Merge branch 'standard-lib-pt-5' into from-331-to-337

ql/src/semmle/go/frameworks/Stdlib.qll

@@ -29,6 +29,7 @@ import semmle.go.frameworks.stdlib.EncodingPem
 import semmle.go.frameworks.stdlib.EncodingXml
 import semmle.go.frameworks.stdlib.Html
 import semmle.go.frameworks.stdlib.HtmlTemplate
+import semmle.go.frameworks.stdlib.Context
 import semmle.go.frameworks.stdlib.Path
 import semmle.go.frameworks.stdlib.PathFilepath
 import semmle.go.frameworks.stdlib.Reflect

ql/src/semmle/go/frameworks/stdlib/Context.qll

@@ -0,0 +1,50 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `context` package.
+ */
+
+import go
+
+/** Provides models of commonly used functions in the `context` package. */
+module Context {
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      // signature: func WithCancel(parent Context) (ctx Context, cancel CancelFunc)
+      hasQualifiedName("context", "WithCancel") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func WithDeadline(parent Context, d time.Time) (Context, CancelFunc)
+      hasQualifiedName("context", "WithDeadline") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func WithTimeout(parent Context, timeout time.Duration) (Context, CancelFunc)
+      hasQualifiedName("context", "WithTimeout") and
+      (inp.isParameter(0) and outp.isResult(0))
+      or
+      // signature: func WithValue(parent Context, key interface{}, val interface{}) Context
+      hasQualifiedName("context", "WithValue") and
+      (inp.isParameter(_) and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+
+  private class MethodModels extends TaintTracking::FunctionModel, Method {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    MethodModels() {
+      // signature: func (Context).Value(key interface{}) interface{}
+      this.implements("context", "Context", "Value") and
+      (inp.isReceiver() and outp.isResult())
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Context.go

@@ -0,0 +1,88 @@
+// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
+
+package main
+
+import (
+	"context"
+	"time"
+)
+
+func TaintStepTest_ContextWithCancel_B0I0O0(sourceCQL interface{}) interface{} {
+	fromContext656 := sourceCQL.(context.Context)
+	intoContext414, _ := context.WithCancel(fromContext656)
+	return intoContext414
+}
+
+func TaintStepTest_ContextWithDeadline_B0I0O0(sourceCQL interface{}) interface{} {
+	fromContext518 := sourceCQL.(context.Context)
+	intoContext650, _ := context.WithDeadline(fromContext518, time.Time{})
+	return intoContext650
+}
+
+func TaintStepTest_ContextWithTimeout_B0I0O0(sourceCQL interface{}) interface{} {
+	fromContext784 := sourceCQL.(context.Context)
+	intoContext957, _ := context.WithTimeout(fromContext784, 0)
+	return intoContext957
+}
+
+func TaintStepTest_ContextWithValue_B0I0O0(sourceCQL interface{}) interface{} {
+	fromContext520 := sourceCQL.(context.Context)
+	intoContext443 := context.WithValue(fromContext520, nil, nil)
+	return intoContext443
+}
+
+func TaintStepTest_ContextWithValue_B0I1O0(sourceCQL interface{}) interface{} {
+	fromInterface127 := sourceCQL.(interface{})
+	intoContext483 := context.WithValue(nil, fromInterface127, nil)
+	return intoContext483
+}
+
+func TaintStepTest_ContextWithValue_B0I2O0(sourceCQL interface{}) interface{} {
+	fromInterface989 := sourceCQL.(interface{})
+	intoContext982 := context.WithValue(nil, nil, fromInterface989)
+	return intoContext982
+}
+
+func TaintStepTest_ContextContextValue_B0I0O0(sourceCQL interface{}) interface{} {
+	fromContext417 := sourceCQL.(context.Context)
+	intoInterface584 := fromContext417.Value(nil)
+	return intoInterface584
+}
+
+func RunAllTaints_Context() {
+	{
+		source := newSource(0)
+		out := TaintStepTest_ContextWithCancel_B0I0O0(source)
+		sink(0, out)
+	}
+	{
+		source := newSource(1)
+		out := TaintStepTest_ContextWithDeadline_B0I0O0(source)
+		sink(1, out)
+	}
+	{
+		source := newSource(2)
+		out := TaintStepTest_ContextWithTimeout_B0I0O0(source)
+		sink(2, out)
+	}
+	{
+		source := newSource(3)
+		out := TaintStepTest_ContextWithValue_B0I0O0(source)
+		sink(3, out)
+	}
+	{
+		source := newSource(4)
+		out := TaintStepTest_ContextWithValue_B0I1O0(source)
+		sink(4, out)
+	}
+	{
+		source := newSource(5)
+		out := TaintStepTest_ContextWithValue_B0I2O0(source)
+		sink(5, out)
+	}
+	{
+		source := newSource(6)
+		out := TaintStepTest_ContextContextValue_B0I0O0(source)
+		sink(6, out)
+	}
+}