Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 1e7bbcc

Browse files
smowtonsmowton
authored
Merge pull request #290 from sauyon/openredirect-uri
Open URL Redirect: make isValidURI and the like sanitizers
2 parents c07db2a + 5b9fb2a commit 1e7bbcc

File tree

3 files changed

+47
-35
lines changed

3 files changed

+47
-35
lines changed

‎ql/src/semmle/go/dataflow/BarrierGuardUtil.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import go
1010
*/
1111
class RedirectCheckBarrierGuard extends DataFlow::BarrierGuard, DataFlow::CallNode {
1212
RedirectCheckBarrierGuard() {
13-
this.getCalleeName().regexpMatch("(?i)(is_?)?(local_?url|valid_?redir(ect)?)")
13+
this.getCalleeName().regexpMatch("(?i)(is_?)?(local_?url|valid_?redir(ect)?)(ur[li])?")
1414
}
1515

1616
override predicate checks(Expr e, boolean outcome) {

‎ql/test/query-tests/Security/CWE-601/OpenUrlRedirect/OpenUrlRedirect.expected

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,20 @@ edges
88
| stdlib.go:89:13:89:18 | selection of Form : Values | stdlib.go:92:23:92:28 | target |
99
| stdlib.go:113:24:113:28 | selection of URL : pointer type | stdlib.go:113:24:113:37 | call to String |
1010
| stdlib.go:113:24:113:28 | selection of URL : pointer type | stdlib.go:113:24:113:37 | call to String |
11-
| stdlib.go:134:13:134:18 | selection of Form : Values | stdlib.go:140:23:140:28 | target |
12-
| stdlib.go:147:11:147:15 | selection of URL : pointer type | stdlib.go:147:11:147:15 | selection of URL : pointer type |
13-
| stdlib.go:147:11:147:15 | selection of URL : pointer type | stdlib.go:147:11:147:15 | selection of URL : pointer type |
14-
| stdlib.go:147:11:147:15 | selection of URL : pointer type | stdlib.go:150:24:150:35 | call to String |
15-
| stdlib.go:147:11:147:15 | selection of URL : pointer type | stdlib.go:150:24:150:35 | call to String |
16-
| stdlib.go:161:35:161:39 | selection of URL : pointer type | stdlib.go:161:24:161:52 | ...+... |
17-
| stdlib.go:161:35:161:39 | selection of URL : pointer type | stdlib.go:161:24:161:52 | ...+... |
18-
| stdlib.go:170:13:170:33 | call to FormValue : string | stdlib.go:172:23:172:28 | target |
19-
| stdlib.go:178:36:178:56 | call to FormValue : string | stdlib.go:180:23:180:28 | implicit dereference : URL |
20-
| stdlib.go:178:36:178:56 | call to FormValue : string | stdlib.go:180:23:180:33 | selection of Path |
21-
| stdlib.go:178:36:178:56 | call to FormValue : string | stdlib.go:182:23:182:42 | call to EscapedPath |
22-
| stdlib.go:180:23:180:28 | implicit dereference : URL | stdlib.go:180:23:180:28 | implicit dereference : URL |
23-
| stdlib.go:180:23:180:28 | implicit dereference : URL | stdlib.go:180:23:180:33 | selection of Path |
24-
| stdlib.go:180:23:180:28 | implicit dereference : URL | stdlib.go:182:23:182:42 | call to EscapedPath |
11+
| stdlib.go:146:13:146:18 | selection of Form : Values | stdlib.go:152:23:152:28 | target |
12+
| stdlib.go:159:11:159:15 | selection of URL : pointer type | stdlib.go:159:11:159:15 | selection of URL : pointer type |
13+
| stdlib.go:159:11:159:15 | selection of URL : pointer type | stdlib.go:159:11:159:15 | selection of URL : pointer type |
14+
| stdlib.go:159:11:159:15 | selection of URL : pointer type | stdlib.go:162:24:162:35 | call to String |
15+
| stdlib.go:159:11:159:15 | selection of URL : pointer type | stdlib.go:162:24:162:35 | call to String |
16+
| stdlib.go:173:35:173:39 | selection of URL : pointer type | stdlib.go:173:24:173:52 | ...+... |
17+
| stdlib.go:173:35:173:39 | selection of URL : pointer type | stdlib.go:173:24:173:52 | ...+... |
18+
| stdlib.go:182:13:182:33 | call to FormValue : string | stdlib.go:184:23:184:28 | target |
19+
| stdlib.go:190:36:190:56 | call to FormValue : string | stdlib.go:192:23:192:28 | implicit dereference : URL |
20+
| stdlib.go:190:36:190:56 | call to FormValue : string | stdlib.go:192:23:192:33 | selection of Path |
21+
| stdlib.go:190:36:190:56 | call to FormValue : string | stdlib.go:194:23:194:42 | call to EscapedPath |
22+
| stdlib.go:192:23:192:28 | implicit dereference : URL | stdlib.go:192:23:192:28 | implicit dereference : URL |
23+
| stdlib.go:192:23:192:28 | implicit dereference : URL | stdlib.go:192:23:192:33 | selection of Path |
24+
| stdlib.go:192:23:192:28 | implicit dereference : URL | stdlib.go:194:23:194:42 | call to EscapedPath |
2525
nodes
2626
| OpenUrlRedirect.go:10:23:10:28 | selection of Form : Values | semmle.label | selection of Form : Values |
2727
| OpenUrlRedirect.go:10:23:10:42 | call to Get | semmle.label | call to Get |
@@ -41,22 +41,22 @@ nodes
4141
| stdlib.go:113:24:113:28 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
4242
| stdlib.go:113:24:113:37 | call to String | semmle.label | call to String |
4343
| stdlib.go:113:24:113:37 | call to String | semmle.label | call to String |
44-
| stdlib.go:134:13:134:18 | selection of Form : Values | semmle.label | selection of Form : Values |
45-
| stdlib.go:140:23:140:28 | target | semmle.label | target |
46-
| stdlib.go:147:11:147:15 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
47-
| stdlib.go:147:11:147:15 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
48-
| stdlib.go:150:24:150:35 | call to String | semmle.label | call to String |
49-
| stdlib.go:150:24:150:35 | call to String | semmle.label | call to String |
50-
| stdlib.go:161:24:161:52 | ...+... | semmle.label | ...+... |
51-
| stdlib.go:161:24:161:52 | ...+... | semmle.label | ...+... |
52-
| stdlib.go:161:35:161:39 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
53-
| stdlib.go:161:35:161:39 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
54-
| stdlib.go:170:13:170:33 | call to FormValue : string | semmle.label | call to FormValue : string |
55-
| stdlib.go:172:23:172:28 | target | semmle.label | target |
56-
| stdlib.go:178:36:178:56 | call to FormValue : string | semmle.label | call to FormValue : string |
57-
| stdlib.go:180:23:180:28 | implicit dereference : URL | semmle.label | implicit dereference : URL |
58-
| stdlib.go:180:23:180:33 | selection of Path | semmle.label | selection of Path |
59-
| stdlib.go:182:23:182:42 | call to EscapedPath | semmle.label | call to EscapedPath |
44+
| stdlib.go:146:13:146:18 | selection of Form : Values | semmle.label | selection of Form : Values |
45+
| stdlib.go:152:23:152:28 | target | semmle.label | target |
46+
| stdlib.go:159:11:159:15 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
47+
| stdlib.go:159:11:159:15 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
48+
| stdlib.go:162:24:162:35 | call to String | semmle.label | call to String |
49+
| stdlib.go:162:24:162:35 | call to String | semmle.label | call to String |
50+
| stdlib.go:173:24:173:52 | ...+... | semmle.label | ...+... |
51+
| stdlib.go:173:24:173:52 | ...+... | semmle.label | ...+... |
52+
| stdlib.go:173:35:173:39 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
53+
| stdlib.go:173:35:173:39 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
54+
| stdlib.go:182:13:182:33 | call to FormValue : string | semmle.label | call to FormValue : string |
55+
| stdlib.go:184:23:184:28 | target | semmle.label | target |
56+
| stdlib.go:190:36:190:56 | call to FormValue : string | semmle.label | call to FormValue : string |
57+
| stdlib.go:192:23:192:28 | implicit dereference : URL | semmle.label | implicit dereference : URL |
58+
| stdlib.go:192:23:192:33 | selection of Path | semmle.label | selection of Path |
59+
| stdlib.go:194:23:194:42 | call to EscapedPath | semmle.label | call to EscapedPath |
6060
#select
6161
| OpenUrlRedirect.go:10:23:10:42 | call to Get | OpenUrlRedirect.go:10:23:10:28 | selection of Form : Values | OpenUrlRedirect.go:10:23:10:42 | call to Get | Untrusted URL redirection due to $@. | OpenUrlRedirect.go:10:23:10:28 | selection of Form | user-provided value |
6262
| stdlib.go:15:30:15:35 | target | stdlib.go:13:13:13:18 | selection of Form : Values | stdlib.go:15:30:15:35 | target | Untrusted URL redirection due to $@. | stdlib.go:13:13:13:18 | selection of Form | user-provided value |
@@ -65,7 +65,7 @@ nodes
6565
| stdlib.go:46:23:46:28 | target | stdlib.go:44:13:44:18 | selection of Form : Values | stdlib.go:46:23:46:28 | target | Untrusted URL redirection due to $@. | stdlib.go:44:13:44:18 | selection of Form | user-provided value |
6666
| stdlib.go:67:23:67:40 | ...+... | stdlib.go:64:13:64:18 | selection of Form : Values | stdlib.go:67:23:67:40 | ...+... | Untrusted URL redirection due to $@. | stdlib.go:64:13:64:18 | selection of Form | user-provided value |
6767
| stdlib.go:92:23:92:28 | target | stdlib.go:89:13:89:18 | selection of Form : Values | stdlib.go:92:23:92:28 | target | Untrusted URL redirection due to $@. | stdlib.go:89:13:89:18 | selection of Form | user-provided value |
68-
| stdlib.go:140:23:140:28 | target | stdlib.go:134:13:134:18 | selection of Form : Values | stdlib.go:140:23:140:28 | target | Untrusted URL redirection due to $@. | stdlib.go:134:13:134:18 | selection of Form | user-provided value |
69-
| stdlib.go:172:23:172:28 | target | stdlib.go:170:13:170:33 | call to FormValue : string | stdlib.go:172:23:172:28 | target | Untrusted URL redirection due to $@. | stdlib.go:170:13:170:33 | call to FormValue | user-provided value |
70-
| stdlib.go:180:23:180:33 | selection of Path | stdlib.go:178:36:178:56 | call to FormValue : string | stdlib.go:180:23:180:33 | selection of Path | Untrusted URL redirection due to $@. | stdlib.go:178:36:178:56 | call to FormValue | user-provided value |
71-
| stdlib.go:182:23:182:42 | call to EscapedPath | stdlib.go:178:36:178:56 | call to FormValue : string | stdlib.go:182:23:182:42 | call to EscapedPath | Untrusted URL redirection due to $@. | stdlib.go:178:36:178:56 | call to FormValue | user-provided value |
68+
| stdlib.go:152:23:152:28 | target | stdlib.go:146:13:146:18 | selection of Form : Values | stdlib.go:152:23:152:28 | target | Untrusted URL redirection due to $@. | stdlib.go:146:13:146:18 | selection of Form | user-provided value |
69+
| stdlib.go:184:23:184:28 | target | stdlib.go:182:13:182:33 | call to FormValue : string | stdlib.go:184:23:184:28 | target | Untrusted URL redirection due to $@. | stdlib.go:182:13:182:33 | call to FormValue | user-provided value |
70+
| stdlib.go:192:23:192:33 | selection of Path | stdlib.go:190:36:190:56 | call to FormValue : string | stdlib.go:192:23:192:33 | selection of Path | Untrusted URL redirection due to $@. | stdlib.go:190:36:190:56 | call to FormValue | user-provided value |
71+
| stdlib.go:194:23:194:42 | call to EscapedPath | stdlib.go:190:36:190:56 | call to FormValue : string | stdlib.go:194:23:194:42 | call to EscapedPath | Untrusted URL redirection due to $@. | stdlib.go:190:36:190:56 | call to FormValue | user-provided value |

‎ql/test/query-tests/Security/CWE-601/OpenUrlRedirect/stdlib.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,18 @@ func serveStdlib() {
128128
}
129129
})
130130

131+
http.HandleFunc("/ex", func(w http.ResponseWriter, r *http.Request) {
132+
r.ParseForm()
133+
134+
target := r.Form.Get("target")
135+
// GOOD: a check is done on the URL
136+
if isValidRedirectUri(target) {
137+
http.Redirect(w, r, target, 302)
138+
} else {
139+
// ...
140+
}
141+
})
142+
131143
http.HandleFunc("/ex9", func(w http.ResponseWriter, r *http.Request) {
132144
r.ParseForm()
133145

0 commit comments

Comments
 (0)