@@ -7,7 +7,7 @@ import semmle.go.security.RequestForgery
7
7
module Twirp {
8
8
/**
9
9
* A *.pb.go file generated by Twirp.
10
- * This file will all the types representing protobuf messages and should have a companion *.twirp.go file.
10
+ * This file contains all the types representing protobuf messages and should have a companion *.twirp.go file.
11
11
*/
12
12
class ProtobufGeneratedFile extends File {
13
13
ProtobufGeneratedFile ( ) {
@@ -77,12 +77,10 @@ module Twirp {
77
77
* A Twirp client
78
78
*/
79
79
class ServiceClient extends NamedType {
80
- PointerType pointerType ;
81
-
82
80
ServiceClient ( ) {
83
- exists ( ServiceInterface i |
84
- pointerType .implements ( i ) and
85
- this = pointerType .getBaseType ( ) and
81
+ exists ( ServiceInterface i , PointerType p |
82
+ p .implements ( i ) and
83
+ this = p .getBaseType ( ) and
86
84
this .getName ( ) .toLowerCase ( ) = i .getName ( ) .toLowerCase ( ) + [ "protobuf" , "json" ] + "client"
87
85
)
88
86
}
@@ -101,7 +99,7 @@ module Twirp {
101
99
}
102
100
103
101
/**
104
- * Twirp function to construct a Client
102
+ * A Twirp function to construct a Client
105
103
*/
106
104
class ClientConstructor extends Function {
107
105
ClientConstructor ( ) {
@@ -114,7 +112,7 @@ module Twirp {
114
112
}
115
113
116
114
/**
117
- * Twirp function to construct a Server
115
+ * A Twirp function to construct a Server
118
116
* Its first argument should be an implementation of the service interface
119
117
*/
120
118
class ServerConstructor extends Function {
@@ -127,7 +125,7 @@ module Twirp {
127
125
}
128
126
129
127
/**
130
- * SSRF sink for the Client constructor
128
+ * An SSRF sink for the Client constructor
131
129
*/
132
130
class ClientRequestUrlAsSink extends RequestForgery:: Sink {
133
131
ClientRequestUrlAsSink ( ) {
@@ -146,22 +144,19 @@ module Twirp {
146
144
* A service handler
147
145
*/
148
146
class ServiceHandler extends Method {
149
- Method m ;
150
-
151
147
ServiceHandler ( ) {
152
148
exists ( DataFlow:: CallNode call , Type handlerType , ServiceInterface i |
153
149
call .getTarget ( ) instanceof ServerConstructor and
154
150
call .getArgument ( 0 ) .getType ( ) = handlerType and
155
151
handlerType .implements ( i ) and
156
152
this = handlerType .getMethod ( _) and
157
- this .implements ( m ) and
158
- i .getNamedType ( ) .getMethod ( _) = m
153
+ this .implements ( i .getNamedType ( ) .getMethod ( _) )
159
154
)
160
155
}
161
156
}
162
157
163
158
/**
164
- * A request comming to the service handler
159
+ * A request coming to the service handler
165
160
*/
166
161
class Request extends UntrustedFlowSource:: Range , DataFlow:: ParameterNode {
167
162
ServiceHandler handler ;
0 commit comments