Skip to content

Commit a5c392e

Browse files
committed
Add back taint models for append and copy
This is needed when they are used with string arguments.
1 parent 0369f8f commit a5c392e

File tree

1 file changed

+24
-0
lines changed

1 file changed

+24
-0
lines changed

go/ql/lib/semmle/go/frameworks/Stdlib.qll

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,30 @@ import semmle.go.frameworks.stdlib.TextTabwriter
4444
import semmle.go.frameworks.stdlib.TextTemplate
4545
import semmle.go.frameworks.stdlib.Unsafe
4646

47+
/**
48+
* A model of the built-in `append` function, which propagates taint from its arguments to its
49+
* result.
50+
*/
51+
private class AppendFunction extends TaintTracking::FunctionModel {
52+
AppendFunction() { this = Builtin::append() }
53+
54+
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
55+
inp.isParameter(_) and outp.isResult()
56+
}
57+
}
58+
59+
/**
60+
* A model of the built-in `copy` function, which propagates taint from its second argument
61+
* to its first.
62+
*/
63+
private class CopyFunction extends TaintTracking::FunctionModel {
64+
CopyFunction() { this = Builtin::copy() }
65+
66+
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
67+
inp.isParameter(1) and outp.isParameter(0)
68+
}
69+
}
70+
4771
/** Provides a class for modeling functions which convert strings into integers. */
4872
module IntegerParser {
4973
/**

0 commit comments

Comments
 (0)