Owen Mansel-Chan
3cbce80d0b
Add SimpleTypeSanitizer to go/request-forgery
2025-10-09 12:17:21 +01:00
Owen Mansel-Chan
7599fdd8fa
Add request forgery test for numeric type
2025-10-09 12:17:19 +01:00
Owen Mansel-Chan
2629369c93
Improve additional flow step for Host field
2025-10-01 16:18:05 +01:00
Owen Mansel-Chan
6d6852fb8d
Test PathAssignmentBarrier for OpenUrlRedirect
2025-10-01 16:18:02 +01:00
Owen Mansel-Chan
f0f5fc7eac
Improve SSRF additional flow step
2025-10-01 16:18:00 +01:00
Owen Mansel-Chan
c9ce2c8043
Add test for assignment to Url.Host field
2025-10-01 16:17:58 +01:00
Owen Mansel-Chan
8b04d0a2b9
Convert SSRF tests to inline expectations tests
2025-10-01 16:17:57 +01:00
Owen Mansel-Chan
6e4dbe8e22
Fix SafeUrlFlow so test passes
2025-10-01 16:17:52 +01:00
Owen Mansel-Chan
620ae33e0c
Make SafeUrlFlow test more comprehensive (failing)
2025-10-01 16:17:04 +01:00
Owen Mansel-Chan
c9a2816bfe
Fix OpenUrlRedirect barrier for write to Url.Host
2025-10-01 16:13:24 +01:00
Owen Mansel-Chan
414bab1f30
Add OpenUrlRedirect tests for Url.Host field
2025-10-01 16:13:22 +01:00
Owen Mansel-Chan
1144bb99b4
Convert OpenUrlRedirect tests to InlineExpectations
2025-10-01 16:13:21 +01:00
Owen Mansel-Chan
25f182302d
Fix email injection sink that needs local flow
2025-10-01 16:13:10 +01:00
Owen Mansel-Chan
52b6539697
Typo
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-10-01 16:13:06 +01:00
Owen Mansel-Chan
5efc8ac1a4
Fix backwards flow through TaintTracking::FunctionModel
...
We only do this for taint models as there isn't any backwards flow
through data flow function models.
2025-10-01 16:13:01 +01:00
Owen Mansel-Chan
3906f2560d
Adjust Stack Exposure test so it passes
...
A minor bug in our CFG means that we evaluate the base of a
SliceExpr before the bounds. Since the bounds may have side
effects, as in this case, it would be better to evaluate them first.
But in the short term I am just adjusting the test to make it work.
2025-10-01 16:12:59 +01:00
Owen Mansel-Chan
62155876c5
Fix flow to variable capture
...
The jump step to a `SsaCaptureVariable` should start at the last use
before it, rather than from the previous definition.
2025-10-01 16:12:57 +01:00
Owen Mansel-Chan
cf6cfe2a1e
Non-initializing writes should target post-update nodes
2025-10-01 16:12:54 +01:00
Owen Mansel-Chan
8a3bd8408b
Fix test expectations for Cleartext Logging
...
One spurious alert was removed, one missing alert was added, and some
source locations changed.
2025-10-01 16:12:52 +01:00
Owen Mansel-Chan
3229630598
Make store step to send stmt's channel use post-update node
2025-10-01 16:12:51 +01:00
Owen Mansel-Chan
ac71f9cd8e
Expected change in test output
...
These sources are now modeled using models-as-data, which (probably
correctly) uses the post-update node as the source. But the deprecated
QL models still exist, so we get two test results for each of these
calls.
2025-10-01 16:12:49 +01:00
Owen Mansel-Chan
d2230c531d
Expected changes in test output
2025-10-01 16:12:47 +01:00
Owen Mansel-Chan
118def8d28
Make separate post-update nodes
2025-10-01 16:12:45 +01:00
Owen Mansel-Chan
a0c647ce83
Add Email Injection tests for reverse flow models
2025-10-01 16:12:43 +01:00
Owen Mansel-Chan
9892836f14
Switch order of PUN test output
2025-10-01 16:12:42 +01:00
Owen Mansel-Chan
14301e0af4
Expected changes in dataflow edges
2025-10-01 16:12:28 +01:00
Owen Mansel-Chan
c20abf6d58
Line numbers change because 3 lines were added
2025-10-01 16:12:27 +01:00
Owen Mansel-Chan
521066578b
Test result that was missing is now found
2025-10-01 16:12:25 +01:00
Owen Mansel-Chan
3594dba83c
Make insecure randomness test more realistic
2025-10-01 16:12:24 +01:00
Owen Mansel-Chan
b2a9cecd69
Fix Allocation Size Overflow for use-use flow
...
We have an operator expression like `x * 5`. We want to follow where the
value of the operator expression goes. We used to follow local flow from
an operand, but now there is flow from that operand to the next use of
the variable. The fix is to explicitly start local flow from the
operator expression.
There are also some expected edge changes due to use-use flow.
2025-10-01 16:12:18 +01:00
Owen Mansel-Chan
16a11b48ad
Switch to use-use dataflow. This will make post-update nodes easy to implement.
...
Queries / tests that required changes:
* The CleartextLogging and MissingErrorCheck queries are updated because they assumed def-use flow
* The CommandInjection query works around the shortcomings of use-use flow by essentially reintroducing def-use flow when it applies a sanitizer
* The OpenUrlRedirect query currently just accepts its fate; the tests are updated to avoid excess sanitization while the query comments on the problem. We should choose this approach or the CommandInjection one.
2025-10-01 16:12:07 +01:00
Owen Mansel-Chan
ff3d795a8f
Merge pull request #20556 from owen-mc/go/test/safeurlflow
...
Go: Add tests for SafeUrlFlow, and fix a latent bug
2025-10-01 15:05:55 +01:00
Owen Mansel-Chan
8983ac9212
Phrase test in terms of safe URLs
2025-10-01 14:13:15 +01:00
Owen Mansel-Chan
c93852d87a
Improve comments in test file
2025-10-01 11:01:58 +01:00
Owen Mansel-Chan
a2a9575587
Add tests for safe URL flow
2025-09-30 15:05:42 +01:00
Chris Smowton
e9cccb46c0
Go: mistyped-exponentiation: notice constants with likely-bitmask values
2025-09-25 15:19:40 +01:00
Owen Mansel-Chan
d9e7c89af0
Add indirect method calls
2025-09-11 11:31:28 +01:00
Owen Mansel-Chan
84e70e166e
Add direct method calls
2025-09-11 11:27:56 +01:00
Owen Mansel-Chan
fa18fd2782
Add method defs
2025-09-11 11:24:53 +01:00
Owen Mansel-Chan
cbbf7c2578
Include pre-update node in output
2025-09-11 11:22:17 +01:00
Arthur Baars
5d3ec35e29
Remove non-breaking spaces from code
2025-09-05 09:41:15 +02:00
Owen Mansel-Chan
2a45b28e5f
Merge pull request #20064 from Kwstubbs/go-path-separator
...
Update Go Path Injection Sanitizer and Sink
2025-09-03 16:45:15 +01:00
Kevin Stubbings
b4b848a25c
Fix tests and simplify sanitizer
2025-07-21 21:53:35 +00:00
Kevin Stubbings
f86152d3bd
Add sanitizer changes and fix test
2025-07-16 21:27:33 +00:00
Kevin Stubbings
504ae0f35a
Update go path sanitizers and sinks
2025-07-16 06:12:45 +00:00
Chris Smowton
c8eefb7c5c
Golang: Mark filepath.IsLocal as a tainted-path sanitizer guard
2025-07-15 14:47:17 +01:00
Owen Mansel-Chan
990043ce86
Add net/http.Head and net/http.Client.Head as client requests
...
They were previously deliberately excluded.
2025-07-08 14:31:48 +01:00
Owen Mansel-Chan
d437a096f1
Test more client request URL sinks
2025-07-08 13:20:04 +01:00
Owen Mansel-Chan
0788a90d88
Convert RequestForgery test to inline expectations
2025-07-04 16:56:05 +01:00
Owen Mansel-Chan
d10b9e665c
Fix linter warnings in Request Forgery tests
2025-07-04 16:55:09 +01:00
