raw HTML
" // $responsebody="raw HTML
" +func (c myAppController) rawRead() { // $responsebody='argument corresponding to c' + c.ViewArgs["Foo"] = "raw HTML
" // $responsebody='"raw HTML
"' c.ViewArgs["Bar"] = "not raw HTML
" - c.ViewArgs["Foo"] = c.Params.Query // $responsebody=selection of Query + c.ViewArgs["Foo"] = c.Params.Query // $responsebody='selection of Query' c.Render() } diff --git a/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/controllers/hotels.go b/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/controllers/hotels.go index b4752fa8fc9..c4b42533e37 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/controllers/hotels.go +++ b/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/controllers/hotels.go @@ -104,7 +104,7 @@ func (c Hotels) ListJson(search string, size, page uint64) revel.Result { var hotels []*models.Hotel - return c.RenderJSON(map[string]interface{}{"hotels": hotels, "search": search, "size": size, "page": page, "nextPage": nextPage}) // $responsebody=map literal + return c.RenderJSON(map[string]interface{}{"hotels": hotels, "search": search, "size": size, "page": page, "nextPage": nextPage}) // $responsebody='map literal' } func (c Hotels) List(search string, size, page uint64) revel.Result { if page == 0 { @@ -155,7 +155,7 @@ func (c Hotels) SaveSettings(password, verifyPassword string) revel.Result { } func (c Hotels) ConfirmBooking(id int, booking models.Booking) revel.Result { - hotel := c.loadHotelById(id) // $responsebody=call to loadHotelById + hotel := c.loadHotelById(id) // $responsebody='call to loadHotelById' if hotel == nil { return c.NotFound("Hotel %d does not exist", id) } diff --git a/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/init.go b/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/init.go index ef5b74fa507..2d9d9fbf7f1 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/init.go +++ b/ql/test/library-tests/semmle/go/frameworks/Revel/examples/booking/app/init.go @@ -33,11 +33,11 @@ func init() { switch event { case revel.ENGINE_BEFORE_INITIALIZED: revel.AddHTTPMux("/this/is/a/test", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprintln(w, "Hi there, it worked", r.URL.Path) // $responsebody=selection of Path $responsebody="Hi there, it worked" + fmt.Fprintln(w, "Hi there, it worked", r.URL.Path) // $responsebody='selection of Path' $responsebody='"Hi there, it worked"' w.WriteHeader(200) })) revel.AddHTTPMux("/this/is/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprintln(w, "Hi there, shorter prefix", r.URL.Path) // $responsebody=selection of Path $responsebody="Hi there, shorter prefix" + fmt.Fprintln(w, "Hi there, shorter prefix", r.URL.Path) // $responsebody='selection of Path' $responsebody='"Hi there, shorter prefix"' w.WriteHeader(200) })) } diff --git a/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql b/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql index b63817f371c..6ec1ec4717c 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql +++ b/ql/test/library-tests/semmle/go/frameworks/Revel/test.ql @@ -41,7 +41,7 @@ class HttpResponseBodyTest extends InlineExpectationsTest { exists(HTTP::ResponseBody rb | rb.hasLocationInfo(file, line, _, _, _) and element = rb.toString() and - value = rb.toString() + value = "'" + rb.toString() + "'" ) } } diff --git a/ql/test/library-tests/semmle/go/frameworks/Yaml/tests.ql b/ql/test/library-tests/semmle/go/frameworks/Yaml/tests.ql index 9c76068a9a0..5aa7aeac95f 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Yaml/tests.ql +++ b/ql/test/library-tests/semmle/go/frameworks/Yaml/tests.ql @@ -11,7 +11,7 @@ class TaintFunctionModelTest extends InlineExpectationsTest { exists(TaintTracking::FunctionModel model, DataFlow::CallNode call | call = model.getACall() | call.hasLocationInfo(file, line, _, _, _) and element = call.toString() and - value = model.getAnInputNode(call) + " -> " + model.getAnOutputNode(call) + value = "\"" + model.getAnInputNode(call) + " -> " + model.getAnOutputNode(call) + "\"" ) } } @@ -27,7 +27,8 @@ class MarshalerTest extends InlineExpectationsTest { call.hasLocationInfo(file, line, _, _, _) and element = call.toString() and value = - m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " + m.getOutput().getNode(call) + "\"" + m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " + + m.getOutput().getNode(call) + "\"" ) } } @@ -43,7 +44,8 @@ class UnmarshalerTest extends InlineExpectationsTest { call.hasLocationInfo(file, line, _, _, _) and element = call.toString() and value = - m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " + m.getOutput().getNode(call) + "\"" + m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " + + m.getOutput().getNode(call) + "\"" ) } } diff --git a/ql/test/library-tests/semmle/go/frameworks/Yaml/yaml.go b/ql/test/library-tests/semmle/go/frameworks/Yaml/yaml.go index d2796eb9997..cf3d29500b2 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Yaml/yaml.go +++ b/ql/test/library-tests/semmle/go/frameworks/Yaml/yaml.go @@ -11,31 +11,31 @@ func main() { var in, out interface{} var inb []byte - out, _ = yaml1.Marshal(in) // $marshaler=yaml: in -> ... = ...[0] $ttfnmodelstep=in -> ... = ...[0] - yaml1.Unmarshal(inb, out) // $unmarshaler=yaml: inb -> definition of out $ttfnmodelstep=inb -> definition of out + out, _ = yaml1.Marshal(in) // $marshaler="yaml: in -> ... = ...[0]" $ttfnmodelstep="in -> ... = ...[0]" + yaml1.Unmarshal(inb, out) // $unmarshaler="yaml: inb -> definition of out" $ttfnmodelstep="inb -> definition of out" - out, _ = yaml2.Marshal(in) // $marshaler=yaml: in -> ... = ...[0] $ttfnmodelstep=in -> ... = ...[0] - yaml2.Unmarshal(inb, out) // $unmarshaler=yaml: inb -> definition of out $ttfnmodelstep=inb -> definition of out - yaml2.UnmarshalStrict(inb, out) // $unmarshaler=yaml: inb -> definition of out $ttfnmodelstep=inb -> definition of out + out, _ = yaml2.Marshal(in) // $marshaler="yaml: in -> ... = ...[0]" $ttfnmodelstep="in -> ... = ...[0]" + yaml2.Unmarshal(inb, out) // $unmarshaler="yaml: inb -> definition of out" $ttfnmodelstep="inb -> definition of out" + yaml2.UnmarshalStrict(inb, out) // $unmarshaler="yaml: inb -> definition of out" $ttfnmodelstep="inb -> definition of out" var r io.Reader - d := yaml2.NewDecoder(r) // $ttfnmodelstep=r -> call to NewDecoder - d.Decode(out) // $ttfnmodelstep=d -> definition of out + d := yaml2.NewDecoder(r) // $ttfnmodelstep="r -> call to NewDecoder" + d.Decode(out) // $ttfnmodelstep="d -> definition of out" var w io.Writer - e := yaml2.NewEncoder(w) // $ttfnmodelstep=definition of e -> definition of w - e.Encode(in) // $ttfnmodelstep=in -> definition of e + e := yaml2.NewEncoder(w) // $ttfnmodelstep="definition of e -> definition of w" + e.Encode(in) // $ttfnmodelstep="in -> definition of e" - out, _ = yaml3.Marshal(in) // $marshaler=yaml: in -> ... = ...[0] $ttfnmodelstep=in -> ... = ...[0] - yaml3.Unmarshal(inb, out) // $unmarshaler=yaml: inb -> definition of out $ttfnmodelstep=inb -> definition of out + out, _ = yaml3.Marshal(in) // $marshaler="yaml: in -> ... = ...[0]" $ttfnmodelstep="in -> ... = ...[0]" + yaml3.Unmarshal(inb, out) // $unmarshaler="yaml: inb -> definition of out" $ttfnmodelstep="inb -> definition of out" - d1 := yaml3.NewDecoder(r) // $ttfnmodelstep=r -> call to NewDecoder - d1.Decode(out) // $ttfnmodelstep=d1 -> definition of out + d1 := yaml3.NewDecoder(r) // $ttfnmodelstep="r -> call to NewDecoder" + d1.Decode(out) // $ttfnmodelstep="d1 -> definition of out" - e1 := yaml3.NewEncoder(w) // $ttfnmodelstep=definition of e1 -> definition of w - e1.Encode(in) // $ttfnmodelstep=in -> definition of e1 + e1 := yaml3.NewEncoder(w) // $ttfnmodelstep="definition of e1 -> definition of w" + e1.Encode(in) // $ttfnmodelstep="in -> definition of e1" var n1 yaml3.Node - n1.Decode(out) // $ttfnmodelstep=n1 -> definition of out - n1.Encode(in) // $ttfnmodelstep=in -> definition of n1 + n1.Decode(out) // $ttfnmodelstep="n1 -> definition of out" + n1.Encode(in) // $ttfnmodelstep="in -> definition of n1" } diff --git a/ql/test/library-tests/semmle/go/frameworks/Zap/TaintFlows.ql b/ql/test/library-tests/semmle/go/frameworks/Zap/TaintFlows.ql index a423807e2e7..390ef7a60de 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Zap/TaintFlows.ql +++ b/ql/test/library-tests/semmle/go/frameworks/Zap/TaintFlows.ql @@ -22,7 +22,7 @@ class ZapTest extends InlineExpectationsTest { tag = "zap" and exists(DataFlow::Node sink | any(TestConfig c).hasFlow(_, sink) | element = sink.toString() and - value = sink.toString() and + value = "\"" + sink.toString() + "\"" and sink.hasLocationInfo(file, line, _, _, _) ) } diff --git a/ql/test/library-tests/semmle/go/frameworks/Zap/test.go b/ql/test/library-tests/semmle/go/frameworks/Zap/test.go index 0e1932ba696..63f10b5273e 100644 --- a/ql/test/library-tests/semmle/go/frameworks/Zap/test.go +++ b/ql/test/library-tests/semmle/go/frameworks/Zap/test.go @@ -18,72 +18,72 @@ func getUntrustedString() string { func testZapLoggerDPanic() { logger, _ := zap.NewProduction() - logger.DPanic(getUntrustedString()) // $zap=call to getUntrustedString + logger.DPanic(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapLoggerFatal() { logger := zap.NewExample() - logger.Fatal("msg", zap.String(getUntrustedString(), "value")) // $zap=call to String + logger.Fatal("msg", zap.String(getUntrustedString(), "value")) // $zap="call to String" } func testZapLoggerPanic() { logger, _ := zap.NewDevelopment() - logger.Panic("msg", zap.Any("key", getUntrustedData())) // $zap=call to Any + logger.Panic("msg", zap.Any("key", getUntrustedData())) // $zap="call to Any" } func testZapLoggerDebug(core zapcore.Core, byteArray []byte) { logger := zap.New(core) - logger.Debug(getUntrustedString()) // $zap=call to getUntrustedString - logger.Debug("msg", zap.Binary(getUntrustedString(), byteArray)) // $zap=call to Binary - logger.Debug("msg", zap.ByteString("key", getUntrustedData().([]byte))) // $zap=call to ByteString + logger.Debug(getUntrustedString()) // $zap="call to getUntrustedString" + logger.Debug("msg", zap.Binary(getUntrustedString(), byteArray)) // $zap="call to Binary" + logger.Debug("msg", zap.ByteString("key", getUntrustedData().([]byte))) // $zap="call to ByteString" } func testZapLoggerError(bss [][]byte) { logger := zap.L() - logger.Error(getUntrustedString()) // $zap=call to getUntrustedString - logger.Error("msg", zap.ByteStrings(getUntrustedString(), bss)) // $zap=call to ByteStrings - logger.Error("msg", zap.Error(getUntrustedData().(error))) // $zap=call to Error + logger.Error(getUntrustedString()) // $zap="call to getUntrustedString" + logger.Error("msg", zap.ByteStrings(getUntrustedString(), bss)) // $zap="call to ByteStrings" + logger.Error("msg", zap.Error(getUntrustedData().(error))) // $zap="call to Error" } func testZapLoggerInfo(logger *zap.Logger, errs []error) { - logger.Info(getUntrustedString()) // $zap=call to getUntrustedString - logger.Info("msg", zap.Errors(getUntrustedString(), errs)) // $zap=call to Errors - logger.Info("msg", zap.NamedError("key", getUntrustedData().(error))) // $zap=call to NamedError + logger.Info(getUntrustedString()) // $zap="call to getUntrustedString" + logger.Info("msg", zap.Errors(getUntrustedString(), errs)) // $zap="call to Errors" + logger.Info("msg", zap.NamedError("key", getUntrustedData().(error))) // $zap="call to NamedError" } func testZapLoggerWarn(logger *zap.Logger) { - logger.Warn(getUntrustedString()) // $zap=call to getUntrustedString - logger.Warn("msg", zap.Reflect(getUntrustedString(), nil)) // $zap=call to Reflect - logger.Warn("msg", zap.Stringp("key", getUntrustedData().(*string))) // $zap=call to Stringp - logger.Warn("msg", zap.Strings("key", getUntrustedData().([]string))) // $zap=call to Strings + logger.Warn(getUntrustedString()) // $zap="call to getUntrustedString" + logger.Warn("msg", zap.Reflect(getUntrustedString(), nil)) // $zap="call to Reflect" + logger.Warn("msg", zap.Stringp("key", getUntrustedData().(*string))) // $zap="call to Stringp" + logger.Warn("msg", zap.Strings("key", getUntrustedData().([]string))) // $zap="call to Strings" } func testZapLoggerNop() { // We do not currently recognise that a logger made using NewNop() does not actually do any logging logger := zap.NewNop() - logger.Debug(getUntrustedString()) // $SPURIOUS:zap=call to getUntrustedString + logger.Debug(getUntrustedString()) // $SPURIOUS:zap="call to getUntrustedString" } func testLoggerNamed(logger *zap.Logger) { - namedLogger := logger.Named(getUntrustedString()) // $zap=call to getUntrustedString + namedLogger := logger.Named(getUntrustedString()) // $zap="call to getUntrustedString" namedLogger.Info("hello world") } func testLoggerWith(logger *zap.Logger) *zap.Logger { - logger1 := logger.With(zap.Any(getUntrustedString(), nil)) // $zap=call to Any + logger1 := logger.With(zap.Any(getUntrustedString(), nil)) // $zap="call to Any" logger1.Info("hello world") - logger2 := logger.With(zap.String("key", getUntrustedString())) // $zap=call to String + logger2 := logger.With(zap.String("key", getUntrustedString())) // $zap="call to String" logger2.Info("hello world") - logger3 := logger.With(zap.String("key", getUntrustedString())) // $SPURIOUS:zap=call to String + logger3 := logger.With(zap.String("key", getUntrustedString())) // $SPURIOUS:zap="call to String" return logger3 } func getLoggerWithUntrustedField() *zap.Logger { - return zap.NewExample().With(zap.NamedError("key", getUntrustedData().(error))) // $zap=call to NamedError + return zap.NewExample().With(zap.NamedError("key", getUntrustedData().(error))) // $zap="call to NamedError" } func getLoggerWithUntrustedFieldUnused() *zap.Logger { - return zap.NewExample().With(zap.NamedError("key", getUntrustedData().(error))) // $SPURIOUS:zap=call to NamedError + return zap.NewExample().With(zap.NamedError("key", getUntrustedData().(error))) // $SPURIOUS:zap="call to NamedError" } func testLoggerWithAcrossFunctionBoundary() { @@ -91,91 +91,91 @@ func testLoggerWithAcrossFunctionBoundary() { } func testLoggerWithOptions(logger *zap.Logger) *zap.Logger { - logger1 := logger.WithOptions(zap.Fields(zap.Any(getUntrustedString(), nil))) // $zap=call to Fields + logger1 := logger.WithOptions(zap.Fields(zap.Any(getUntrustedString(), nil))) // $zap="call to Fields" logger1.Info("hello world") - logger2 := logger.WithOptions(zap.Fields(zap.String("key", getUntrustedString()))) // $zap=call to Fields + logger2 := logger.WithOptions(zap.Fields(zap.String("key", getUntrustedString()))) // $zap="call to Fields" logger2.Info("hello world") - logger3 := logger.WithOptions(zap.Fields(zap.String("key", getUntrustedString()))) // $SPURIOUS:zap=call to Fields + logger3 := logger.WithOptions(zap.Fields(zap.String("key", getUntrustedString()))) // $SPURIOUS:zap="call to Fields" return logger3 } func testZapSugaredLoggerDPanic(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.DPanic(getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.DPanic(getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerDPanicf(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.DPanicf(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.DPanicf(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapSugaredLoggerDPanicw(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.DPanicw(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.DPanicw(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapSugaredLoggerFatal(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.Fatal(getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.Fatal(getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerFatalf(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.Fatalf(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.Fatalf(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapSugaredLoggerFatalw(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.Fatalw(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.Fatalw(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapSugaredLoggerPanic(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.Panic(getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.Panic(getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerPanicf(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.Panicf(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.Panicf(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapSugaredLoggerPanicw(sugaredLogger *zap.SugaredLogger) { - sugaredLogger.Panicw(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.Panicw(getUntrustedString()) // $zap="call to getUntrustedString" } func testZapSugaredLoggerDebug() { sugaredLogger := zap.S() - sugaredLogger.Debug(getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Debugf("msg", getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Debugw("msg", "key", getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.Debug(getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Debugf("msg", getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Debugw("msg", "key", getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerError() { logger, _ := zap.NewProduction() sugaredLogger := logger.Sugar() - sugaredLogger.Error(getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Errorf("msg", getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Errorw("msg", "key", getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.Error(getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Errorf("msg", getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Errorw("msg", "key", getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerInfo() { logger := zap.NewExample() sugaredLogger := logger.Sugar() - sugaredLogger.Info(getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Infof("msg", getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Infow("msg", "key", getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.Info(getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Infof("msg", getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Infow("msg", "key", getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerWarn() { logger, _ := zap.NewDevelopment() sugaredLogger := logger.Sugar() - sugaredLogger.Warn(getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Warnf("msg", getUntrustedData()) // $zap=call to getUntrustedData - sugaredLogger.Warnw("msg", "key", getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.Warn(getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Warnf("msg", getUntrustedData()) // $zap="call to getUntrustedData" + sugaredLogger.Warnw("msg", "key", getUntrustedData()) // $zap="call to getUntrustedData" } func testZapSugaredLoggerNamed() { logger := zap.L() sugaredLogger := logger.Sugar() - sugaredLogger.Named(getUntrustedString()) // $zap=call to getUntrustedString + sugaredLogger.Named(getUntrustedString()) // $zap="call to getUntrustedString" sugaredLogger.Info("msg") } func testZapSugaredLoggerWith() { logger := zap.L() sugaredLogger := logger.Sugar() - sugaredLogger.With("key", getUntrustedData()) // $zap=call to getUntrustedData + sugaredLogger.With("key", getUntrustedData()) // $zap="call to getUntrustedData" sugaredLogger.Info("msg") }