hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Go: Migrate AppenderOrSprinter model to models-as-data

Browse Source
This commit is contained in:
Tony Torralba
2024-01-09 16:33:13 +01:00
parent 6b8ed7ee71
commit da4049e25c
4 changed files with 30 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
go/ql/lib/change-notes/2024-01-09-fmt-apprender-or-sprinter-deprecated.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: deprecated
---
* The class `Fmt::AppenderOrSprinter` of the `Fmt.qll` module has been deprecated. Use the new `Fmt::AppenderOrSprinterFunc` class instead. Its taint flow features have been migrated to models-as-data.

11
go/ql/lib/ext/fmt.model.yml
View File

@@ -8,3 +8,14 @@ extensions:
- ["fmt", "ScanState", True, "Token", "", "", "Argument[-1]", "ReturnValue[0]", "taint", "manual"]
- ["fmt", "State", True, "Write", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
- ["fmt", "Stringer", True, "String", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Append", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Append", "", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Appendf", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Appendf", "", "", "Argument[1]", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Appendf", "", "", "Argument[2].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Appendln", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Appendln", "", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Sprint", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Sprintf", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Sprintf", "", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"]
- ["fmt", "", True, "Sprintln", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"]

17
go/ql/lib/semmle/go/frameworks/stdlib/Fmt.qll
View File

@@ -7,8 +7,12 @@ import go
// Some TaintTracking::FunctionModel subclasses remain because varargs functions don't work with Models-as-Data sumamries yet.
/** Provides models of commonly used functions in the `fmt` package. */
module Fmt {
/** The `Sprint` or `Append` functions or one of their variants. */
class AppenderOrSprinter extends TaintTracking::FunctionModel {
/**
* The `Sprint` or `Append` functions or one of their variants.
*
* DEPRECATED: Use AppenderOrSprinterFunc.
*/
deprecated class AppenderOrSprinter extends TaintTracking::FunctionModel {
AppenderOrSprinter() { this.hasQualifiedName("fmt", ["Append", "Sprint"] + ["", "f", "ln"]) }
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
@@ -16,8 +20,15 @@ module Fmt {
}
}
/** The `Sprint` or `Append` functions or one of their variants. */
class AppenderOrSprinterFunc extends Function {
AppenderOrSprinterFunc() {
this.hasQualifiedName("fmt", ["Append", "Sprint"] + ["", "f", "ln"])
}
}
/** The `Sprint` function or one of its variants. */
class Sprinter extends AppenderOrSprinter {
class Sprinter extends AppenderOrSprinterFunc {
Sprinter() { this.getName().matches("Sprint%") }
}

2
go/ql/src/Security/CWE-352/ConstantOauth2State.ql
View File

@@ -99,7 +99,7 @@ module PrivateUrlFlowsToAuthCodeUrlCallConfig implements DataFlow::ConfigSig {
or
// Propagate across Sprintf and similar calls
exists(DataFlow::CallNode cn |
cn.getACalleeIncludingExternals().asFunction() instanceof Fmt::AppenderOrSprinter
cn.getACalleeIncludingExternals().asFunction() instanceof Fmt::AppenderOrSprinterFunc
|
pred = cn.getASyntacticArgument() and succ = cn.getResult()
)