Skip to content

Commit b2deea4

Browse files
owen-mcowen-mc
committed
Avoid duplicate additional flow steps in configs
`localTaintStep` includes a lot of steps which are already part of value flow. Instead use `defaultAdditionalTaintStep`, which is just the extra steps that are added for taint tracking.
1 parent 7e5891b commit b2deea4

File tree

5 files changed

+25
-116
lines changed

5 files changed

+25
-116
lines changed

‎go/ql/lib/semmle/go/security/CleartextLogging.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ module CleartextLogging {
8484
or
8585
// taint steps that do not include flow through fields. Field reads would produce FPs due to
8686
// the additional taint step above that taints whole structs from individual field writes.
87-
TaintTracking::localTaintStep(src, trg) and
87+
TaintTracking::defaultAdditionalTaintStep(src, trg, _) and
8888
not TaintTracking::fieldReadStep(src, trg) and
8989
// Also exclude protobuf field fetches, since they amount to single field reads.
9090
not any(Protobuf::GetMethod gm).taintStep(src, trg)

‎go/ql/lib/semmle/go/security/OpenUrlRedirect.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,8 @@ module OpenUrlRedirect {
7171

7272
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
7373
// taint steps that do not include flow through fields
74-
TaintTracking::localTaintStep(pred, succ) and not TaintTracking::fieldReadStep(pred, succ)
74+
TaintTracking::defaultAdditionalTaintStep(pred, succ, _) and
75+
not TaintTracking::fieldReadStep(pred, succ)
7576
or
7677
// explicit extra taint steps for this query
7778
any(AdditionalStep s).hasTaintStep(pred, succ)

‎go/ql/test/library-tests/semmle/go/frameworks/Echo/OpenRedirect.expected

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,17 @@
11
edges
2-
| test.go:172:2:172:6 | definition of param | test.go:173:20:173:24 | param | provenance | |
3-
| test.go:172:2:172:6 | definition of param | test.go:173:20:173:24 | param | provenance | Config |
4-
| test.go:172:11:172:32 | call to Param | test.go:172:2:172:6 | definition of param | provenance | |
5-
| test.go:172:11:172:32 | call to Param | test.go:172:2:172:6 | definition of param | provenance | Config |
6-
| test.go:178:2:178:6 | definition of param | test.go:182:24:182:28 | param | provenance | |
7-
| test.go:178:2:178:6 | definition of param | test.go:182:24:182:28 | param | provenance | Config |
8-
| test.go:178:11:178:32 | call to Param | test.go:178:2:178:6 | definition of param | provenance | |
9-
| test.go:178:11:178:32 | call to Param | test.go:178:2:178:6 | definition of param | provenance | Config |
2+
| test.go:172:11:172:32 | call to Param | test.go:173:20:173:24 | param | provenance | |
3+
| test.go:178:11:178:32 | call to Param | test.go:182:24:182:28 | param | provenance | |
104
| test.go:182:24:182:28 | param | test.go:182:20:182:28 | ...+... | provenance | Config |
11-
| test.go:190:2:190:4 | definition of url | test.go:193:21:193:23 | url | provenance | |
12-
| test.go:190:2:190:4 | definition of url | test.go:193:21:193:23 | url | provenance | Config |
13-
| test.go:190:9:190:26 | star expression | test.go:190:2:190:4 | definition of url | provenance | |
14-
| test.go:190:9:190:26 | star expression | test.go:190:2:190:4 | definition of url | provenance | Config |
155
| test.go:190:9:190:26 | star expression | test.go:190:10:190:26 | selection of URL | provenance | Config |
6+
| test.go:190:9:190:26 | star expression | test.go:193:21:193:23 | url | provenance | |
167
| test.go:190:10:190:26 | selection of URL | test.go:190:9:190:26 | star expression | provenance | Config |
178
| test.go:193:21:193:23 | url | test.go:193:21:193:32 | call to String | provenance | Config |
189
nodes
19-
| test.go:172:2:172:6 | definition of param | semmle.label | definition of param |
2010
| test.go:172:11:172:32 | call to Param | semmle.label | call to Param |
2111
| test.go:173:20:173:24 | param | semmle.label | param |
22-
| test.go:178:2:178:6 | definition of param | semmle.label | definition of param |
2312
| test.go:178:11:178:32 | call to Param | semmle.label | call to Param |
2413
| test.go:182:20:182:28 | ...+... | semmle.label | ...+... |
2514
| test.go:182:24:182:28 | param | semmle.label | param |
26-
| test.go:190:2:190:4 | definition of url | semmle.label | definition of url |
2715
| test.go:190:9:190:26 | star expression | semmle.label | star expression |
2816
| test.go:190:10:190:26 | selection of URL | semmle.label | selection of URL |
2917
| test.go:193:21:193:23 | url | semmle.label | url |

‎go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected

Lines changed: 9 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,30 @@
11
edges
2-
| klog.go:20:3:25:3 | range statement[1] | klog.go:20:13:20:19 | definition of headers | provenance | |
3-
| klog.go:20:3:25:3 | range statement[1] | klog.go:20:13:20:19 | definition of headers | provenance | Config |
4-
| klog.go:20:13:20:19 | definition of headers | klog.go:21:27:21:33 | headers | provenance | |
5-
| klog.go:20:13:20:19 | definition of headers | klog.go:21:27:21:33 | headers | provenance | Config |
2+
| klog.go:20:3:25:3 | range statement[1] | klog.go:21:27:21:33 | headers | provenance | |
63
| klog.go:20:30:20:37 | selection of Header | klog.go:20:3:25:3 | range statement[1] | provenance | Config |
7-
| klog.go:21:4:24:4 | range statement[1] | klog.go:21:11:21:16 | definition of header | provenance | |
8-
| klog.go:21:4:24:4 | range statement[1] | klog.go:21:11:21:16 | definition of header | provenance | Config |
9-
| klog.go:21:11:21:16 | definition of header | klog.go:22:15:22:20 | header | provenance | |
10-
| klog.go:21:11:21:16 | definition of header | klog.go:22:15:22:20 | header | provenance | Config |
4+
| klog.go:21:4:24:4 | range statement[1] | klog.go:22:15:22:20 | header | provenance | |
115
| klog.go:21:27:21:33 | headers | klog.go:21:4:24:4 | range statement[1] | provenance | Config |
126
| klog.go:28:13:28:20 | selection of Header | klog.go:28:13:28:41 | call to Get | provenance | Config |
137
| overrides.go:9:9:9:16 | password | overrides.go:13:14:13:23 | call to String | provenance | |
148
| passwords.go:8:12:8:12 | definition of x | passwords.go:9:14:9:14 | x | provenance | |
15-
| passwords.go:8:12:8:12 | definition of x | passwords.go:9:14:9:14 | x | provenance | Config |
169
| passwords.go:30:8:30:15 | password | passwords.go:8:12:8:12 | definition of x | provenance | |
1710
| passwords.go:34:28:34:35 | password | passwords.go:34:14:34:35 | ...+... | provenance | Config |
18-
| passwords.go:36:2:36:5 | definition of obj1 | passwords.go:39:14:39:17 | obj1 | provenance | |
19-
| passwords.go:36:2:36:5 | definition of obj1 | passwords.go:39:14:39:17 | obj1 | provenance | Config |
20-
| passwords.go:36:10:38:2 | struct literal | passwords.go:36:2:36:5 | definition of obj1 | provenance | |
21-
| passwords.go:36:10:38:2 | struct literal | passwords.go:36:2:36:5 | definition of obj1 | provenance | Config |
11+
| passwords.go:36:10:38:2 | struct literal | passwords.go:39:14:39:17 | obj1 | provenance | |
2212
| passwords.go:37:13:37:13 | x | passwords.go:36:10:38:2 | struct literal | provenance | Config |
23-
| passwords.go:41:2:41:5 | definition of obj2 | passwords.go:44:14:44:17 | obj2 | provenance | |
24-
| passwords.go:41:2:41:5 | definition of obj2 | passwords.go:44:14:44:17 | obj2 | provenance | Config |
25-
| passwords.go:41:10:43:2 | struct literal | passwords.go:41:2:41:5 | definition of obj2 | provenance | |
26-
| passwords.go:41:10:43:2 | struct literal | passwords.go:41:2:41:5 | definition of obj2 | provenance | Config |
13+
| passwords.go:41:10:43:2 | struct literal | passwords.go:44:14:44:17 | obj2 | provenance | |
2714
| passwords.go:42:6:42:13 | password | passwords.go:41:10:43:2 | struct literal | provenance | Config |
2815
| passwords.go:46:6:46:9 | definition of obj3 | passwords.go:47:14:47:17 | obj3 | provenance | |
29-
| passwords.go:46:6:46:9 | definition of obj3 | passwords.go:47:14:47:17 | obj3 | provenance | Config |
3016
| passwords.go:48:11:48:18 | password | passwords.go:46:6:46:9 | definition of obj3 | provenance | Config |
31-
| passwords.go:85:2:85:14 | definition of utilityObject | passwords.go:88:14:88:26 | utilityObject | provenance | |
32-
| passwords.go:85:2:85:14 | definition of utilityObject | passwords.go:88:14:88:26 | utilityObject | provenance | Config |
33-
| passwords.go:85:19:87:2 | struct literal | passwords.go:85:2:85:14 | definition of utilityObject | provenance | |
34-
| passwords.go:85:19:87:2 | struct literal | passwords.go:85:2:85:14 | definition of utilityObject | provenance | Config |
17+
| passwords.go:85:19:87:2 | struct literal | passwords.go:88:14:88:26 | utilityObject | provenance | |
3518
| passwords.go:86:16:86:36 | call to make | passwords.go:85:19:87:2 | struct literal | provenance | Config |
36-
| passwords.go:90:2:90:7 | definition of secret | passwords.go:91:23:91:28 | secret | provenance | |
37-
| passwords.go:90:2:90:7 | definition of secret | passwords.go:91:23:91:28 | secret | provenance | Config |
38-
| passwords.go:90:12:90:19 | password | passwords.go:90:2:90:7 | definition of secret | provenance | |
39-
| passwords.go:90:12:90:19 | password | passwords.go:90:2:90:7 | definition of secret | provenance | Config |
19+
| passwords.go:90:12:90:19 | password | passwords.go:91:23:91:28 | secret | provenance | |
4020
| passwords.go:101:33:101:40 | password | passwords.go:101:15:101:40 | ...+... | provenance | Config |
4121
| passwords.go:107:34:107:41 | password | passwords.go:107:16:107:41 | ...+... | provenance | Config |
4222
| passwords.go:112:33:112:40 | password | passwords.go:112:15:112:40 | ...+... | provenance | Config |
4323
| passwords.go:116:28:116:36 | password1 | passwords.go:116:28:116:45 | call to String | provenance | Config |
4424
| passwords.go:116:28:116:45 | call to String | passwords.go:116:14:116:45 | ...+... | provenance | Config |
45-
| passwords.go:118:2:118:7 | definition of config | passwords.go:125:14:125:19 | config | provenance | |
46-
| passwords.go:118:2:118:7 | definition of config | passwords.go:125:14:125:19 | config | provenance | Config |
47-
| passwords.go:118:2:118:7 | definition of config [x] | passwords.go:126:14:126:19 | config [x] | provenance | |
48-
| passwords.go:118:2:118:7 | definition of config [y] | passwords.go:127:14:127:19 | config [y] | provenance | |
49-
| passwords.go:118:12:123:2 | struct literal | passwords.go:118:2:118:7 | definition of config | provenance | |
50-
| passwords.go:118:12:123:2 | struct literal | passwords.go:118:2:118:7 | definition of config | provenance | Config |
51-
| passwords.go:118:12:123:2 | struct literal [x] | passwords.go:118:2:118:7 | definition of config [x] | provenance | |
52-
| passwords.go:118:12:123:2 | struct literal [y] | passwords.go:118:2:118:7 | definition of config [y] | provenance | |
25+
| passwords.go:118:12:123:2 | struct literal | passwords.go:125:14:125:19 | config | provenance | |
26+
| passwords.go:118:12:123:2 | struct literal [x] | passwords.go:126:14:126:19 | config [x] | provenance | |
27+
| passwords.go:118:12:123:2 | struct literal [y] | passwords.go:127:14:127:19 | config [y] | provenance | |
5328
| passwords.go:119:13:119:13 | x | passwords.go:118:12:123:2 | struct literal | provenance | Config |
5429
| passwords.go:121:13:121:20 | password | passwords.go:118:12:123:2 | struct literal | provenance | Config |
5530
| passwords.go:121:13:121:20 | password | passwords.go:118:12:123:2 | struct literal [x] | provenance | |
@@ -69,10 +44,8 @@ edges
6944
| protos/query/query.pb.go:119:10:119:10 | x [pointer, Description] | protos/query/query.pb.go:119:10:119:10 | implicit dereference [Description] | provenance | |
7045
nodes
7146
| klog.go:20:3:25:3 | range statement[1] | semmle.label | range statement[1] |
72-
| klog.go:20:13:20:19 | definition of headers | semmle.label | definition of headers |
7347
| klog.go:20:30:20:37 | selection of Header | semmle.label | selection of Header |
7448
| klog.go:21:4:24:4 | range statement[1] | semmle.label | range statement[1] |
75-
| klog.go:21:11:21:16 | definition of header | semmle.label | definition of header |
7649
| klog.go:21:27:21:33 | headers | semmle.label | headers |
7750
| klog.go:22:15:22:20 | header | semmle.label | header |
7851
| klog.go:28:13:28:20 | selection of Header | semmle.label | selection of Header |
@@ -118,23 +91,19 @@ nodes
11891
| passwords.go:32:12:32:19 | password | semmle.label | password |
11992
| passwords.go:34:14:34:35 | ...+... | semmle.label | ...+... |
12093
| passwords.go:34:28:34:35 | password | semmle.label | password |
121-
| passwords.go:36:2:36:5 | definition of obj1 | semmle.label | definition of obj1 |
12294
| passwords.go:36:10:38:2 | struct literal | semmle.label | struct literal |
12395
| passwords.go:37:13:37:13 | x | semmle.label | x |
12496
| passwords.go:39:14:39:17 | obj1 | semmle.label | obj1 |
125-
| passwords.go:41:2:41:5 | definition of obj2 | semmle.label | definition of obj2 |
12697
| passwords.go:41:10:43:2 | struct literal | semmle.label | struct literal |
12798
| passwords.go:42:6:42:13 | password | semmle.label | password |
12899
| passwords.go:44:14:44:17 | obj2 | semmle.label | obj2 |
129100
| passwords.go:46:6:46:9 | definition of obj3 | semmle.label | definition of obj3 |
130101
| passwords.go:47:14:47:17 | obj3 | semmle.label | obj3 |
131102
| passwords.go:48:11:48:18 | password | semmle.label | password |
132103
| passwords.go:51:14:51:27 | fixed_password | semmle.label | fixed_password |
133-
| passwords.go:85:2:85:14 | definition of utilityObject | semmle.label | definition of utilityObject |
134104
| passwords.go:85:19:87:2 | struct literal | semmle.label | struct literal |
135105
| passwords.go:86:16:86:36 | call to make | semmle.label | call to make |
136106
| passwords.go:88:14:88:26 | utilityObject | semmle.label | utilityObject |
137-
| passwords.go:90:2:90:7 | definition of secret | semmle.label | definition of secret |
138107
| passwords.go:90:12:90:19 | password | semmle.label | password |
139108
| passwords.go:91:23:91:28 | secret | semmle.label | secret |
140109
| passwords.go:101:15:101:40 | ...+... | semmle.label | ...+... |
@@ -146,9 +115,6 @@ nodes
146115
| passwords.go:116:14:116:45 | ...+... | semmle.label | ...+... |
147116
| passwords.go:116:28:116:36 | password1 | semmle.label | password1 |
148117
| passwords.go:116:28:116:45 | call to String | semmle.label | call to String |
149-
| passwords.go:118:2:118:7 | definition of config | semmle.label | definition of config |
150-
| passwords.go:118:2:118:7 | definition of config [x] | semmle.label | definition of config [x] |
151-
| passwords.go:118:2:118:7 | definition of config [y] | semmle.label | definition of config [y] |
152118
| passwords.go:118:12:123:2 | struct literal | semmle.label | struct literal |
153119
| passwords.go:118:12:123:2 | struct literal [x] | semmle.label | struct literal [x] |
154120
| passwords.go:118:12:123:2 | struct literal [y] | semmle.label | struct literal [y] |

0 commit comments

Comments
 (0)