mirror of
https://github.com/github/codeql.git
synced 2026-08-04 01:13:00 +02:00
0c6c135967
This query already treats structs differently to usual: it includes field -> whole struct taint steps, but explicitly excludes struct -> field steps. This means that a logging framework sinking an entire struct with a tainted field yields an alert, but we don't get FPs caused by writing field `x` but then reading field `y`. However, protobuf messages have a special treatment, with taint usually associated with the whole struct and getter methods propagating that taint out. Suppressing these getter method steps specifically for the cleartext-logging query mirrors its treatment of structs in general and avoids this sort of field-mismatch FP. On the downside we will miss same-field propagation like `m.field = password; Log(m.GetField())` if we don't have source code for the implementation of `m`. However this is hopefully unusual since the typical use of protobufs is to serialize and deserialize, rather than using the struct as a general-purpose datastructure.
12 lines
233 B
Modula-2
12 lines
233 B
Modula-2
module main
|
|
|
|
go 1.14
|
|
|
|
require (
|
|
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
|
|
github.com/sirupsen/logrus v1.5.0
|
|
k8s.io/klog v1.0.0
|
|
github.com/golang/protobuf v1.4.2
|
|
google.golang.org/protobuf v1.23.0
|
|
)
|