hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rename predicates to avoid clashes

Browse Source
This commit is contained in:
Owen Mansel-Chan
2022-10-26 15:28:48 +01:00
parent 1718ef88be
commit f2e2c02db6
15 changed files with 62 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll
View File

@@ -48,11 +48,11 @@ module AllocationSizeOverflow {
* Holds if `nd` is at a position where overflow might occur, and its result is used to compute
* allocation size `allocsz`.
*/
predicate isSink(DataFlow::Node nd, DataFlow::Node allocsz) {
predicate isSinkWithAllocationSize(DataFlow::Node nd, DataFlow::Node allocsz) {
nd.(Sink).getAllocationSize() = allocsz
}
override predicate isSink(DataFlow::Node nd) { isSink(nd, _) }
override predicate isSink(DataFlow::Node nd) { isSinkWithAllocationSize(nd, _) }
override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
additionalStep(pred, succ)

6
go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll
View File

@@ -109,7 +109,7 @@ class ConversionWithoutBoundsCheckConfig extends TaintTracking::Configuration {
* not also in a right-shift expression. We allow this case because it is
* a common pattern to serialise `byte(v)`, `byte(v >> 8)`, and so on.
*/
predicate isSink(DataFlow::TypeCastNode sink, int bitSize) {
predicate isSinkWithBitSize(DataFlow::TypeCastNode sink, int bitSize) {
sink.asExpr() instanceof ConversionExpr and
exists(IntegerType integerType | sink.getResultType().getUnderlyingType() = integerType |
bitSize = integerType.getSize()
@@ -125,7 +125,7 @@ class ConversionWithoutBoundsCheckConfig extends TaintTracking::Configuration {
)
}
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, sinkBitSize) }
override predicate isSink(DataFlow::Node sink) { this.isSinkWithBitSize(sink, sinkBitSize) }
override predicate isSanitizer(DataFlow::Node node) {
// To catch flows that only happen on 32-bit architectures we
@@ -140,7 +140,7 @@ class ConversionWithoutBoundsCheckConfig extends TaintTracking::Configuration {
override predicate isSanitizerOut(DataFlow::Node node) {
exists(int bitSize | isIncorrectIntegerConversion(sourceBitSize, bitSize) |
this.isSink(node, bitSize)
this.isSinkWithBitSize(node, bitSize)
)
}
}

4
go/ql/lib/semmle/go/security/InsecureRandomness.qll
View File

@@ -25,10 +25,10 @@ module InsecureRandomness {
override predicate isSource(DataFlow::Node source) { source instanceof Source }
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.isSinkWithKind(sink, _) }
/** Holds if `sink` is a sink for this configuration with kind `kind`. */
predicate isSink(Sink sink, string kind) { kind = sink.getKind() }
predicate isSinkWithKind(Sink sink, string kind) { kind = sink.getKind() }
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
}

6
go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql
View File

@@ -83,7 +83,7 @@ predicate regexpGuardsError(RegexpPattern regexp) {
class Config extends DataFlow::Configuration {
Config() { this = "IncompleteHostNameRegexp::Config" }
predicate isSource(DataFlow::Node source, string hostPart) {
predicate isSourceString(DataFlow::Node source, string hostPart) {
exists(Expr e |
e = source.asExpr() and
isIncompleteHostNameRegexpPattern(e.getStringValue(), hostPart)
@@ -95,7 +95,7 @@ class Config extends DataFlow::Configuration {
)
}
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
override predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
override predicate isSink(DataFlow::Node sink) {
sink instanceof RegexpPattern and
@@ -107,7 +107,7 @@ class Config extends DataFlow::Configuration {
}
from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string hostPart
where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), hostPart)
where c.hasFlowPath(source, sink) and c.isSourceString(source.getNode(), hostPart)
select source, source, sink,
"This regular expression has an unescaped dot before '" + hostPart + "', " +
"so it might match more hosts than expected when $@.", sink, "the regular expression is used"

6
go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql
View File

@@ -63,7 +63,7 @@ predicate isInterestingUnanchoredRegexpString(string re, string msg) {
class Config extends DataFlow::Configuration {
Config() { this = "MissingRegexpAnchor::Config" }
predicate isSource(DataFlow::Node source, string msg) {
predicate isSourceString(DataFlow::Node source, string msg) {
exists(Expr e | e = source.asExpr() |
isInterestingUnanchoredRegexpString(e.getStringValue(), msg)
or
@@ -71,11 +71,11 @@ class Config extends DataFlow::Configuration {
)
}
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
override predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
override predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
}
from Config c, DataFlow::PathNode source, string msg
where c.hasFlowPath(source, _) and c.isSource(source.getNode(), msg)
where c.hasFlowPath(source, _) and c.isSourceString(source.getNode(), msg)
select source.getNode(), msg

6
go/ql/src/Security/CWE-020/SuspiciousCharacterInRegexp.ql
View File

@@ -32,7 +32,7 @@ predicate containsEscapedCharacter(DataFlow::Node source, string character) {
class Config extends DataFlow::Configuration {
Config() { this = "SuspiciousRegexpEscape" }
predicate isSource(DataFlow::Node source, string report) {
predicate isSourceString(DataFlow::Node source, string report) {
containsEscapedCharacter(source, "a") and
report =
"the bell character \\a; did you mean \\\\a, the Vim alphabetic character class (use [[:alpha:]] instead) or \\\\A, the beginning of text?"
@@ -41,12 +41,12 @@ class Config extends DataFlow::Configuration {
report = "a literal backspace \\b; did you mean \\\\b, a word boundary?"
}
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
override predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
override predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
}
from Config c, DataFlow::PathNode source, DataFlow::PathNode sink, string report
where c.hasFlowPath(source, sink) and c.isSource(source.getNode(), report)
where c.hasFlowPath(source, sink) and c.isSourceString(source.getNode(), report)
select source, source, sink, "This string literal that is $@ contains " + report, sink,
"used as a regular expression"

2
go/ql/src/Security/CWE-190/AllocationSizeOverflow.ql
View File

@@ -20,7 +20,7 @@ from
DataFlow::Node allocsz
where
cfg.hasFlowPath(source, sink) and
cfg.isSink(sink.getNode(), allocsz)
cfg.isSinkWithAllocationSize(sink.getNode(), allocsz)
select sink, source, sink,
"This operation, which is used in an $@, involves a $@ and might overflow.", allocsz,
"allocation", source, "potentially large value"

8
go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
View File

@@ -66,14 +66,14 @@ class HostKeyCallbackAssignmentConfig extends DataFlow::Configuration {
/**
* Holds if `sink` is a value written by `write` to a field `ClientConfig.HostKeyCallback`.
*/
predicate isSink(DataFlow::Node sink, Write write) {
predicate writeIsSink(DataFlow::Node sink, Write write) {
exists(Field f |
f.hasQualifiedName(CryptoSsh::packagePath(), "ClientConfig", "HostKeyCallback") and
write.writesField(_, f, sink)
)
}
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.writeIsSink(sink, _) }
}
/**
@@ -92,8 +92,8 @@ predicate hostCheckReachesSink(DataFlow::PathNode sink) {
SsaWithFields sinkAccessPath, SsaWithFields otherSinkAccessPath
|
config.hasFlowPath(source, otherSink) and
config.isSink(sink.getNode(), sinkWrite) and
config.isSink(otherSink.getNode(), otherSinkWrite) and
config.writeIsSink(sink.getNode(), sinkWrite) and
config.writeIsSink(otherSink.getNode(), otherSinkWrite) and
sinkWrite.writesField(sinkAccessPath.getAUse(), _, sink.getNode()) and
otherSinkWrite.writesField(otherSinkAccessPath.getAUse(), _, otherSink.getNode()) and
otherSinkAccessPath = sinkAccessPath.similar()

8
go/ql/src/Security/CWE-327/InsecureTLS.ql
View File

@@ -60,7 +60,7 @@ class TlsVersionFlowConfig extends TaintTracking::Configuration {
/**
* Holds if `source` is a TLS version source yielding value `val`.
*/
predicate isSource(DataFlow::Node source, int val) {
predicate intIsSource(DataFlow::Node source, int val) {
val = source.getIntValue() and
val = getATlsVersion() and
not DataFlow::isReturnedWithError(source)
@@ -74,7 +74,7 @@ class TlsVersionFlowConfig extends TaintTracking::Configuration {
fieldWrite.writesField(base, fld, sink)
}
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
override predicate isSource(DataFlow::Node source) { intIsSource(source, _) }
override predicate isSink(DataFlow::Node sink) { isSink(sink, _, _, _) }
}
@@ -87,7 +87,7 @@ predicate secureTlsVersionFlow(
) {
exists(int version |
config.hasFlowPath(source, sink) and
config.isSource(source.getNode(), version) and
config.intIsSource(source.getNode(), version) and
not isInsecureTlsVersion(version, _, fld.getName())
)
}
@@ -130,7 +130,7 @@ predicate isInsecureTlsVersionFlow(
) {
exists(TlsVersionFlowConfig cfg, int version, Field fld |
cfg.hasFlowPath(source, sink) and
cfg.isSource(source.getNode(), version) and
cfg.intIsSource(source.getNode(), version) and
cfg.isSink(sink.getNode(), fld, base, _) and
isInsecureTlsVersion(version, _, fld.getName()) and
// Exclude cases where a secure TLS version can also flow to the same

2
go/ql/src/Security/CWE-338/InsecureRandomness.ql
View File

@@ -17,7 +17,7 @@ import DataFlow::PathGraph
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, string kind
where
cfg.hasFlowPath(source, sink) and
cfg.isSink(sink.getNode(), kind) and
cfg.isSinkWithKind(sink.getNode(), kind) and
(
kind != "A password-related function"
or

16
go/ql/src/Security/CWE-352/ConstantOauth2State.ql
View File

@@ -31,7 +31,7 @@ class AuthCodeUrl extends Method {
class ConstantStateFlowConf extends DataFlow::Configuration {
ConstantStateFlowConf() { this = "ConstantStateFlowConf" }
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
exists(AuthCodeUrl m | call = m.getACall() | sink = call.getArgument(0))
}
@@ -46,7 +46,7 @@ class ConstantStateFlowConf extends DataFlow::Configuration {
)
}
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.isSinkCall(sink, _) }
}
/**
@@ -109,11 +109,11 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
any(Fmt::AppenderOrSprinter s).taintStep(pred, succ)
}
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
exists(AuthCodeUrl m | call = m.getACall() | sink = call.getReceiver())
}
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.isSinkCall(sink, _) }
}
/**
@@ -126,7 +126,7 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
predicate privateUrlFlowsToAuthCodeUrlCall(DataFlow::CallNode call) {
exists(PrivateUrlFlowsToAuthCodeUrlCall flowConfig, DataFlow::Node receiver |
flowConfig.hasFlowTo(receiver) and
flowConfig.isSink(receiver, call)
flowConfig.isSinkCall(receiver, call)
)
}
@@ -134,7 +134,7 @@ predicate privateUrlFlowsToAuthCodeUrlCall(DataFlow::CallNode call) {
class FlowToPrint extends DataFlow::Configuration {
FlowToPrint() { this = "FlowToPrint" }
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
exists(LoggerCall logCall | call = logCall | sink = logCall.getAMessageComponent())
}
@@ -142,7 +142,7 @@ class FlowToPrint extends DataFlow::Configuration {
source = any(AuthCodeUrl m).getACall().getResult()
}
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.isSinkCall(sink, _) }
}
/** Holds if the provided `CallNode`'s result flows to an argument of a printer call. */
@@ -198,7 +198,7 @@ from
DataFlow::CallNode sinkCall
where
cfg.hasFlowPath(source, sink) and
cfg.isSink(sink.getNode(), sinkCall) and
cfg.isSinkCall(sink.getNode(), sinkCall) and
// Exclude cases that seem to be oauth flows done from within a terminal:
not seemsLikeDoneWithinATerminal(sinkCall) and
not privateUrlFlowsToAuthCodeUrlCall(sinkCall)

6
go/ql/src/Security/CWE-601/BadRedirectCheck.ql
View File

@@ -94,13 +94,13 @@ predicate urlPath(DataFlow::Node nd) {
class Configuration extends TaintTracking::Configuration {
Configuration() { this = "BadRedirectCheck" }
override predicate isSource(DataFlow::Node source) { this.isSource(source, _) }
override predicate isSource(DataFlow::Node source) { this.isCheckedSource(source, _) }
/**
* Holds if `source` is the first node that flows into a use of a variable that is checked by a
* bad redirect check `check`..
*/
predicate isSource(DataFlow::Node source, DataFlow::Node check) {
predicate isCheckedSource(DataFlow::Node source, DataFlow::Node check) {
exists(SsaWithFields v |
DataFlow::localFlow(source, v.getAUse()) and
not exists(source.getAPredecessor()) and
@@ -170,7 +170,7 @@ predicate isBadRedirectCheckWrapper(DataFlow::Node check, FuncDef f, FunctionInp
from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node check
where
cfg.isSource(source.getNode(), check) and
cfg.isCheckedSource(source.getNode(), check) and
cfg.hasFlowPath(source, sink)
select check, source, sink,
"This is a check that $@, which flows into a $@, has a leading slash, but not that it does not have '/' or '\\' in its second position.",

12
go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql
View File

@@ -61,7 +61,7 @@ class FlowsUntrustedToAllowOriginHeader extends TaintTracking::Configuration {
override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
predicate isSink(DataFlow::Node sink, AllowOriginHeaderWrite hw) { sink = hw.getValue() }
predicate isSinkHW(DataFlow::Node sink, AllowOriginHeaderWrite hw) { sink = hw.getValue() }
override predicate isSanitizer(DataFlow::Node node) {
exists(ControlFlow::ConditionGuardNode cgn |
@@ -71,7 +71,7 @@ class FlowsUntrustedToAllowOriginHeader extends TaintTracking::Configuration {
)
}
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.isSinkHW(sink, _) }
}
/**
@@ -95,7 +95,7 @@ predicate allowCredentialsIsSetToTrue(AllowOriginHeaderWrite allowOriginHW) {
predicate flowsFromUntrustedToAllowOrigin(AllowOriginHeaderWrite allowOriginHW, string message) {
exists(FlowsUntrustedToAllowOriginHeader cfg, DataFlow::Node sink |
cfg.hasFlowTo(sink) and
cfg.isSink(sink, allowOriginHW)
cfg.isSinkHW(sink, allowOriginHW)
|
message =
headerAllowOrigin() + " header is set to a user-defined value, and " +
@@ -130,9 +130,9 @@ class FlowsFromUntrusted extends TaintTracking::Configuration {
override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
override predicate isSink(DataFlow::Node sink) { this.isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { this.isSinkCgn(sink, _) }
predicate isSink(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn) {
predicate isSinkCgn(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn) {
exists(IfStmt ifs |
exists(Expr operand |
operand = ifs.getCond().getAChildExpr*() and
@@ -171,7 +171,7 @@ class FlowsFromUntrusted extends TaintTracking::Configuration {
*/
predicate flowsToGuardedByCheckOnUntrusted(AllowOriginHeaderWrite allowOriginHW) {
exists(FlowsFromUntrusted cfg, DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn |
cfg.hasFlowTo(sink) and cfg.isSink(sink, cgn)
cfg.hasFlowTo(sink) and cfg.isSinkCgn(sink, cgn)
|
cgn.dominates(allowOriginHW.getBasicBlock())
)

22
go/ql/src/experimental/Unsafe/WrongUsageOfUnsafe.ql
View File

@@ -41,16 +41,18 @@ class ConversionToUnsafePointer extends DataFlow::TypeCastNode {
class UnsafeTypeCastingConf extends TaintTracking::Configuration {
UnsafeTypeCastingConf() { this = "UnsafeTypeCastingConf" }
predicate isSource(DataFlow::Node source, ConversionToUnsafePointer conv) { source = conv }
predicate conversionIsSource(DataFlow::Node source, ConversionToUnsafePointer conv) {
source = conv
}
predicate isSink(DataFlow::Node sink, DataFlow::TypeCastNode ca) {
predicate typeCastNodeIsSink(DataFlow::Node sink, DataFlow::TypeCastNode ca) {
ca.getOperand().getType() instanceof UnsafePointerType and
sink = ca
}
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
override predicate isSource(DataFlow::Node source) { conversionIsSource(source, _) }
override predicate isSink(DataFlow::Node sink) { isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { typeCastNodeIsSink(sink, _) }
}
/*
@@ -66,8 +68,8 @@ predicate castShortArrayToLongerArray(
ArrayType arrTo, ArrayType arrFrom, int arrFromSize
|
cfg.hasFlowPath(source, sink) and
cfg.isSource(source.getNode(), castLittle) and
cfg.isSink(sink.getNode(), castBig) and
cfg.conversionIsSource(source.getNode(), castLittle) and
cfg.typeCastNodeIsSink(sink.getNode(), castBig) and
arrTo = getFinalType(castBig.getResultType()) and
(
// Array (whole) to array:
@@ -111,8 +113,8 @@ predicate castTypeToArray(DataFlow::PathNode source, DataFlow::PathNode sink, st
ArrayType arrTo, Type typeFrom
|
cfg.hasFlowPath(source, sink) and
cfg.isSource(source.getNode(), castLittle) and
cfg.isSink(sink.getNode(), castBig) and
cfg.conversionIsSource(source.getNode(), castLittle) and
cfg.typeCastNodeIsSink(sink.getNode(), castBig) and
arrTo = getFinalType(castBig.getResultType()) and
not typeFrom.getUnderlyingType() instanceof ArrayType and
not typeFrom instanceof PointerType and
@@ -141,8 +143,8 @@ predicate castDifferentBitSizeNumbers(
NumericType numTo, NumericType numFrom
|
cfg.hasFlowPath(source, sink) and
cfg.isSource(source.getNode(), castLittle) and
cfg.isSink(sink.getNode(), castBig) and
cfg.conversionIsSource(source.getNode(), castLittle) and
cfg.typeCastNodeIsSink(sink.getNode(), castBig) and
numTo = getFinalType(castBig.getResultType()) and
numFrom = getFinalType(castLittle.getOperand().getType()) and
// TODO: also consider cast from uint to int?

14
go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/StdlibTaintFlow.ql
View File

@@ -13,13 +13,13 @@ class Link extends TaintTracking::FunctionModel {
}
}
predicate isSource(DataFlow::Node source, DataFlow::CallNode call) {
predicate callResultisSource(DataFlow::Node source, DataFlow::CallNode call) {
exists(Function fn | fn.hasQualifiedName(_, "newSource") |
call = fn.getACall() and source = call.getResult()
)
}
predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
predicate callArgumentisSink(DataFlow::Node sink, DataFlow::CallNode call) {
exists(Function fn | fn.hasQualifiedName(_, "sink") |
call = fn.getACall() and sink = call.getArgument(1)
)
@@ -28,9 +28,9 @@ predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
class FlowConf extends TaintTracking::Configuration {
FlowConf() { this = "FlowConf" }
override predicate isSource(DataFlow::Node source) { isSource(source, _) }
override predicate isSource(DataFlow::Node source) { callResultisSource(source, _) }
override predicate isSink(DataFlow::Node sink) { isSink(sink, _) }
override predicate isSink(DataFlow::Node sink) { callArgumentisSink(sink, _) }
}
/**
@@ -43,8 +43,8 @@ predicate flowsToSink(DataFlow::CallNode sourceCall) {
|
cfg.hasFlowPath(source, sink) and
(
isSource(source.getNode(), sourceCall) and
isSink(sink.getNode(), sinkCall) and
callResultisSource(source.getNode(), sourceCall) and
callArgumentisSink(sink.getNode(), sinkCall) and
sourceCall.getArgument(0).getIntValue() = sinkCall.getArgument(0).getIntValue()
)
)
@@ -52,5 +52,5 @@ predicate flowsToSink(DataFlow::CallNode sourceCall) {
/* Show only flow sources that DON'T flow to their dedicated sink. */
from DataFlow::CallNode sourceCall
where isSource(_, sourceCall) and not flowsToSink(sourceCall)
where callResultisSource(_, sourceCall) and not flowsToSink(sourceCall)
select sourceCall, "No flow to its sink"