hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 14:23:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove Protocol as UntrustedFlowSource

Browse Source
This commit is contained in:
Slavomir
2021-07-15 16:20:33 +02:00
parent 498332c186
commit d252d6003f
3 changed files with 7 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
ql/src/experimental/frameworks/Fiber.json
View File

@@ -1,5 +1,6 @@
{
"Name": "Fiber",
"Preload": null,
"Models": [
{
"Name": "TaintTracking",
@@ -929,17 +930,15 @@
}
},
{
"Kind": "Func",
"Kind": "Struct",
"Qualifier": {
"Path": "github.com/gofiber/fiber",
"Version": "v1.14.6",
"ID": "TypeMethod-Ctx-Protocol",
"Pos": [
false,
true
],
"Flows": null,
"Name": "Protocol"
"ID": "Struct-Error",
"TypeName": "Error",
"Fields": {
"Message": null
}
}
},
{
@@ -1019,18 +1018,6 @@
"Value": null
}
}
},
{
"Kind": "Struct",
"Qualifier": {
"Path": "github.com/gofiber/fiber",
"Version": "v1.14.6",
"ID": "Struct-Error",
"TypeName": "Error",
"Fields": {
"Message": null
}
}
}
]
}

4
ql/src/experimental/frameworks/Fiber.qll
View File

@@ -366,10 +366,6 @@ private module Fiber {
methodName = "Path" and
out.isResult()
or
// signature: func (*Ctx).Protocol() string
methodName = "Protocol" and
out.isResult()
or
// signature: func (*Ctx).Query(key string, defaultValue ...string) string
methodName = "Query" and
out.isResult()

6
ql/test/experimental/frameworks/Fiber/UntrustedFlowSources.go
View File

@@ -89,12 +89,6 @@ func UntrustedFlowSources_GithubComGofiberFiberV1146() {
result544 := receiverCtx648.Path("")
sink(result544) // $untrustedFlowSource
}
// func (*Ctx).Protocol() string
{
var receiverCtx484 fiber.Ctx
result824 := receiverCtx484.Protocol()
sink(result824) // $untrustedFlowSource
}
// func (*Ctx).Query(key string, defaultValue ...string) string
{
var receiverCtx754 fiber.Ctx