Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 17868dd

Browse files
gagliardettogagliardetto
committed
Merge branch 'standard-lib-pt-16' into from-331-to-337
2 parents ed965c7 + c89cfc8 commit 17868dd

File tree

3 files changed

+290
-81
lines changed
  • ql
    • src/semmle/go/frameworks
    • test/library-tests/semmle/go/frameworks/StdlibTaintFlow

3 files changed

+290
-81
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 1 addition & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import semmle.go.frameworks.stdlib.EncodingXml
3030
import semmle.go.frameworks.stdlib.Html
3131
import semmle.go.frameworks.stdlib.HtmlTemplate
3232
import semmle.go.frameworks.stdlib.Context
33+
import semmle.go.frameworks.stdlib.Os
3334
import semmle.go.frameworks.stdlib.Path
3435
import semmle.go.frameworks.stdlib.PathFilepath
3536
import semmle.go.frameworks.stdlib.Reflect
@@ -400,87 +401,6 @@ module IoUtil {
400401
}
401402
}
402403

403-
/** Provides models of commonly used functions in the `os` package. */
404-
module OS {
405-
/**
406-
* A call to a function in `os` that accesses the file system.
407-
*/
408-
private class OsFileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
409-
int pathidx;
410-
411-
OsFileSystemAccess() {
412-
exists(string fn | getTarget().hasQualifiedName("os", fn) |
413-
fn = "Chdir" and pathidx = 0
414-
or
415-
fn = "Chmod" and pathidx = 0
416-
or
417-
fn = "Chown" and pathidx = 0
418-
or
419-
fn = "Chtimes" and pathidx = 0
420-
or
421-
fn = "Create" and pathidx = 0
422-
or
423-
fn = "Lchown" and pathidx = 0
424-
or
425-
fn = "Link" and pathidx in [0 .. 1]
426-
or
427-
fn = "Lstat" and pathidx = 0
428-
or
429-
fn = "Mkdir" and pathidx = 0
430-
or
431-
fn = "MkdirAll" and pathidx = 0
432-
or
433-
fn = "NewFile" and pathidx = 1
434-
or
435-
fn = "Open" and pathidx = 0
436-
or
437-
fn = "OpenFile" and pathidx = 0
438-
or
439-
fn = "Readlink" and pathidx = 0
440-
or
441-
fn = "Remove" and pathidx = 0
442-
or
443-
fn = "RemoveAll" and pathidx = 0
444-
or
445-
fn = "Rename" and pathidx in [0 .. 1]
446-
or
447-
fn = "Stat" and pathidx = 0
448-
or
449-
fn = "Symlink" and pathidx in [0 .. 1]
450-
or
451-
fn = "Truncate" and pathidx = 0
452-
)
453-
}
454-
455-
override DataFlow::Node getAPathArgument() { result = getArgument(pathidx) }
456-
}
457-
458-
/** The `Expand` function. */
459-
class Expand extends TaintTracking::FunctionModel {
460-
Expand() { hasQualifiedName("os", "Expand") }
461-
462-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
463-
inp.isParameter(0) and outp.isResult()
464-
}
465-
}
466-
467-
/** The `ExpandEnv` function. */
468-
class ExpandEnv extends TaintTracking::FunctionModel {
469-
ExpandEnv() { hasQualifiedName("os", "ExpandEnv") }
470-
471-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
472-
inp.isParameter(0) and outp.isResult()
473-
}
474-
}
475-
476-
/** The `os.Exit` function, which ends the process. */
477-
private class Exit extends Function {
478-
Exit() { hasQualifiedName("os", "Exit") }
479-
480-
override predicate mayReturnNormally() { none() }
481-
}
482-
}
483-
484404
/** Provides a class for modeling functions which convert strings into integers. */
485405
module IntegerParser {
486406
/**

‎ql/src/semmle/go/frameworks/stdlib/Os.qll

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `os` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `os` package. */
8+
module Os {
9+
/**
10+
* A call to a function in `os` that accesses the file system.
11+
*/
12+
private class OsFileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
13+
int pathidx;
14+
15+
OsFileSystemAccess() {
16+
exists(string fn | getTarget().hasQualifiedName("os", fn) |
17+
fn = "Chdir" and pathidx = 0
18+
or
19+
fn = "Chmod" and pathidx = 0
20+
or
21+
fn = "Chown" and pathidx = 0
22+
or
23+
fn = "Chtimes" and pathidx = 0
24+
or
25+
fn = "Create" and pathidx = 0
26+
or
27+
fn = "Lchown" and pathidx = 0
28+
or
29+
fn = "Link" and pathidx in [0 .. 1]
30+
or
31+
fn = "Lstat" and pathidx = 0
32+
or
33+
fn = "Mkdir" and pathidx = 0
34+
or
35+
fn = "MkdirAll" and pathidx = 0
36+
or
37+
fn = "NewFile" and pathidx = 1
38+
or
39+
fn = "Open" and pathidx = 0
40+
or
41+
fn = "OpenFile" and pathidx = 0
42+
or
43+
fn = "Readlink" and pathidx = 0
44+
or
45+
fn = "Remove" and pathidx = 0
46+
or
47+
fn = "RemoveAll" and pathidx = 0
48+
or
49+
fn = "Rename" and pathidx in [0 .. 1]
50+
or
51+
fn = "Stat" and pathidx = 0
52+
or
53+
fn = "Symlink" and pathidx in [0 .. 1]
54+
or
55+
fn = "Truncate" and pathidx = 0
56+
)
57+
}
58+
59+
override DataFlow::Node getAPathArgument() { result = getArgument(pathidx) }
60+
}
61+
62+
/** The `os.Exit` function, which ends the process. */
63+
private class Exit extends Function {
64+
Exit() { hasQualifiedName("os", "Exit") }
65+
66+
override predicate mayReturnNormally() { none() }
67+
}
68+
69+
private class FunctionModels extends TaintTracking::FunctionModel {
70+
FunctionInput inp;
71+
FunctionOutput outp;
72+
73+
FunctionModels() {
74+
// signature: func Expand(s string, mapping func(string) string) string
75+
hasQualifiedName("os", "Expand") and
76+
(inp.isParameter(0) and outp.isResult())
77+
or
78+
// signature: func ExpandEnv(s string) string
79+
hasQualifiedName("os", "ExpandEnv") and
80+
(inp.isParameter(0) and outp.isResult())
81+
or
82+
// signature: func NewFile(fd uintptr, name string) *File
83+
hasQualifiedName("os", "NewFile") and
84+
(inp.isParameter(0) and outp.isResult())
85+
or
86+
// signature: func Pipe() (r *File, w *File, err error)
87+
hasQualifiedName("os", "Pipe") and
88+
(inp.isResult(1) and outp.isResult(0))
89+
}
90+
91+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
92+
input = inp and output = outp
93+
}
94+
}
95+
96+
private class MethodModels extends TaintTracking::FunctionModel, Method {
97+
FunctionInput inp;
98+
FunctionOutput outp;
99+
100+
MethodModels() {
101+
// signature: func (*File).Fd() uintptr
102+
this.hasQualifiedName("os", "File", "Fd") and
103+
(inp.isReceiver() and outp.isResult())
104+
or
105+
// signature: func (*File).Read(b []byte) (n int, err error)
106+
this.hasQualifiedName("os", "File", "Read") and
107+
(inp.isReceiver() and outp.isParameter(0))
108+
or
109+
// signature: func (*File).ReadAt(b []byte, off int64) (n int, err error)
110+
this.hasQualifiedName("os", "File", "ReadAt") and
111+
(inp.isReceiver() and outp.isParameter(0))
112+
or
113+
// signature: func (*File).SyscallConn() (syscall.RawConn, error)
114+
this.hasQualifiedName("os", "File", "SyscallConn") and
115+
(
116+
inp.isReceiver() and outp.isResult(0)
117+
or
118+
inp.isResult(0) and outp.isReceiver()
119+
)
120+
or
121+
// signature: func (*File).Write(b []byte) (n int, err error)
122+
this.hasQualifiedName("os", "File", "Write") and
123+
(inp.isParameter(0) and outp.isReceiver())
124+
or
125+
// signature: func (*File).WriteAt(b []byte, off int64) (n int, err error)
126+
this.hasQualifiedName("os", "File", "WriteAt") and
127+
(inp.isParameter(0) and outp.isReceiver())
128+
or
129+
// signature: func (*File).WriteString(s string) (n int, err error)
130+
this.hasQualifiedName("os", "File", "WriteString") and
131+
(inp.isParameter(0) and outp.isReceiver())
132+
}
133+
134+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
135+
input = inp and output = outp
136+
}
137+
}
138+
}

‎ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Os.go

Lines changed: 151 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)