Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 117fd68

Browse files
max-schaefermax-schaefer
authored
Merge pull request #276 from gagliardetto/standard-lib-pt-3
Add taint tracking for the compress/* packages
2 parents cb5c596 + b025963 commit 117fd68

File tree

11 files changed

+585
-0
lines changed

11 files changed

+585
-0
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ import semmle.go.frameworks.stdlib.ArchiveTar
77
import semmle.go.frameworks.stdlib.ArchiveZip
88
import semmle.go.frameworks.stdlib.Bufio
99
import semmle.go.frameworks.stdlib.Bytes
10+
import semmle.go.frameworks.stdlib.CompressBzip2
11+
import semmle.go.frameworks.stdlib.CompressFlate
12+
import semmle.go.frameworks.stdlib.CompressGzip
13+
import semmle.go.frameworks.stdlib.CompressLzw
14+
import semmle.go.frameworks.stdlib.CompressZlib
1015

1116
/** A `String()` method. */
1217
class StringMethod extends TaintTracking::FunctionModel, Method {

‎ql/src/semmle/go/frameworks/stdlib/CompressBzip2.qll

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `compress/bzip2` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `compress/bzip2` package. */
8+
module CompressBzip2 {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader) io.Reader
15+
hasQualifiedName("compress/bzip2", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult())
17+
}
18+
19+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
20+
input = inp and output = outp
21+
}
22+
}
23+
}

‎ql/src/semmle/go/frameworks/stdlib/CompressFlate.qll

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `compress/flate` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `compress/flate` package. */
8+
module CompressFlate {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader) io.ReadCloser
15+
hasQualifiedName("compress/flate", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func NewReaderDict(r io.Reader, dict []byte) io.ReadCloser
19+
hasQualifiedName("compress/flate", "NewReaderDict") and
20+
(inp.isParameter(0) and outp.isResult())
21+
or
22+
// signature: func NewWriter(w io.Writer, level int) (*Writer, error)
23+
hasQualifiedName("compress/flate", "NewWriter") and
24+
(inp.isResult(0) and outp.isParameter(0))
25+
or
26+
// signature: func NewWriterDict(w io.Writer, level int, dict []byte) (*Writer, error)
27+
hasQualifiedName("compress/flate", "NewWriterDict") and
28+
(inp.isResult(0) and outp.isParameter(0))
29+
}
30+
31+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
32+
input = inp and output = outp
33+
}
34+
}
35+
36+
private class MethodModels extends TaintTracking::FunctionModel, Method {
37+
FunctionInput inp;
38+
FunctionOutput outp;
39+
40+
MethodModels() {
41+
// signature: func (*Writer).Reset(dst io.Writer)
42+
this.hasQualifiedName("compress/flate", "Writer", "Reset") and
43+
(inp.isReceiver() and outp.isParameter(0))
44+
or
45+
// signature: func (*Writer).Write(data []byte) (n int, err error)
46+
this.hasQualifiedName("compress/flate", "Writer", "Write") and
47+
(inp.isParameter(0) and outp.isReceiver())
48+
or
49+
// signature: func (Resetter).Reset(r io.Reader, dict []byte) error
50+
this.implements("compress/flate", "Resetter", "Reset") and
51+
(inp.isParameter(0) and outp.isReceiver())
52+
}
53+
54+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
55+
input = inp and output = outp
56+
}
57+
}
58+
}

‎ql/src/semmle/go/frameworks/stdlib/CompressGzip.qll

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `compress/gzip` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `compress/gzip` package. */
8+
module CompressGzip {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader) (*Reader, error)
15+
hasQualifiedName("compress/gzip", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult(0))
17+
or
18+
// signature: func NewWriter(w io.Writer) *Writer
19+
hasQualifiedName("compress/gzip", "NewWriter") and
20+
(inp.isResult() and outp.isParameter(0))
21+
or
22+
// signature: func NewWriterLevel(w io.Writer, level int) (*Writer, error)
23+
hasQualifiedName("compress/gzip", "NewWriterLevel") and
24+
(inp.isResult(0) and outp.isParameter(0))
25+
}
26+
27+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
28+
input = inp and output = outp
29+
}
30+
}
31+
32+
private class MethodModels extends TaintTracking::FunctionModel, Method {
33+
FunctionInput inp;
34+
FunctionOutput outp;
35+
36+
MethodModels() {
37+
// signature: func (*Reader).Reset(r io.Reader) error
38+
this.hasQualifiedName("compress/gzip", "Reader", "Reset") and
39+
(inp.isParameter(0) and outp.isReceiver())
40+
or
41+
// signature: func (*Writer).Reset(w io.Writer)
42+
this.hasQualifiedName("compress/gzip", "Writer", "Reset") and
43+
(inp.isReceiver() and outp.isParameter(0))
44+
or
45+
// signature: func (*Writer).Write(p []byte) (int, error)
46+
this.hasQualifiedName("compress/gzip", "Writer", "Write") and
47+
(inp.isParameter(0) and outp.isReceiver())
48+
}
49+
50+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
51+
input = inp and output = outp
52+
}
53+
}
54+
}

‎ql/src/semmle/go/frameworks/stdlib/CompressLzw.qll

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `compress/lzw` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `compress/lzw` package. */
8+
module CompressLzw {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader, order Order, litWidth int) io.ReadCloser
15+
hasQualifiedName("compress/lzw", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func NewWriter(w io.Writer, order Order, litWidth int) io.WriteCloser
19+
hasQualifiedName("compress/lzw", "NewWriter") and
20+
(inp.isResult() and outp.isParameter(0))
21+
}
22+
23+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
24+
input = inp and output = outp
25+
}
26+
}
27+
}

‎ql/src/semmle/go/frameworks/stdlib/CompressZlib.qll

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `compress/zlib` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `compress/zlib` package. */
8+
module CompressZlib {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader) (io.ReadCloser, error)
15+
hasQualifiedName("compress/zlib", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult(0))
17+
or
18+
// signature: func NewReaderDict(r io.Reader, dict []byte) (io.ReadCloser, error)
19+
hasQualifiedName("compress/zlib", "NewReaderDict") and
20+
(inp.isParameter(0) and outp.isResult(0))
21+
or
22+
// signature: func NewWriter(w io.Writer) *Writer
23+
hasQualifiedName("compress/zlib", "NewWriter") and
24+
(inp.isResult() and outp.isParameter(0))
25+
or
26+
// signature: func NewWriterLevel(w io.Writer, level int) (*Writer, error)
27+
hasQualifiedName("compress/zlib", "NewWriterLevel") and
28+
(inp.isResult(0) and outp.isParameter(0))
29+
or
30+
// signature: func NewWriterLevelDict(w io.Writer, level int, dict []byte) (*Writer, error)
31+
hasQualifiedName("compress/zlib", "NewWriterLevelDict") and
32+
(inp.isResult(0) and outp.isParameter(0))
33+
}
34+
35+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
36+
input = inp and output = outp
37+
}
38+
}
39+
40+
private class MethodModels extends TaintTracking::FunctionModel, Method {
41+
FunctionInput inp;
42+
FunctionOutput outp;
43+
44+
MethodModels() {
45+
// signature: func (*Writer).Reset(w io.Writer)
46+
this.hasQualifiedName("compress/zlib", "Writer", "Reset") and
47+
(inp.isReceiver() and outp.isParameter(0))
48+
or
49+
// signature: func (*Writer).Write(p []byte) (n int, err error)
50+
this.hasQualifiedName("compress/zlib", "Writer", "Write") and
51+
(inp.isParameter(0) and outp.isReceiver())
52+
or
53+
// signature: func (Resetter).Reset(r io.Reader, dict []byte) error
54+
this.implements("compress/zlib", "Resetter", "Reset") and
55+
(inp.isParameter(0) and outp.isReceiver())
56+
}
57+
58+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
59+
input = inp and output = outp
60+
}
61+
}
62+
}

‎ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressBzip2.go

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/CompressFlate.go

Lines changed: 95 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)