Merge pull request github#10026 from pwntester/patch-2

Go: Partial URLs should not sanitize against SSRF

Author: owen-mc

go/ql/lib/change-notes/2023-04-14-partial-URLs-should-not-sanitize-against-SSRF.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Taking a slice is now considered a sanitizer for `SafeUrlFlow`.

go/ql/lib/semmle/go/security/SafeUrlFlowCustomizations.qll

@@ -35,4 +35,9 @@ module SafeUrlFlow {
   private class UnsafeUrlMethodEdge extends SanitizerEdge {
     UnsafeUrlMethodEdge() { this = any(UnsafeUrlMethod um).getACall().getReceiver() }
   }
+
+  /** Any slicing of the URL, considered as a sanitizer for safe URL flow. */
+  private class StringSlicingEdge extends SanitizerEdge {
+    StringSlicingEdge() { this = any(DataFlow::SliceNode sn) }
+  }
 }