diff --git a/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected b/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected index 4fca314327d..4d797f8be5d 100644 --- a/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected +++ b/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected @@ -1,4 +1,5 @@ edges +| klog.go:20:30:20:37 | selection of Header : Header | klog.go:22:15:22:20 | header | | passwords.go:8:12:8:12 | definition of x : string | passwords.go:9:14:9:14 | x | | passwords.go:30:8:30:15 | password : string | passwords.go:8:12:8:12 | definition of x : string | | passwords.go:34:28:34:35 | password : string | passwords.go:34:14:34:35 | ...+... | @@ -22,7 +23,10 @@ edges | passwords.go:127:14:127:19 | config [y] : string | passwords.go:127:14:127:21 | selection of y | | util.go:16:9:16:18 | selection of password : string | passwords.go:28:14:28:28 | call to getPassword | nodes +| klog.go:20:30:20:37 | selection of Header : Header | semmle.label | selection of Header : Header | +| klog.go:22:15:22:20 | header | semmle.label | header | | main.go:15:14:15:21 | password | semmle.label | password | +| main.go:17:12:17:19 | password | semmle.label | password | | passwords.go:8:12:8:12 | definition of x : string | semmle.label | definition of x : string | | passwords.go:9:14:9:14 | x | semmle.label | x | | passwords.go:25:14:25:21 | password | semmle.label | password | @@ -64,7 +68,9 @@ nodes | passwords.go:127:14:127:21 | selection of y | semmle.label | selection of y | | util.go:16:9:16:18 | selection of password : string | semmle.label | selection of password : string | #select +| klog.go:22:15:22:20 | header | klog.go:20:30:20:37 | selection of Header : Header | klog.go:22:15:22:20 | header | Sensitive data returned by $@ is logged here. | klog.go:20:30:20:37 | selection of Header | HTTP request headers | | main.go:15:14:15:21 | password | main.go:15:14:15:21 | password | main.go:15:14:15:21 | password | Sensitive data returned by $@ is logged here. | main.go:15:14:15:21 | password | an access to password | +| main.go:17:12:17:19 | password | main.go:17:12:17:19 | password | main.go:17:12:17:19 | password | Sensitive data returned by $@ is logged here. | main.go:17:12:17:19 | password | an access to password | | passwords.go:9:14:9:14 | x | passwords.go:30:8:30:15 | password : string | passwords.go:9:14:9:14 | x | Sensitive data returned by $@ is logged here. | passwords.go:30:8:30:15 | password | an access to password | | passwords.go:25:14:25:21 | password | passwords.go:25:14:25:21 | password | passwords.go:25:14:25:21 | password | Sensitive data returned by $@ is logged here. | passwords.go:25:14:25:21 | password | an access to password | | passwords.go:26:14:26:23 | selection of password | passwords.go:26:14:26:23 | selection of password | passwords.go:26:14:26:23 | selection of password | Sensitive data returned by $@ is logged here. | passwords.go:26:14:26:23 | selection of password | an access to password | diff --git a/ql/test/query-tests/Security/CWE-312/go.mod b/ql/test/query-tests/Security/CWE-312/go.mod index d56c33ffc85..7dbd14e13e0 100644 --- a/ql/test/query-tests/Security/CWE-312/go.mod +++ b/ql/test/query-tests/Security/CWE-312/go.mod @@ -5,4 +5,5 @@ go 1.14 require ( github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b github.com/sirupsen/logrus v1.5.0 + k8s.io/klog v1.0.0 ) diff --git a/ql/test/query-tests/Security/CWE-312/klog.go b/ql/test/query-tests/Security/CWE-312/klog.go new file mode 100644 index 00000000000..ee0cf9df549 --- /dev/null +++ b/ql/test/query-tests/Security/CWE-312/klog.go @@ -0,0 +1,28 @@ +package main + +//go:generate depstubber -vendor k8s.io/klog "" Info + +import ( + "k8s.io/klog" + "net/http" + "strings" +) + +func mask(key, value string) string { + if strings.EqualFold(key, "Authorization") { + return "" + } + return value +} + +func klogTest() { + http.HandleFunc("/klog", func(w http.ResponseWriter, r *http.Request) { + for name, headers := range r.Header { + for _, header := range headers { + klog.Info(header) // NOT OK + klog.Info(mask(name, header)) // OK + } + } + }) + http.ListenAndServe(":80", nil) +} diff --git a/ql/test/query-tests/Security/CWE-312/vendor/github.com/golang/glog/stub.go b/ql/test/query-tests/Security/CWE-312/vendor/github.com/golang/glog/stub.go index 9e1c7e69fed..cdd12b34901 100644 --- a/ql/test/query-tests/Security/CWE-312/vendor/github.com/golang/glog/stub.go +++ b/ql/test/query-tests/Security/CWE-312/vendor/github.com/golang/glog/stub.go @@ -1,6 +1,7 @@ // Code generated by depstubber. DO NOT EDIT. // This is a simple stub for github.com/golang/glog, strictly for use in testing. +// See the LICENSE file for information about the licensing of the original library. // Source: github.com/golang/glog (exports: ; functions: Info) // Package glog is a stub of github.com/golang/glog, generated by depstubber. diff --git a/ql/test/query-tests/Security/CWE-312/vendor/github.com/sirupsen/logrus/stub.go b/ql/test/query-tests/Security/CWE-312/vendor/github.com/sirupsen/logrus/stub.go index fc5e9fd6736..84859e578f2 100644 --- a/ql/test/query-tests/Security/CWE-312/vendor/github.com/sirupsen/logrus/stub.go +++ b/ql/test/query-tests/Security/CWE-312/vendor/github.com/sirupsen/logrus/stub.go @@ -1,6 +1,7 @@ // Code generated by depstubber. DO NOT EDIT. // This is a simple stub for github.com/sirupsen/logrus, strictly for use in testing. +// See the LICENSE file for information about the licensing of the original library. // Source: github.com/sirupsen/logrus (exports: Fields,Entry; functions: Warning,WithFields,WithField) // Package logrus is a stub of github.com/sirupsen/logrus, generated by depstubber. @@ -29,9 +30,7 @@ func (_ Entry) HasCaller() bool { return false } -func (_ *Entry) Bytes() ([]uint8, interface { - Error() string -}) { +func (_ *Entry) Bytes() ([]byte, error) { return nil, nil } @@ -77,9 +76,7 @@ func (_ *Entry) Printf(_ string, _ ...interface{}) {} func (_ *Entry) Println(_ ...interface{}) {} -func (_ *Entry) String() (string, interface { - Error() string -}) { +func (_ *Entry) String() (string, error) { return "", nil } @@ -105,9 +102,7 @@ func (_ *Entry) WithContext(_ context.Context) *Entry { return nil } -func (_ *Entry) WithError(_ interface { - Error() string -}) *Entry { +func (_ *Entry) WithError(_ error) *Entry { return nil } @@ -134,23 +129,17 @@ func (_ *Entry) WriterLevel(_ Level) *io.PipeWriter { type Fields map[string]interface{} type Formatter interface { - Format(_ *Entry) ([]uint8, interface { - Error() string - }) + Format(_ *Entry) ([]byte, error) } type Hook interface { - Fire(_ *Entry) interface { - Error() string - } + Fire(_ *Entry) error Levels() []Level } type Level uint32 -func (_ Level) MarshalText() ([]uint8, interface { - Error() string -}) { +func (_ Level) MarshalText() ([]byte, error) { return nil, nil } @@ -158,9 +147,7 @@ func (_ Level) String() string { return "" } -func (_ *Level) UnmarshalText(_ []uint8) interface { - Error() string -} { +func (_ *Level) UnmarshalText(_ []byte) error { return nil } @@ -168,9 +155,7 @@ type LevelHooks map[Level][]Hook func (_ LevelHooks) Add(_ Hook) {} -func (_ LevelHooks) Fire(_ Level, _ *Entry) interface { - Error() string -} { +func (_ LevelHooks) Fire(_ Level, _ *Entry) error { return nil } @@ -273,9 +258,7 @@ func (_ *Logger) WithContext(_ context.Context) *Entry { return nil } -func (_ *Logger) WithError(_ interface { - Error() string -}) *Entry { +func (_ *Logger) WithError(_ error) *Entry { return nil } diff --git a/ql/test/query-tests/Security/CWE-312/vendor/k8s.io/klog/LICENSE b/ql/test/query-tests/Security/CWE-312/vendor/k8s.io/klog/LICENSE new file mode 100644 index 00000000000..37ec93a14fd --- /dev/null +++ b/ql/test/query-tests/Security/CWE-312/vendor/k8s.io/klog/LICENSE @@ -0,0 +1,191 @@ +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + +"License" shall mean the terms and conditions for use, reproduction, and +distribution as defined by Sections 1 through 9 of this document. + +"Licensor" shall mean the copyright owner or entity authorized by the copyright +owner that is granting the License. + +"Legal Entity" shall mean the union of the acting entity and all other entities +that control, are controlled by, or are under common control with that entity. +For the purposes of this definition, "control" means (i) the power, direct or +indirect, to cause the direction or management of such entity, whether by +contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the +outstanding shares, or (iii) beneficial ownership of such entity. + +"You" (or "Your") shall mean an individual or Legal Entity exercising +permissions granted by this License. + +"Source" form shall mean the preferred form for making modifications, including +but not limited to software source code, documentation source, and configuration +files. + +"Object" form shall mean any form resulting from mechanical transformation or +translation of a Source form, including but not limited to compiled object code, +generated documentation, and conversions to other media types. + +"Work" shall mean the work of authorship, whether in Source or Object form, made +available under the License, as indicated by a copyright notice that is included +in or attached to the work (an example is provided in the Appendix below). + +"Derivative Works" shall mean any work, whether in Source or Object form, that +is based on (or derived from) the Work and for which the editorial revisions, +annotations, elaborations, or other modifications represent, as a whole, an +original work of authorship. For the purposes of this License, Derivative Works +shall not include works that remain separable from, or merely link (or bind by +name) to the interfaces of, the Work and Derivative Works thereof. + +"Contribution" shall mean any work of authorship, including the original version +of the Work and any modifications or additions to that Work or Derivative Works +thereof, that is intentionally submitted to Licensor for inclusion in the Work +by the copyright owner or by an individual or Legal Entity authorized to submit +on behalf of the copyright owner. For the purposes of this definition, +"submitted" means any form of electronic, verbal, or written communication sent +to the Licensor or its representatives, including but not limited to +communication on electronic mailing lists, source code control systems, and +issue tracking systems that are managed by, or on behalf of, the Licensor for +the purpose of discussing and improving the Work, but excluding communication +that is conspicuously marked or otherwise designated in writing by the copyright +owner as "Not a Contribution." + +"Contributor" shall mean Licensor and any individual or Legal Entity on behalf +of whom a Contribution has been received by Licensor and subsequently +incorporated within the Work. + +2. Grant of Copyright License. + +Subject to the terms and conditions of this License, each Contributor hereby +grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, +irrevocable copyright license to reproduce, prepare Derivative Works of, +publicly display, publicly perform, sublicense, and distribute the Work and such +Derivative Works in Source or Object form. + +3. Grant of Patent License. + +Subject to the terms and conditions of this License, each Contributor hereby +grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, +irrevocable (except as stated in this section) patent license to make, have +made, use, offer to sell, sell, import, and otherwise transfer the Work, where +such license applies only to those patent claims licensable by such Contributor +that are necessarily infringed by their Contribution(s) alone or by combination +of their Contribution(s) with the Work to which such Contribution(s) was +submitted. If You institute patent litigation against any entity (including a +cross-claim or counterclaim in a lawsuit) alleging that the Work or a +Contribution incorporated within the Work constitutes direct or contributory +patent infringement, then any patent licenses granted to You under this License +for that Work shall terminate as of the date such litigation is filed. + +4. Redistribution. + +You may reproduce and distribute copies of the Work or Derivative Works thereof +in any medium, with or without modifications, and in Source or Object form, +provided that You meet the following conditions: + +You must give any other recipients of the Work or Derivative Works a copy of +this License; and +You must cause any modified files to carry prominent notices stating that You +changed the files; and +You must retain, in the Source form of any Derivative Works that You distribute, +all copyright, patent, trademark, and attribution notices from the Source form +of the Work, excluding those notices that do not pertain to any part of the +Derivative Works; and +If the Work includes a "NOTICE" text file as part of its distribution, then any +Derivative Works that You distribute must include a readable copy of the +attribution notices contained within such NOTICE file, excluding those notices +that do not pertain to any part of the Derivative Works, in at least one of the +following places: within a NOTICE text file distributed as part of the +Derivative Works; within the Source form or documentation, if provided along +with the Derivative Works; or, within a display generated by the Derivative +Works, if and wherever such third-party notices normally appear. The contents of +the NOTICE file are for informational purposes only and do not modify the +License. You may add Your own attribution notices within Derivative Works that +You distribute, alongside or as an addendum to the NOTICE text from the Work, +provided that such additional attribution notices cannot be construed as +modifying the License. +You may add Your own copyright statement to Your modifications and may provide +additional or different license terms and conditions for use, reproduction, or +distribution of Your modifications, or for any such Derivative Works as a whole, +provided Your use, reproduction, and distribution of the Work otherwise complies +with the conditions stated in this License. + +5. Submission of Contributions. + +Unless You explicitly state otherwise, any Contribution intentionally submitted +for inclusion in the Work by You to the Licensor shall be under the terms and +conditions of this License, without any additional terms or conditions. +Notwithstanding the above, nothing herein shall supersede or modify the terms of +any separate license agreement you may have executed with Licensor regarding +such Contributions. + +6. Trademarks. + +This License does not grant permission to use the trade names, trademarks, +service marks, or product names of the Licensor, except as required for +reasonable and customary use in describing the origin of the Work and +reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. + +Unless required by applicable law or agreed to in writing, Licensor provides the +Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, +including, without limitation, any warranties or conditions of TITLE, +NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are +solely responsible for determining the appropriateness of using or +redistributing the Work and assume any risks associated with Your exercise of +permissions under this License. + +8. Limitation of Liability. + +In no event and under no legal theory, whether in tort (including negligence), +contract, or otherwise, unless required by applicable law (such as deliberate +and grossly negligent acts) or agreed to in writing, shall any Contributor be +liable to You for damages, including any direct, indirect, special, incidental, +or consequential damages of any character arising as a result of this License or +out of the use or inability to use the Work (including but not limited to +damages for loss of goodwill, work stoppage, computer failure or malfunction, or +any and all other commercial damages or losses), even if such Contributor has +been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. + +While redistributing the Work or Derivative Works thereof, You may choose to +offer, and charge a fee for, acceptance of support, warranty, indemnity, or +other liability obligations and/or rights consistent with this License. However, +in accepting such obligations, You may act only on Your own behalf and on Your +sole responsibility, not on behalf of any other Contributor, and only if You +agree to indemnify, defend, and hold each Contributor harmless for any liability +incurred by, or claims asserted against, such Contributor by reason of your +accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work + +To apply the Apache License to your work, attach the following boilerplate +notice, with the fields enclosed by brackets "[]" replaced with your own +identifying information. (Don't include the brackets!) The text should be +enclosed in the appropriate comment syntax for the file format. We also +recommend that a file or class name and description of purpose be included on +the same "printed page" as the copyright notice for easier identification within +third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/ql/test/query-tests/Security/CWE-312/vendor/k8s.io/klog/stub.go b/ql/test/query-tests/Security/CWE-312/vendor/k8s.io/klog/stub.go new file mode 100644 index 00000000000..7dbaa5001fc --- /dev/null +++ b/ql/test/query-tests/Security/CWE-312/vendor/k8s.io/klog/stub.go @@ -0,0 +1,12 @@ +// Code generated by depstubber. DO NOT EDIT. +// This is a simple stub for k8s.io/klog, strictly for use in testing. + +// See the LICENSE file for information about the licensing of the original library. +// Source: k8s.io/klog (exports: ; functions: Info) + +// Package klog is a stub of k8s.io/klog, generated by depstubber. +package klog + +import () + +func Info(_ ...interface{}) {} diff --git a/ql/test/query-tests/Security/CWE-312/vendor/modules.txt b/ql/test/query-tests/Security/CWE-312/vendor/modules.txt index b0149947f41..911000aac9e 100644 --- a/ql/test/query-tests/Security/CWE-312/vendor/modules.txt +++ b/ql/test/query-tests/Security/CWE-312/vendor/modules.txt @@ -4,3 +4,6 @@ github.com/golang/glog # github.com/sirupsen/logrus v1.5.0 ## explicit github.com/sirupsen/logrus +# k8s.io/klog v1.0.0 +## explicit +k8s.io/klog