Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 1bf366c

Browse files
smowtonsmowton
committed
Add models for the Chi web framework
This is mostly simple as the framework uses ordinary net/http methods and ordinary Go contexts for most purposes.
1 parent 8d7cbe3 commit 1bf366c

File tree

10 files changed

+289
-0
lines changed

10 files changed

+289
-0
lines changed

‎change-notes/2020-09-15-chi.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Added support for the Chi web framework

‎ql/src/go.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import semmle.go.dataflow.DataFlow
2626
import semmle.go.dataflow.GlobalValueNumbering
2727
import semmle.go.dataflow.SSA
2828
import semmle.go.dataflow.TaintTracking
29+
import semmle.go.frameworks.Chi
2930
import semmle.go.frameworks.Email
3031
import semmle.go.frameworks.Encoding
3132
import semmle.go.frameworks.Gin

‎ql/src/semmle/go/frameworks/Chi.qll

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Provides classes for working with untrusted flow sources from the `github.com/go-chi/chi` package.
3+
*/
4+
5+
import go
6+
7+
private module Chi {
8+
/**
9+
* Functions that extract URL parameters, considered as a source of untrusted flow.
10+
*/
11+
private class UserControlledFunction extends UntrustedFlowSource::Range, DataFlow::CallNode {
12+
UserControlledFunction() {
13+
this.getTarget().hasQualifiedName("github.com/go-chi/chi", ["URLParam", "URLParamFromCtx"])
14+
}
15+
}
16+
17+
/**
18+
* Methods that extract URL parameters, considered as a source of untrusted flow.
19+
*/
20+
private class UserControlledRequestMethod extends UntrustedFlowSource::Range,
21+
DataFlow::MethodCallNode {
22+
UserControlledRequestMethod() {
23+
this.getTarget().hasQualifiedName("github.com/go-chi/chi", "Context", "URLParam")
24+
}
25+
}
26+
}

‎ql/test/library-tests/semmle/go/frameworks/Chi/LICENSE

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Copyright (c) 2015-present Peter Kieltyka (https://github.com/pkieltyka), Google Inc.
2+
3+
MIT License
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy of
6+
this software and associated documentation files (the "Software"), to deal in
7+
the Software without restriction, including without limitation the rights to
8+
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
9+
the Software, and to permit persons to whom the Software is furnished to do so,
10+
subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
17+
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
18+
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
19+
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
20+
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎ql/test/library-tests/semmle/go/frameworks/Chi/ReflectedXss.expected

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
edges
2+
| test.go:13:12:13:16 | implicit dereference : URL | test.go:13:12:13:16 | implicit dereference : URL |
3+
| test.go:13:12:13:16 | implicit dereference : URL | test.go:13:12:13:16 | selection of URL : pointer type |
4+
| test.go:13:12:13:16 | implicit dereference : URL | test.go:13:12:13:21 | selection of Path : string |
5+
| test.go:13:12:13:16 | selection of URL : pointer type | test.go:13:12:13:16 | implicit dereference : URL |
6+
| test.go:13:12:13:16 | selection of URL : pointer type | test.go:13:12:13:16 | selection of URL : pointer type |
7+
| test.go:13:12:13:16 | selection of URL : pointer type | test.go:13:12:13:21 | selection of Path : string |
8+
| test.go:13:12:13:21 | selection of Path : string | test.go:21:18:21:23 | hidden : string |
9+
| test.go:21:18:21:23 | hidden : string | test.go:21:11:21:24 | type conversion |
10+
| test.go:22:18:22:45 | call to URLParam : string | test.go:22:11:22:46 | type conversion |
11+
| test.go:23:18:23:60 | call to URLParamFromCtx : string | test.go:23:11:23:61 | type conversion |
12+
| test.go:24:18:24:71 | call to URLParam : string | test.go:24:11:24:72 | type conversion |
13+
nodes
14+
| test.go:13:12:13:16 | implicit dereference : URL | semmle.label | implicit dereference : URL |
15+
| test.go:13:12:13:16 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
16+
| test.go:13:12:13:21 | selection of Path : string | semmle.label | selection of Path : string |
17+
| test.go:21:11:21:24 | type conversion | semmle.label | type conversion |
18+
| test.go:21:18:21:23 | hidden : string | semmle.label | hidden : string |
19+
| test.go:22:11:22:46 | type conversion | semmle.label | type conversion |
20+
| test.go:22:18:22:45 | call to URLParam : string | semmle.label | call to URLParam : string |
21+
| test.go:23:11:23:61 | type conversion | semmle.label | type conversion |
22+
| test.go:23:18:23:60 | call to URLParamFromCtx : string | semmle.label | call to URLParamFromCtx : string |
23+
| test.go:24:11:24:72 | type conversion | semmle.label | type conversion |
24+
| test.go:24:18:24:71 | call to URLParam : string | semmle.label | call to URLParam : string |
25+
#select
26+
| test.go:21:11:21:24 | type conversion | test.go:13:12:13:16 | selection of URL : pointer type | test.go:21:11:21:24 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:13:12:13:16 | selection of URL | user-provided value |
27+
| test.go:22:11:22:46 | type conversion | test.go:22:18:22:45 | call to URLParam : string | test.go:22:11:22:46 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:22:18:22:45 | call to URLParam | user-provided value |
28+
| test.go:23:11:23:61 | type conversion | test.go:23:18:23:60 | call to URLParamFromCtx : string | test.go:23:11:23:61 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:23:18:23:60 | call to URLParamFromCtx | user-provided value |
29+
| test.go:24:11:24:72 | type conversion | test.go:24:18:24:71 | call to URLParam : string | test.go:24:11:24:72 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:24:18:24:71 | call to URLParam | user-provided value |

‎ql/test/library-tests/semmle/go/frameworks/Chi/ReflectedXss.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-079/ReflectedXss.ql

‎ql/test/library-tests/semmle/go/frameworks/Chi/go.mod

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
go 1.14
2+
3+
module test
4+
5+
require (
6+
github.com/go-chi/chi v4.1.2+incompatible
7+
)

‎ql/test/library-tests/semmle/go/frameworks/Chi/test.go

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
package main
2+
3+
import (
4+
"net/http"
5+
6+
"github.com/go-chi/chi"
7+
)
8+
9+
var hidden string
10+
11+
func hideUserData(next http.Handler) http.Handler {
12+
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
13+
hidden = r.URL.Path
14+
next.ServeHTTP(w, r)
15+
})
16+
}
17+
18+
func main() {
19+
r := chi.NewRouter()
20+
r.With(hideUserData).Get("/", func(w http.ResponseWriter, r *http.Request) {
21+
w.Write([]byte(hidden))
22+
w.Write([]byte(chi.URLParam(r, "someParam")))
23+
w.Write([]byte(chi.URLParamFromCtx(r.Context(), "someKey")))
24+
w.Write([]byte(chi.RouteContext(r.Context()).URLParam("someOtherKey")))
25+
})
26+
http.ListenAndServe(":3000", r)
27+
}

‎ql/test/library-tests/semmle/go/frameworks/Chi/vendor/github.com/go-chi/chi/stub.go

Lines changed: 173 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ql/test/library-tests/semmle/go/frameworks/Chi/vendor/modules.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# github.com/go-chi/chi v4.1.2+incompatible
2+
## explicit
3+
github.com/go-chi/chi

0 commit comments

Comments
 (0)