diff --git a/go/ql/lib/semmle/go/controlflow/IR.qll b/go/ql/lib/semmle/go/controlflow/IR.qll index 86df852f7a5..91d73fe901f 100644 --- a/go/ql/lib/semmle/go/controlflow/IR.qll +++ b/go/ql/lib/semmle/go/controlflow/IR.qll @@ -960,7 +960,7 @@ module IR { FuncDef fd; ReadResultInstruction() { - this.isAdditional(fd, "result-read:" + idx.toString()) and + this.isAdditional(fd.getBody(), "result-read:" + idx.toString()) and var = fd.getResultVar(idx) } @@ -987,12 +987,12 @@ module IR { FuncDef fd; InitParameterInstruction() { - this.isAdditional(fd, "param-init:" + idx.toString()) and + this.isAdditional(fd.getBody(), "param-init:" + idx.toString()) and parm = fd.getParameter(idx) } override Instruction getRhs() { - result.(ReadArgumentInstruction).isAdditional(fd, "arg:" + idx.toString()) + result.(ReadArgumentInstruction).isAdditional(fd.getBody(), "arg:" + idx.toString()) } override ControlFlow::Root getRoot() { result = parm.getFunction() } @@ -1005,7 +1005,7 @@ module IR { FuncDef fd; ReadArgumentInstruction() { - this.isAdditional(fd, "arg:" + idx.toString()) and + this.isAdditional(fd.getBody(), "arg:" + idx.toString()) and parm = fd.getParameter(idx) } @@ -1021,12 +1021,14 @@ module IR { FuncDef fd; InitResultInstruction() { - this.isAdditional(fd, "result-init:" + idx.toString()) and + this.isAdditional(fd.getBody(), "result-init:" + idx.toString()) and res = fd.getResultVar(idx) } override Instruction getRhs() { - result.(ResultZeroInitInstruction).isAdditional(fd, "result-zero-init:" + idx.toString()) + result + .(ResultZeroInitInstruction) + .isAdditional(fd.getBody(), "result-zero-init:" + idx.toString()) } override ControlFlow::Root getRoot() { result = res.getFunction() } @@ -1038,7 +1040,7 @@ module IR { FuncDef fd; ResultZeroInitInstruction() { - this.isAdditional(fd, "result-zero-init:" + idx.toString()) and + this.isAdditional(fd.getBody(), "result-zero-init:" + idx.toString()) and res = fd.getResultVar(idx) } @@ -1214,12 +1216,12 @@ module IR { exists(IncDecStmt ids | write.isIn(ids) | lhs = ids.getOperand().stripParens()) or exists(FuncDef fd, int idx | - write.isAdditional(fd, "param-init:" + idx.toString()) and + write.isAdditional(fd.getBody(), "param-init:" + idx.toString()) and lhs = fd.getParameter(idx).getDeclaration() ) or exists(FuncDef fd, int idx | - write.isAdditional(fd, "result-init:" + idx.toString()) and + write.isAdditional(fd.getBody(), "result-init:" + idx.toString()) and lhs = fd.getResultVar(idx).getDeclaration() ) } or @@ -1411,7 +1413,7 @@ module IR { */ InitParameterInstruction initRecvInstruction(ReceiverVariable r) { exists(FuncDef fd, int i | - fd.getParameter(i) = r and result.isAdditional(fd, "param-init:" + i.toString()) + fd.getParameter(i) = r and result.isAdditional(fd.getBody(), "param-init:" + i.toString()) ) } @@ -1420,7 +1422,7 @@ module IR { */ InitParameterInstruction initParamInstruction(Parameter p) { exists(FuncDef fd, int i | - fd.getParameter(i) = p and result.isAdditional(fd, "param-init:" + i.toString()) + fd.getParameter(i) = p and result.isAdditional(fd.getBody(), "param-init:" + i.toString()) ) } diff --git a/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.go b/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.go index 74e7c7c1c33..1c58cfdb11c 100644 --- a/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.go +++ b/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/BadRedirectCheck.go @@ -1,8 +1,8 @@ package main -func sanitizeUrl(redir string) string { // $ Source +func sanitizeUrl(redir string) string { if len(redir) > 0 && redir[0] == '/' { // $ Alert return redir } return "/" -} +} // $ Source diff --git a/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/cves.go b/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/cves.go index 01fc6553977..a4cd0aa830c 100644 --- a/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/cves.go +++ b/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/cves.go @@ -11,11 +11,11 @@ func isValidRedirect(url string) bool { return len(url) >= 2 && url[0] == '/' && url[1] != '/' // $ Alert // NOT OK } -func alsoABadRedirect(url string, rw http.ResponseWriter, req *http.Request) { // $ Source +func alsoABadRedirect(url string, rw http.ResponseWriter, req *http.Request) { if isValidRedirect(url) { http.Redirect(rw, req, url, 302) // $ Sink } -} +} // $ Source func isValidRedirectGood(url string) bool { return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\' // OK diff --git a/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/main.go b/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/main.go index f45653e0945..4dd703323a2 100644 --- a/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/main.go +++ b/go/ql/test/query-tests/Security/CWE-601/BadRedirectCheck/main.go @@ -7,9 +7,9 @@ import ( "strings" ) -func badRedirect(redirect string, rw http.ResponseWriter, req *http.Request) { // $ Source +func badRedirect(redirect string, rw http.ResponseWriter, req *http.Request) { http.Redirect(rw, req, sanitizeUrl(redirect), 302) // $ Sink -} +} // $ Source func goodRedirect(redirect string, rw http.ResponseWriter, req *http.Request) { http.Redirect(rw, req, sanitizeUrlGood(redirect), 302) @@ -29,11 +29,11 @@ func isValidRedir(redirect string) bool { } } -func alsoABadRedirect1(url string, rw http.ResponseWriter, req *http.Request) { // $ Source +func alsoABadRedirect1(url string, rw http.ResponseWriter, req *http.Request) { if isValidRedir(url) { http.Redirect(rw, req, url, 302) // $ Sink } -} +} // $ Source func isValidRedir1(redirect string) bool { switch { @@ -65,17 +65,17 @@ func goodRedirect4(url string, rw http.ResponseWriter, req *http.Request) { http.Redirect(rw, req, getTarget(url), 302) } -func getTarget1(redirect string) string { // $ Source +func getTarget1(redirect string) string { if redirect[0] != '/' { // $ Alert return "/" } return path.Clean(redirect) -} +} // $ Source -func badRedirect1(url string, rw http.ResponseWriter, req *http.Request) { // $ Source +func badRedirect1(url string, rw http.ResponseWriter, req *http.Request) { http.Redirect(rw, req, getTarget1(url), 302) // $ Sink -} +} // $ Source func getTarget2(redirect string) string { u, _ := url.Parse(redirect)