hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-06 10:18:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

update function-entry additional nodes

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-05-30 06:30:38 +01:00
parent 73204db045
commit cc47cefeac
4 changed files with 25 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
go/ql/lib/semmle/go/controlflow/IR.qll
View File

@@ -960,7 +960,7 @@ module IR {
FuncDef fd;
ReadResultInstruction() {
this.isAdditional(fd, "result-read:" + idx.toString()) and
this.isAdditional(fd.getBody(), "result-read:" + idx.toString()) and
var = fd.getResultVar(idx)
}
@@ -987,12 +987,12 @@ module IR {
FuncDef fd;
InitParameterInstruction() {
this.isAdditional(fd, "param-init:" + idx.toString()) and
this.isAdditional(fd.getBody(), "param-init:" + idx.toString()) and
parm = fd.getParameter(idx)
}
override Instruction getRhs() {
result.(ReadArgumentInstruction).isAdditional(fd, "arg:" + idx.toString())
result.(ReadArgumentInstruction).isAdditional(fd.getBody(), "arg:" + idx.toString())
}
override ControlFlow::Root getRoot() { result = parm.getFunction() }
@@ -1005,7 +1005,7 @@ module IR {
FuncDef fd;
ReadArgumentInstruction() {
this.isAdditional(fd, "arg:" + idx.toString()) and
this.isAdditional(fd.getBody(), "arg:" + idx.toString()) and
parm = fd.getParameter(idx)
}
@@ -1021,12 +1021,14 @@ module IR {
FuncDef fd;
InitResultInstruction() {
this.isAdditional(fd, "result-init:" + idx.toString()) and
this.isAdditional(fd.getBody(), "result-init:" + idx.toString()) and
res = fd.getResultVar(idx)
}
override Instruction getRhs() {
result.(ResultZeroInitInstruction).isAdditional(fd, "result-zero-init:" + idx.toString())
result
.(ResultZeroInitInstruction)
.isAdditional(fd.getBody(), "result-zero-init:" + idx.toString())
}
override ControlFlow::Root getRoot() { result = res.getFunction() }
@@ -1038,7 +1040,7 @@ module IR {
FuncDef fd;
ResultZeroInitInstruction() {
this.isAdditional(fd, "result-zero-init:" + idx.toString()) and
this.isAdditional(fd.getBody(), "result-zero-init:" + idx.toString()) and
res = fd.getResultVar(idx)
}
@@ -1214,12 +1216,12 @@ module IR {
exists(IncDecStmt ids | write.isIn(ids) | lhs = ids.getOperand().stripParens())
or
exists(FuncDef fd, int idx |
write.isAdditional(fd, "param-init:" + idx.toString()) and
write.isAdditional(fd.getBody(), "param-init:" + idx.toString()) and
lhs = fd.getParameter(idx).getDeclaration()
)
or
exists(FuncDef fd, int idx |
write.isAdditional(fd, "result-init:" + idx.toString()) and
write.isAdditional(fd.getBody(), "result-init:" + idx.toString()) and
lhs = fd.getResultVar(idx).getDeclaration()
)
} or
@@ -1411,7 +1413,7 @@ module IR {
*/
InitParameterInstruction initRecvInstruction(ReceiverVariable r) {
exists(FuncDef fd, int i |
fd.getParameter(i) = r and result.isAdditional(fd, "param-init:" + i.toString())
fd.getParameter(i) = r and result.isAdditional(fd.getBody(), "param-init:" + i.toString())
)
}
@@ -1420,7 +1422,7 @@ module IR {
*/
InitParameterInstruction initParamInstruction(Parameter p) {
exists(FuncDef fd, int i |
fd.getParameter(i) = p and result.isAdditional(fd, "param-init:" + i.toString())
fd.getParameter(i) = p and result.isAdditional(fd.getBody(), "param-init:" + i.toString())
)
}

4
go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.go
View File

@@ -1,8 +1,8 @@
package main
func sanitizeUrl(redir string) string { // $ Source
func sanitizeUrl(redir string) string {
if len(redir) > 0 && redir[0] == '/' { // $ Alert
return redir
}
return "/"
}
} // $ Source

4
go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/cves.go
View File

@@ -11,11 +11,11 @@ func isValidRedirect(url string) bool {
return len(url) >= 2 && url[0] == '/' && url[1] != '/' // $ Alert // NOT OK
}
func alsoABadRedirect(url string, rw http.ResponseWriter, req *http.Request) { // $ Source
func alsoABadRedirect(url string, rw http.ResponseWriter, req *http.Request) {
if isValidRedirect(url) {
http.Redirect(rw, req, url, 302) // $ Sink
}
}
} // $ Source
func isValidRedirectGood(url string) bool {
return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\' // OK

16
go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/main.go
View File

@@ -7,9 +7,9 @@ import (
"strings"
)
func badRedirect(redirect string, rw http.ResponseWriter, req *http.Request) { // $ Source
func badRedirect(redirect string, rw http.ResponseWriter, req *http.Request) {
http.Redirect(rw, req, sanitizeUrl(redirect), 302) // $ Sink
}
} // $ Source
func goodRedirect(redirect string, rw http.ResponseWriter, req *http.Request) {
http.Redirect(rw, req, sanitizeUrlGood(redirect), 302)
@@ -29,11 +29,11 @@ func isValidRedir(redirect string) bool {
}
}
func alsoABadRedirect1(url string, rw http.ResponseWriter, req *http.Request) { // $ Source
func alsoABadRedirect1(url string, rw http.ResponseWriter, req *http.Request) {
if isValidRedir(url) {
http.Redirect(rw, req, url, 302) // $ Sink
}
}
} // $ Source
func isValidRedir1(redirect string) bool {
switch {
@@ -65,17 +65,17 @@ func goodRedirect4(url string, rw http.ResponseWriter, req *http.Request) {
http.Redirect(rw, req, getTarget(url), 302)
}
func getTarget1(redirect string) string { // $ Source
func getTarget1(redirect string) string {
if redirect[0] != '/' { // $ Alert
return "/"
}
return path.Clean(redirect)
}
} // $ Source
func badRedirect1(url string, rw http.ResponseWriter, req *http.Request) { // $ Source
func badRedirect1(url string, rw http.ResponseWriter, req *http.Request) {
http.Redirect(rw, req, getTarget1(url), 302) // $ Sink
}
} // $ Source
func getTarget2(redirect string) string {
u, _ := url.Parse(redirect)