Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 0510404

Browse files
gagliardettogagliardetto
committed
Merge branch 'standard-lib-pt-12' into stdlib-339-340-342-346-347
2 parents 1a5d582 + 4127cb5 commit 0510404

File tree

7 files changed

+516
-298
lines changed

7 files changed

+516
-298
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 2 additions & 249 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ import semmle.go.frameworks.stdlib.NetHttpHttputil
3838
import semmle.go.frameworks.stdlib.NetMail
3939
import semmle.go.frameworks.stdlib.NetTextproto
4040
import semmle.go.frameworks.stdlib.Log
41+
import semmle.go.frameworks.stdlib.Io
42+
import semmle.go.frameworks.stdlib.IoIoutil
4143
import semmle.go.frameworks.stdlib.Path
4244
import semmle.go.frameworks.stdlib.PathFilepath
4345
import semmle.go.frameworks.stdlib.Reflect
@@ -89,255 +91,6 @@ private class CopyFunction extends TaintTracking::FunctionModel {
8991
}
9092
}
9193

92-
/** Provides models of commonly used functions in the `io` package. */
93-
module Io {
94-
private class Copy extends TaintTracking::FunctionModel {
95-
Copy() {
96-
// func Copy(dst Writer, src Reader) (written int64, err error)
97-
// func CopyBuffer(dst Writer, src Reader, buf []byte) (written int64, err error)
98-
// func CopyN(dst Writer, src Reader, n int64) (written int64, err error)
99-
hasQualifiedName("io", "Copy") or
100-
hasQualifiedName("io", "CopyBuffer") or
101-
hasQualifiedName("io", "CopyN")
102-
}
103-
104-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
105-
input.isParameter(1) and output.isParameter(0)
106-
}
107-
}
108-
109-
private class Pipe extends TaintTracking::FunctionModel {
110-
Pipe() {
111-
// func Pipe() (*PipeReader, *PipeWriter)
112-
hasQualifiedName("io", "Pipe")
113-
}
114-
115-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
116-
input.isResult(0) and output.isResult(1)
117-
}
118-
}
119-
120-
private class ReadAtLeast extends TaintTracking::FunctionModel {
121-
ReadAtLeast() {
122-
// func ReadAtLeast(r Reader, buf []byte, min int) (n int, err error)
123-
// func ReadFull(r Reader, buf []byte) (n int, err error)
124-
hasQualifiedName("io", "ReadAtLeast") or
125-
hasQualifiedName("io", "ReadFull")
126-
}
127-
128-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
129-
input.isParameter(0) and output.isParameter(1)
130-
}
131-
}
132-
133-
private class WriteString extends TaintTracking::FunctionModel {
134-
WriteString() {
135-
// func WriteString(w Writer, s string) (n int, err error)
136-
this.hasQualifiedName("io", "WriteString")
137-
}
138-
139-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
140-
input.isParameter(1) and output.isParameter(0)
141-
}
142-
}
143-
144-
private class ByteReaderReadByte extends TaintTracking::FunctionModel, Method {
145-
ByteReaderReadByte() {
146-
// func ReadByte() (byte, error)
147-
this.implements("io", "ByteReader", "ReadByte")
148-
}
149-
150-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
151-
input.isReceiver() and output.isResult(0)
152-
}
153-
}
154-
155-
private class ByteWriterWriteByte extends TaintTracking::FunctionModel, Method {
156-
ByteWriterWriteByte() {
157-
// func WriteByte(c byte) error
158-
this.implements("io", "ByteWriter", "WriteByte")
159-
}
160-
161-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
162-
input.isParameter(0) and output.isReceiver()
163-
}
164-
}
165-
166-
private class ReaderRead extends TaintTracking::FunctionModel, Method {
167-
ReaderRead() {
168-
// func Read(p []byte) (n int, err error)
169-
this.implements("io", "Reader", "Read")
170-
}
171-
172-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
173-
input.isReceiver() and output.isParameter(0)
174-
}
175-
}
176-
177-
private class LimitReader extends TaintTracking::FunctionModel {
178-
LimitReader() {
179-
// func LimitReader(r Reader, n int64) Reader
180-
this.hasQualifiedName("io", "LimitReader")
181-
}
182-
183-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
184-
input.isParameter(0) and output.isResult()
185-
}
186-
}
187-
188-
private class MultiReader extends TaintTracking::FunctionModel {
189-
MultiReader() {
190-
// func MultiReader(readers ...Reader) Reader
191-
this.hasQualifiedName("io", "MultiReader")
192-
}
193-
194-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
195-
input.isParameter(_) and output.isResult()
196-
}
197-
}
198-
199-
private class TeeReader extends TaintTracking::FunctionModel {
200-
TeeReader() {
201-
// func TeeReader(r Reader, w Writer) Reader
202-
this.hasQualifiedName("io", "TeeReader")
203-
}
204-
205-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
206-
input.isParameter(0) and output.isResult()
207-
or
208-
input.isParameter(0) and output.isParameter(1)
209-
}
210-
}
211-
212-
private class ReaderAtReadAt extends TaintTracking::FunctionModel, Method {
213-
ReaderAtReadAt() {
214-
// func ReadAt(p []byte, off int64) (n int, err error)
215-
this.implements("io", "ReaderAt", "ReadAt")
216-
}
217-
218-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
219-
input.isReceiver() and output.isParameter(0)
220-
}
221-
}
222-
223-
private class ReaderFromReadFrom extends TaintTracking::FunctionModel, Method {
224-
ReaderFromReadFrom() {
225-
// func ReadFrom(r Reader) (n int64, err error)
226-
this.implements("io", "ReaderFrom", "ReadFrom")
227-
}
228-
229-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
230-
input.isParameter(0) and output.isReceiver()
231-
}
232-
}
233-
234-
private class RuneReaderReadRune extends TaintTracking::FunctionModel, Method {
235-
RuneReaderReadRune() {
236-
// func ReadRune() (r rune, size int, err error)
237-
this.implements("io", "RuneReader", "ReadRune")
238-
}
239-
240-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
241-
input.isReceiver() and output.isResult(0)
242-
}
243-
}
244-
245-
private class NewSectionReader extends TaintTracking::FunctionModel {
246-
NewSectionReader() {
247-
// func NewSectionReader(r ReaderAt, off int64, n int64) *SectionReader
248-
this.hasQualifiedName("io", "NewSectionReader")
249-
}
250-
251-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
252-
input.isParameter(0) and output.isResult()
253-
}
254-
}
255-
256-
private class StringWriterWriteString extends TaintTracking::FunctionModel, Method {
257-
StringWriterWriteString() {
258-
// func WriteString(s string) (n int, err error)
259-
this.implements("io", "StringWriter", "WriteString")
260-
}
261-
262-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
263-
input.isParameter(0) and output.isReceiver()
264-
}
265-
}
266-
267-
private class WriterWrite extends TaintTracking::FunctionModel, Method {
268-
WriterWrite() {
269-
// func Write(p []byte) (n int, err error)
270-
this.implements("io", "Writer", "Write")
271-
}
272-
273-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
274-
input.isParameter(0) and output.isReceiver()
275-
}
276-
}
277-
278-
private class MultiWriter extends TaintTracking::FunctionModel {
279-
MultiWriter() {
280-
// func MultiWriter(writers ...Writer) Writer
281-
hasQualifiedName("io", "MultiWriter")
282-
}
283-
284-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
285-
input.isResult() and output.isParameter(_)
286-
}
287-
}
288-
289-
private class WriterAtWriteAt extends TaintTracking::FunctionModel, Method {
290-
WriterAtWriteAt() {
291-
// func WriteAt(p []byte, off int64) (n int, err error)
292-
this.implements("io", "WriterAt", "WriteAt")
293-
}
294-
295-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
296-
input.isParameter(0) and output.isReceiver()
297-
}
298-
}
299-
300-
private class WriterToWriteTo extends TaintTracking::FunctionModel, Method {
301-
WriterToWriteTo() {
302-
// func WriteTo(w Writer) (n int64, err error)
303-
this.implements("io", "WriterTo", "WriteTo")
304-
}
305-
306-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
307-
input.isReceiver() and output.isParameter(0)
308-
}
309-
}
310-
}
311-
312-
/** Provides models of commonly used functions in the `io/ioutil` package. */
313-
module IoUtil {
314-
private class IoUtilFileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
315-
IoUtilFileSystemAccess() {
316-
exists(string fn | getTarget().hasQualifiedName("io/ioutil", fn) |
317-
fn = "ReadDir" or
318-
fn = "ReadFile" or
319-
fn = "TempDir" or
320-
fn = "TempFile" or
321-
fn = "WriteFile"
322-
)
323-
}
324-
325-
override DataFlow::Node getAPathArgument() { result = getAnArgument() }
326-
}
327-
328-
/**
329-
* A taint model of the `ioutil.ReadAll` function, recording that it propagates taint
330-
* from its first argument to its first result.
331-
*/
332-
private class ReadAll extends TaintTracking::FunctionModel {
333-
ReadAll() { hasQualifiedName("io/ioutil", "ReadAll") }
334-
335-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
336-
inp.isParameter(0) and outp.isResult(0)
337-
}
338-
}
339-
}
340-
34194
/** Provides a class for modeling functions which convert strings into integers. */
34295
module IntegerParser {
34396
/**

‎ql/src/semmle/go/frameworks/stdlib/Io.qll

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `io` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `io` package. */
8+
module Io {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func Copy(dst Writer, src Reader) (written int64, err error)
15+
hasQualifiedName("io", "Copy") and
16+
(inp.isParameter(1) and outp.isParameter(0))
17+
or
18+
// signature: func CopyBuffer(dst Writer, src Reader, buf []byte) (written int64, err error)
19+
hasQualifiedName("io", "CopyBuffer") and
20+
(inp.isParameter(1) and outp.isParameter(0))
21+
or
22+
// signature: func CopyN(dst Writer, src Reader, n int64) (written int64, err error)
23+
hasQualifiedName("io", "CopyN") and
24+
(inp.isParameter(1) and outp.isParameter(0))
25+
or
26+
// signature: func LimitReader(r Reader, n int64) Reader
27+
hasQualifiedName("io", "LimitReader") and
28+
(inp.isParameter(0) and outp.isResult())
29+
or
30+
// signature: func MultiReader(readers ...Reader) Reader
31+
hasQualifiedName("io", "MultiReader") and
32+
(inp.isParameter(_) and outp.isResult())
33+
or
34+
// signature: func MultiWriter(writers ...Writer) Writer
35+
hasQualifiedName("io", "MultiWriter") and
36+
(inp.isResult() and outp.isParameter(_))
37+
or
38+
// signature: func NewSectionReader(r ReaderAt, off int64, n int64) *SectionReader
39+
hasQualifiedName("io", "NewSectionReader") and
40+
(inp.isParameter(0) and outp.isResult())
41+
or
42+
// signature: func Pipe() (*PipeReader, *PipeWriter)
43+
hasQualifiedName("io", "Pipe") and
44+
(inp.isResult(1) and outp.isResult(0))
45+
or
46+
// signature: func ReadAtLeast(r Reader, buf []byte, min int) (n int, err error)
47+
hasQualifiedName("io", "ReadAtLeast") and
48+
(inp.isParameter(0) and outp.isParameter(1))
49+
or
50+
// signature: func ReadFull(r Reader, buf []byte) (n int, err error)
51+
hasQualifiedName("io", "ReadFull") and
52+
(inp.isParameter(0) and outp.isParameter(1))
53+
or
54+
// signature: func TeeReader(r Reader, w Writer) Reader
55+
hasQualifiedName("io", "TeeReader") and
56+
(
57+
inp.isParameter(0) and
58+
(outp.isParameter(1) or outp.isResult())
59+
)
60+
or
61+
// signature: func WriteString(w Writer, s string) (n int, err error)
62+
hasQualifiedName("io", "WriteString") and
63+
(inp.isParameter(1) and outp.isParameter(0))
64+
}
65+
66+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
67+
input = inp and output = outp
68+
}
69+
}
70+
71+
private class MethodModels extends TaintTracking::FunctionModel, Method {
72+
FunctionInput inp;
73+
FunctionOutput outp;
74+
75+
MethodModels() {
76+
// signature: func (Reader).Read(p []byte) (n int, err error)
77+
this.implements("io", "Reader", "Read") and
78+
(inp.isReceiver() and outp.isParameter(0))
79+
or
80+
// signature: func (ReaderAt).ReadAt(p []byte, off int64) (n int, err error)
81+
this.implements("io", "ReaderAt", "ReadAt") and
82+
(inp.isReceiver() and outp.isParameter(0))
83+
or
84+
// signature: func (ReaderFrom).ReadFrom(r Reader) (n int64, err error)
85+
this.implements("io", "ReaderFrom", "ReadFrom") and
86+
(inp.isParameter(0) and outp.isReceiver())
87+
or
88+
// signature: func (Writer).Write(p []byte) (n int, err error)
89+
this.implements("io", "Writer", "Write") and
90+
(inp.isParameter(0) and outp.isReceiver())
91+
or
92+
// signature: func (WriterAt).WriteAt(p []byte, off int64) (n int, err error)
93+
this.implements("io", "WriterAt", "WriteAt") and
94+
(inp.isParameter(0) and outp.isReceiver())
95+
or
96+
// signature: func (StringWriter).WriteString(s string) (n int, err error)
97+
this.implements("io", "StringWriter", "WriteString") and
98+
(inp.isParameter(0) and outp.isReceiver())
99+
or
100+
// signature: func (WriterTo).WriteTo(w Writer) (n int64, err error)
101+
this.implements("io", "WriterTo", "WriteTo") and
102+
(inp.isReceiver() and outp.isParameter(0))
103+
}
104+
105+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
106+
input = inp and output = outp
107+
}
108+
}
109+
}

0 commit comments

Comments
 (0)