hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 22:32:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Do not allow "Argument" on its own

Browse Source
This commit is contained in:
Owen Mansel-Chan
2021-12-03 06:02:05 -05:00
parent d2ca1fb2eb
commit d717734820
4 changed files with 5 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ql/lib/semmle/go/dataflow/ExternalFlow.qll
View File

@@ -293,7 +293,6 @@ module CsvValidation {
(
invalidSpecComponent(input, part) and
not part = "" and
not (part = "Argument" and pred = "sink") and
not parseArg(part, _)
or
specSplit(input, part, _) and
@@ -309,7 +308,7 @@ module CsvValidation {
|
invalidSpecComponent(output, part) and
not part = "" and
not (part = ["Argument", "Parameter"] and pred = "source") and
not (part = "Parameter" and pred = "source") and
msg = "Unrecognized output specification \"" + part + "\" in " + pred + " model."
)
or

12
ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -721,13 +721,9 @@ module Private {
not exists(interpretComponent(c))
}
private predicate inputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _)
}
private predicate inputNeedsReference(string c) { parseArg(c, _) }
private predicate outputNeedsReference(string c) {
c = "Argument" or
parseArg(c, _) or
c = "ReturnValue" or
parseReturn(c, _)
@@ -763,7 +759,7 @@ module Private {
exists(int pos |
node.asNode().(PostUpdateNode).getPreUpdateNode().(ArgNode).argumentOf(mid.asCall(), pos)
|
c = "Argument" or parseArg(c, pos)
parseArg(c, pos)
)
or
exists(int pos | node.asNode().(ParamNode).isParameterOf(mid.asCallable(), pos) |
@@ -791,9 +787,7 @@ module Private {
interpretInput(input, idx + 1, ref, mid) and
specSplit(input, c, idx)
|
exists(int pos | node.asNode().(ArgNode).argumentOf(mid.asCall(), pos) |
c = "Argument" or parseArg(c, pos)
)
exists(int pos | node.asNode().(ArgNode).argumentOf(mid.asCall(), pos) | parseArg(c, pos))
or
exists(int pos, ReturnNodeExt ret |
(

1
ql/test/library-tests/semmle/go/dataflow/ExternalFlow/srcs.expected
View File

@@ -1,7 +1,6 @@
invalidModelRow
#select
| test.go:12:6:12:8 | definition of arg | qltest-arg |
| test.go:37:6:37:6 | definition of a | qltest-arg |
| test.go:40:8:40:15 | call to Src1 | qltest |
| test.go:41:8:41:15 | call to Src2 | qltest |
| test.go:41:8:41:15 | call to Src2 | qltest-w-subtypes |

2
ql/test/library-tests/semmle/go/dataflow/ExternalFlow/srcs.ql
View File

@@ -11,7 +11,7 @@ class SourceModelTest extends SourceModelCsv {
"github.com/nonexistent/test;A;false;Src1;;;ReturnValue;qltest",
"github.com/nonexistent/test;A;false;Src2;;;ReturnValue;qltest",
"github.com/nonexistent/test;A;true;Src2;;;ReturnValue;qltest-w-subtypes",
"github.com/nonexistent/test;A;false;SrcArg;;;Argument;qltest-arg",
"github.com/nonexistent/test;A;false;SrcArg;;;Argument[0];qltest-arg",
"github.com/nonexistent/test;A;false;Src3;;;ReturnValue[0];qltest",
"github.com/nonexistent/test;A;true;Src3;;;ReturnValue[1];qltest-w-subtypes"
]