Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 3075294

Browse files
gagliardettosmowton
gagliardetto
authored and
smowton
committed
Move strings module to stdlib, and add more taint-tracking classes to it.
1 parent 42c7f8c commit 3075294

File tree

3 files changed

+725
-64
lines changed

3 files changed

+725
-64
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -485,70 +485,6 @@ module IntegerParser {
485485
}
486486
}
487487

488-
/** Provides models of commonly used functions in the `strings` package. */
489-
module Strings {
490-
/** The `Join` function. */
491-
class Join extends TaintTracking::FunctionModel {
492-
Join() { hasQualifiedName("strings", "Join") }
493-
494-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
495-
inp.isParameter([0 .. 1]) and outp.isResult()
496-
}
497-
}
498-
499-
/** The `Repeat` function. */
500-
class Repeat extends TaintTracking::FunctionModel {
501-
Repeat() { hasQualifiedName("strings", "Repeat") }
502-
503-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
504-
inp.isParameter(0) and outp.isResult()
505-
}
506-
}
507-
508-
/** The `Replace` or `ReplaceAll` function. */
509-
class Replacer extends TaintTracking::FunctionModel {
510-
Replacer() {
511-
hasQualifiedName("strings", "Replace") or hasQualifiedName("strings", "ReplaceAll")
512-
}
513-
514-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
515-
(inp.isParameter(0) or inp.isParameter(2)) and
516-
outp.isResult()
517-
}
518-
}
519-
520-
/** The `Split` function or one of its variants. */
521-
class Splitter extends TaintTracking::FunctionModel {
522-
Splitter() {
523-
exists(string split | split.matches("Split%") | hasQualifiedName("strings", split))
524-
}
525-
526-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
527-
inp.isParameter(0) and outp.isResult()
528-
}
529-
}
530-
531-
/** One of the case-converting functions in the `strings` package. */
532-
class CaseConverter extends TaintTracking::FunctionModel {
533-
CaseConverter() {
534-
exists(string conv | conv.matches("To%") | hasQualifiedName("strings", conv))
535-
}
536-
537-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
538-
inp.isParameter(getNumParameter() - 1) and outp.isResult()
539-
}
540-
}
541-
542-
/** The `Trim` function or one of its variants. */
543-
class Trimmer extends TaintTracking::FunctionModel {
544-
Trimmer() { exists(string split | split.matches("Trim%") | hasQualifiedName("strings", split)) }
545-
546-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
547-
inp.isParameter(0) and outp.isResult()
548-
}
549-
}
550-
}
551-
552488
/** Provides models of commonly used functions in the `net/url` package. */
553489
module URL {
554490
/** The `PathEscape` or `QueryEscape` function. */

‎ql/src/semmle/go/frameworks/stdlib/Strings.qll

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `strings` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `strings` package. */
8+
module Strings {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func Fields(s string) []string
15+
hasQualifiedName("strings", "Fields") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func FieldsFunc(s string, f func(rune) bool) []string
19+
hasQualifiedName("strings", "FieldsFunc") and
20+
(inp.isParameter(0) and outp.isResult())
21+
or
22+
// signature: func Join(elems []string, sep string) string
23+
hasQualifiedName("strings", "Join") and
24+
(inp.isParameter(_) and outp.isResult())
25+
or
26+
// signature: func Map(mapping func(rune) rune, s string) string
27+
hasQualifiedName("strings", "Map") and
28+
(inp.isParameter(1) and outp.isResult())
29+
or
30+
// signature: func NewReader(s string) *Reader
31+
hasQualifiedName("strings", "NewReader") and
32+
(inp.isParameter(0) and outp.isResult())
33+
or
34+
// signature: func NewReplacer(oldnew ...string) *Replacer
35+
hasQualifiedName("strings", "NewReplacer") and
36+
(inp.isParameter(_) and outp.isResult())
37+
or
38+
// signature: func Repeat(s string, count int) string
39+
hasQualifiedName("strings", "Repeat") and
40+
(inp.isParameter(0) and outp.isResult())
41+
or
42+
// signature: func Replace(s string, old string, new string, n int) string
43+
hasQualifiedName("strings", "Replace") and
44+
(inp.isParameter([0, 2]) and outp.isResult())
45+
or
46+
// signature: func ReplaceAll(s string, old string, new string) string
47+
hasQualifiedName("strings", "ReplaceAll") and
48+
(inp.isParameter([0, 2]) and outp.isResult())
49+
or
50+
// signature: func Split(s string, sep string) []string
51+
hasQualifiedName("strings", "Split") and
52+
(inp.isParameter(0) and outp.isResult())
53+
or
54+
// signature: func SplitAfter(s string, sep string) []string
55+
hasQualifiedName("strings", "SplitAfter") and
56+
(inp.isParameter(0) and outp.isResult())
57+
or
58+
// signature: func SplitAfterN(s string, sep string, n int) []string
59+
hasQualifiedName("strings", "SplitAfterN") and
60+
(inp.isParameter(0) and outp.isResult())
61+
or
62+
// signature: func SplitN(s string, sep string, n int) []string
63+
hasQualifiedName("strings", "SplitN") and
64+
(inp.isParameter(0) and outp.isResult())
65+
or
66+
// signature: func Title(s string) string
67+
hasQualifiedName("strings", "Title") and
68+
(inp.isParameter(0) and outp.isResult())
69+
or
70+
// signature: func ToLower(s string) string
71+
hasQualifiedName("strings", "ToLower") and
72+
(inp.isParameter(0) and outp.isResult())
73+
or
74+
// signature: func ToLowerSpecial(c unicode.SpecialCase, s string) string
75+
hasQualifiedName("strings", "ToLowerSpecial") and
76+
(inp.isParameter(1) and outp.isResult())
77+
or
78+
// signature: func ToTitle(s string) string
79+
hasQualifiedName("strings", "ToTitle") and
80+
(inp.isParameter(0) and outp.isResult())
81+
or
82+
// signature: func ToTitleSpecial(c unicode.SpecialCase, s string) string
83+
hasQualifiedName("strings", "ToTitleSpecial") and
84+
(inp.isParameter(1) and outp.isResult())
85+
or
86+
// signature: func ToUpper(s string) string
87+
hasQualifiedName("strings", "ToUpper") and
88+
(inp.isParameter(0) and outp.isResult())
89+
or
90+
// signature: func ToUpperSpecial(c unicode.SpecialCase, s string) string
91+
hasQualifiedName("strings", "ToUpperSpecial") and
92+
(inp.isParameter(1) and outp.isResult())
93+
or
94+
// signature: func ToValidUTF8(s string, replacement string) string
95+
hasQualifiedName("strings", "ToValidUTF8") and
96+
(inp.isParameter(_) and outp.isResult())
97+
or
98+
// signature: func Trim(s string, cutset string) string
99+
hasQualifiedName("strings", "Trim") and
100+
(inp.isParameter(0) and outp.isResult())
101+
or
102+
// signature: func TrimFunc(s string, f func(rune) bool) string
103+
hasQualifiedName("strings", "TrimFunc") and
104+
(inp.isParameter(0) and outp.isResult())
105+
or
106+
// signature: func TrimLeft(s string, cutset string) string
107+
hasQualifiedName("strings", "TrimLeft") and
108+
(inp.isParameter(0) and outp.isResult())
109+
or
110+
// signature: func TrimLeftFunc(s string, f func(rune) bool) string
111+
hasQualifiedName("strings", "TrimLeftFunc") and
112+
(inp.isParameter(0) and outp.isResult())
113+
or
114+
// signature: func TrimPrefix(s string, prefix string) string
115+
hasQualifiedName("strings", "TrimPrefix") and
116+
(inp.isParameter(0) and outp.isResult())
117+
or
118+
// signature: func TrimRight(s string, cutset string) string
119+
hasQualifiedName("strings", "TrimRight") and
120+
(inp.isParameter(0) and outp.isResult())
121+
or
122+
// signature: func TrimRightFunc(s string, f func(rune) bool) string
123+
hasQualifiedName("strings", "TrimRightFunc") and
124+
(inp.isParameter(0) and outp.isResult())
125+
or
126+
// signature: func TrimSpace(s string) string
127+
hasQualifiedName("strings", "TrimSpace") and
128+
(inp.isParameter(0) and outp.isResult())
129+
or
130+
// signature: func TrimSuffix(s string, suffix string) string
131+
hasQualifiedName("strings", "TrimSuffix") and
132+
(inp.isParameter(0) and outp.isResult())
133+
}
134+
135+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
136+
input = inp and output = outp
137+
}
138+
}
139+
140+
private class MethodModels extends TaintTracking::FunctionModel, Method {
141+
FunctionInput inp;
142+
FunctionOutput outp;
143+
144+
MethodModels() {
145+
// signature: func (*Builder).String() string
146+
this.hasQualifiedName("strings", "Builder", "String") and
147+
(inp.isReceiver() and outp.isResult())
148+
or
149+
// signature: func (*Builder).Write(p []byte) (int, error)
150+
this.hasQualifiedName("strings", "Builder", "Write") and
151+
(inp.isParameter(0) and outp.isReceiver())
152+
or
153+
// signature: func (*Builder).WriteByte(c byte) error
154+
this.hasQualifiedName("strings", "Builder", "WriteByte") and
155+
(inp.isParameter(0) and outp.isReceiver())
156+
or
157+
// signature: func (*Builder).WriteString(s string) (int, error)
158+
this.hasQualifiedName("strings", "Builder", "WriteString") and
159+
(inp.isParameter(0) and outp.isReceiver())
160+
or
161+
// signature: func (*Reader).Read(b []byte) (n int, err error)
162+
this.hasQualifiedName("strings", "Reader", "Read") and
163+
(inp.isReceiver() and outp.isParameter(0))
164+
or
165+
// signature: func (*Reader).ReadAt(b []byte, off int64) (n int, err error)
166+
this.hasQualifiedName("strings", "Reader", "ReadAt") and
167+
(inp.isReceiver() and outp.isParameter(0))
168+
or
169+
// signature: func (*Reader).ReadByte() (byte, error)
170+
this.hasQualifiedName("strings", "Reader", "ReadByte") and
171+
(inp.isReceiver() and outp.isResult(0))
172+
or
173+
// signature: func (*Reader).ReadRune() (ch rune, size int, err error)
174+
this.hasQualifiedName("strings", "Reader", "ReadRune") and
175+
(inp.isReceiver() and outp.isResult(0))
176+
or
177+
// signature: func (*Reader).Reset(s string)
178+
this.hasQualifiedName("strings", "Reader", "Reset") and
179+
(inp.isParameter(0) and outp.isReceiver())
180+
or
181+
// signature: func (*Reader).WriteTo(w io.Writer) (n int64, err error)
182+
this.hasQualifiedName("strings", "Reader", "WriteTo") and
183+
(inp.isReceiver() and outp.isParameter(0))
184+
or
185+
// signature: func (*Replacer).Replace(s string) string
186+
this.hasQualifiedName("strings", "Replacer", "Replace") and
187+
(inp.isParameter(0) and outp.isResult())
188+
or
189+
// signature: func (*Replacer).WriteString(w io.Writer, s string) (n int, err error)
190+
this.hasQualifiedName("strings", "Replacer", "WriteString") and
191+
(inp.isParameter(1) and outp.isParameter(0))
192+
}
193+
194+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
195+
input = inp and output = outp
196+
}
197+
}
198+
}

0 commit comments

Comments
 (0)