodingXmlUnmarshalerUnmarshalXML_B0I0O0(sourceCQL interface{}) interface{} {
|
||||
fromDecoder679 := sourceCQL.(*xml.Decoder)
|
||||
var intoUnmarshaler736 xml.Unmarshaler
|
||||
intoUnmarshaler736.UnmarshalXML(fromDecoder679, xml.StartElement{})
|
||||
return intoUnmarshaler736
|
||||
}
|
||||
|
||||
func RunAllTaints_EncodingXml() {
|
||||
{
|
||||
source := newSource(0)
|
||||
out := TaintStepTest_EncodingXmlCopyToken_B0I0O0(source)
|
||||
sink(0, out)
|
||||
}
|
||||
{
|
||||
source := newSource(1)
|
||||
out := TaintStepTest_EncodingXmlEscape_B0I0O0(source)
|
||||
sink(1, out)
|
||||
}
|
||||
{
|
||||
source := newSource(2)
|
||||
out := TaintStepTest_EncodingXmlEscapeText_B0I0O0(source)
|
||||
sink(2, out)
|
||||
}
|
||||
{
|
||||
source := newSource(3)
|
||||
out := TaintStepTest_EncodingXmlMarshal_B0I0O0(source)
|
||||
sink(3, out)
|
||||
}
|
||||
{
|
||||
source := newSource(4)
|
||||
out := TaintStepTest_EncodingXmlMarshalIndent_B0I0O0(source)
|
||||
sink(4, out)
|
||||
}
|
||||
{
|
||||
source := newSource(5)
|
||||
out := TaintStepTest_EncodingXmlMarshalIndent_B0I1O0(source)
|
||||
sink(5, out)
|
||||
}
|
||||
{
|
||||
source := newSource(6)
|
||||
out := TaintStepTest_EncodingXmlMarshalIndent_B0I2O0(source)
|
||||
sink(6, out)
|
||||
}
|
||||
{
|
||||
source := newSource(7)
|
||||
out := TaintStepTest_EncodingXmlNewDecoder_B0I0O0(source)
|
||||
sink(7, out)
|
||||
}
|
||||
{
|
||||
source := newSource(8)
|
||||
out := TaintStepTest_EncodingXmlNewEncoder_B0I0O0(source)
|
||||
sink(8, out)
|
||||
}
|
||||
{
|
||||
source := newSource(9)
|
||||
out := TaintStepTest_EncodingXmlNewTokenDecoder_B0I0O0(source)
|
||||
sink(9, out)
|
||||
}
|
||||
{
|
||||
source := newSource(10)
|
||||
out := TaintStepTest_EncodingXmlUnmarshal_B0I0O0(source)
|
||||
sink(10, out)
|
||||
}
|
||||
{
|
||||
source := newSource(11)
|
||||
out := TaintStepTest_EncodingXmlCharDataCopy_B0I0O0(source)
|
||||
sink(11, out)
|
||||
}
|
||||
{
|
||||
source := newSource(12)
|
||||
out := TaintStepTest_EncodingXmlCommentCopy_B0I0O0(source)
|
||||
sink(12, out)
|
||||
}
|
||||
{
|
||||
source := newSource(13)
|
||||
out := TaintStepTest_EncodingXmlDecoderDecode_B0I0O0(source)
|
||||
sink(13, out)
|
||||
}
|
||||
{
|
||||
source := newSource(14)
|
||||
out := TaintStepTest_EncodingXmlDecoderDecodeElement_B0I0O0(source)
|
||||
sink(14, out)
|
||||
}
|
||||
{
|
||||
source := newSource(15)
|
||||
out := TaintStepTest_EncodingXmlDecoderRawToken_B0I0O0(source)
|
||||
sink(15, out)
|
||||
}
|
||||
{
|
||||
source := newSource(16)
|
||||
out := TaintStepTest_EncodingXmlDecoderToken_B0I0O0(source)
|
||||
sink(16, out)
|
||||
}
|
||||
{
|
||||
source := newSource(17)
|
||||
out := TaintStepTest_EncodingXmlDirectiveCopy_B0I0O0(source)
|
||||
sink(17, out)
|
||||
}
|
||||
{
|
||||
source := newSource(18)
|
||||
out := TaintStepTest_EncodingXmlEncoderEncode_B0I0O0(source)
|
||||
sink(18, out)
|
||||
}
|
||||
{
|
||||
source := newSource(19)
|
||||
out := TaintStepTest_EncodingXmlEncoderEncodeElement_B0I0O0(source)
|
||||
sink(19, out)
|
||||
}
|
||||
{
|
||||
source := newSource(20)
|
||||
out := TaintStepTest_EncodingXmlEncoderEncodeToken_B0I0O0(source)
|
||||
sink(20, out)
|
||||
}
|
||||
{
|
||||
source := newSource(21)
|
||||
out := TaintStepTest_EncodingXmlEncoderIndent_B0I0O0(source)
|
||||
sink(21, out)
|
||||
}
|
||||
{
|
||||
source := newSource(22)
|
||||
out := TaintStepTest_EncodingXmlEncoderIndent_B0I1O0(source)
|
||||
sink(22, out)
|
||||
}
|
||||
{
|
||||
source := newSource(23)
|
||||
out := TaintStepTest_EncodingXmlProcInstCopy_B0I0O0(source)
|
||||
sink(23, out)
|
||||
}
|
||||
{
|
||||
source := newSource(24)
|
||||
out := TaintStepTest_EncodingXmlStartElementCopy_B0I0O0(source)
|
||||
sink(24, out)
|
||||
}
|
||||
{
|
||||
source := newSource(25)
|
||||
out := TaintStepTest_EncodingXmlMarshalerMarshalXML_B0I0O0(source)
|
||||
sink(25, out)
|
||||
}
|
||||
{
|
||||
source := newSource(26)
|
||||
out := TaintStepTest_EncodingXmlTokenReaderToken_B0I0O0(source)
|
||||
sink(26, out)
|
||||
}
|
||||
{
|
||||
source := newSource(27)
|
||||
out := TaintStepTest_EncodingXmlUnmarshalerUnmarshalXML_B0I0O0(source)
|
||||
sink(27, out)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user