Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 3fd6062

Browse files
gagliardettogagliardetto
committed
Add taint-tracking for package "bytes"
1 parent dd8e124 commit 3fd6062

File tree

3 files changed

+878
-11
lines changed

3 files changed

+878
-11
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import go
66
import semmle.go.frameworks.stdlib.ArchiveTar
77
import semmle.go.frameworks.stdlib.ArchiveZip
88
import semmle.go.frameworks.stdlib.Bufio
9+
import semmle.go.frameworks.stdlib.Bytes
910

1011
/** A `String()` method. */
1112
class StringMethod extends TaintTracking::FunctionModel, Method {
@@ -74,17 +75,6 @@ module PathFilePath {
7475
}
7576
}
7677

77-
/** Provides models of commonly used functions in the `bytes` package. */
78-
private module Bytes {
79-
private class BufferBytes extends TaintTracking::FunctionModel, Method {
80-
BufferBytes() { this.hasQualifiedName("bytes", "Buffer", ["Bytes", "String"]) }
81-
82-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
83-
input.isReceiver() and output.isResult()
84-
}
85-
}
86-
}
87-
8878
/** Provides models of commonly used functions in the `fmt` package. */
8979
module Fmt {
9080
/** The `Sprint` function or one of its variants. */

‎ql/src/semmle/go/frameworks/stdlib/Bytes.qll

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `bytes` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `bytes` package. */
8+
module Bytes {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func Fields(s []byte) [][]byte
15+
hasQualifiedName("bytes", "Fields") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func FieldsFunc(s []byte, f func(rune) bool) [][]byte
19+
hasQualifiedName("bytes", "FieldsFunc") and
20+
(inp.isParameter(0) and outp.isResult())
21+
or
22+
// signature: func Join(s [][]byte, sep []byte) []byte
23+
hasQualifiedName("bytes", "Join") and
24+
(inp.isParameter(_) and outp.isResult())
25+
or
26+
// signature: func Map(mapping func(r rune) rune, s []byte) []byte
27+
hasQualifiedName("bytes", "Map") and
28+
(inp.isParameter(1) and outp.isResult())
29+
or
30+
// signature: func NewBuffer(buf []byte) *Buffer
31+
hasQualifiedName("bytes", "NewBuffer") and
32+
(inp.isParameter(0) and outp.isResult())
33+
or
34+
// signature: func NewBufferString(s string) *Buffer
35+
hasQualifiedName("bytes", "NewBufferString") and
36+
(inp.isParameter(0) and outp.isResult())
37+
or
38+
// signature: func NewReader(b []byte) *Reader
39+
hasQualifiedName("bytes", "NewReader") and
40+
(inp.isParameter(0) and outp.isResult())
41+
or
42+
// signature: func Repeat(b []byte, count int) []byte
43+
hasQualifiedName("bytes", "Repeat") and
44+
(inp.isParameter(0) and outp.isResult())
45+
or
46+
// signature: func Replace(s []byte, old []byte, new []byte, n int) []byte
47+
hasQualifiedName("bytes", "Replace") and
48+
(inp.isParameter([0, 2]) and outp.isResult())
49+
or
50+
// signature: func ReplaceAll(s []byte, old []byte, new []byte) []byte
51+
hasQualifiedName("bytes", "ReplaceAll") and
52+
(inp.isParameter([0, 2]) and outp.isResult())
53+
or
54+
// signature: func Runes(s []byte) []rune
55+
hasQualifiedName("bytes", "Runes") and
56+
(inp.isParameter(0) and outp.isResult())
57+
or
58+
// signature: func Split(s []byte, sep []byte) [][]byte
59+
hasQualifiedName("bytes", "Split") and
60+
(inp.isParameter(0) and outp.isResult())
61+
or
62+
// signature: func SplitAfter(s []byte, sep []byte) [][]byte
63+
hasQualifiedName("bytes", "SplitAfter") and
64+
(inp.isParameter(0) and outp.isResult())
65+
or
66+
// signature: func SplitAfterN(s []byte, sep []byte, n int) [][]byte
67+
hasQualifiedName("bytes", "SplitAfterN") and
68+
(inp.isParameter(0) and outp.isResult())
69+
or
70+
// signature: func SplitN(s []byte, sep []byte, n int) [][]byte
71+
hasQualifiedName("bytes", "SplitN") and
72+
(inp.isParameter(0) and outp.isResult())
73+
or
74+
// signature: func Title(s []byte) []byte
75+
hasQualifiedName("bytes", "Title") and
76+
(inp.isParameter(0) and outp.isResult())
77+
or
78+
// signature: func ToLower(s []byte) []byte
79+
hasQualifiedName("bytes", "ToLower") and
80+
(inp.isParameter(0) and outp.isResult())
81+
or
82+
// signature: func ToLowerSpecial(c unicode.SpecialCase, s []byte) []byte
83+
hasQualifiedName("bytes", "ToLowerSpecial") and
84+
(inp.isParameter(1) and outp.isResult())
85+
or
86+
// signature: func ToTitle(s []byte) []byte
87+
hasQualifiedName("bytes", "ToTitle") and
88+
(inp.isParameter(0) and outp.isResult())
89+
or
90+
// signature: func ToTitleSpecial(c unicode.SpecialCase, s []byte) []byte
91+
hasQualifiedName("bytes", "ToTitleSpecial") and
92+
(inp.isParameter(1) and outp.isResult())
93+
or
94+
// signature: func ToUpper(s []byte) []byte
95+
hasQualifiedName("bytes", "ToUpper") and
96+
(inp.isParameter(0) and outp.isResult())
97+
or
98+
// signature: func ToUpperSpecial(c unicode.SpecialCase, s []byte) []byte
99+
hasQualifiedName("bytes", "ToUpperSpecial") and
100+
(inp.isParameter(1) and outp.isResult())
101+
or
102+
// signature: func ToValidUTF8(s []byte, replacement []byte) []byte
103+
hasQualifiedName("bytes", "ToValidUTF8") and
104+
(inp.isParameter(_) and outp.isResult())
105+
or
106+
// signature: func Trim(s []byte, cutset string) []byte
107+
hasQualifiedName("bytes", "Trim") and
108+
(inp.isParameter(0) and outp.isResult())
109+
or
110+
// signature: func TrimFunc(s []byte, f func(r rune) bool) []byte
111+
hasQualifiedName("bytes", "TrimFunc") and
112+
(inp.isParameter(0) and outp.isResult())
113+
or
114+
// signature: func TrimLeft(s []byte, cutset string) []byte
115+
hasQualifiedName("bytes", "TrimLeft") and
116+
(inp.isParameter(0) and outp.isResult())
117+
or
118+
// signature: func TrimLeftFunc(s []byte, f func(r rune) bool) []byte
119+
hasQualifiedName("bytes", "TrimLeftFunc") and
120+
(inp.isParameter(0) and outp.isResult())
121+
or
122+
// signature: func TrimPrefix(s []byte, prefix []byte) []byte
123+
hasQualifiedName("bytes", "TrimPrefix") and
124+
(inp.isParameter(0) and outp.isResult())
125+
or
126+
// signature: func TrimRight(s []byte, cutset string) []byte
127+
hasQualifiedName("bytes", "TrimRight") and
128+
(inp.isParameter(0) and outp.isResult())
129+
or
130+
// signature: func TrimRightFunc(s []byte, f func(r rune) bool) []byte
131+
hasQualifiedName("bytes", "TrimRightFunc") and
132+
(inp.isParameter(0) and outp.isResult())
133+
or
134+
// signature: func TrimSpace(s []byte) []byte
135+
hasQualifiedName("bytes", "TrimSpace") and
136+
(inp.isParameter(0) and outp.isResult())
137+
or
138+
// signature: func TrimSuffix(s []byte, suffix []byte) []byte
139+
hasQualifiedName("bytes", "TrimSuffix") and
140+
(inp.isParameter(0) and outp.isResult())
141+
}
142+
143+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
144+
input = inp and output = outp
145+
}
146+
}
147+
148+
private class MethodModels extends TaintTracking::FunctionModel, Method {
149+
FunctionInput inp;
150+
FunctionOutput outp;
151+
152+
MethodModels() {
153+
// Methods:
154+
// signature: func (*Buffer).Bytes() []byte
155+
this.(Method).hasQualifiedName("bytes", "Buffer", "Bytes") and
156+
(inp.isReceiver() and outp.isResult())
157+
or
158+
// signature: func (*Buffer).Next(n int) []byte
159+
this.(Method).hasQualifiedName("bytes", "Buffer", "Next") and
160+
(inp.isReceiver() and outp.isResult())
161+
or
162+
// signature: func (*Buffer).Read(p []byte) (n int, err error)
163+
this.(Method).hasQualifiedName("bytes", "Buffer", "Read") and
164+
(inp.isReceiver() and outp.isParameter(0))
165+
or
166+
// signature: func (*Buffer).ReadByte() (byte, error)
167+
this.(Method).hasQualifiedName("bytes", "Buffer", "ReadByte") and
168+
(inp.isReceiver() and outp.isResult(0))
169+
or
170+
// signature: func (*Buffer).ReadBytes(delim byte) (line []byte, err error)
171+
this.(Method).hasQualifiedName("bytes", "Buffer", "ReadBytes") and
172+
(inp.isReceiver() and outp.isResult(0))
173+
or
174+
// signature: func (*Buffer).ReadFrom(r io.Reader) (n int64, err error)
175+
this.(Method).hasQualifiedName("bytes", "Buffer", "ReadFrom") and
176+
(inp.isParameter(0) and outp.isReceiver())
177+
or
178+
// signature: func (*Buffer).ReadRune() (r rune, size int, err error)
179+
this.(Method).hasQualifiedName("bytes", "Buffer", "ReadRune") and
180+
(inp.isReceiver() and outp.isResult(0))
181+
or
182+
// signature: func (*Buffer).ReadString(delim byte) (line string, err error)
183+
this.(Method).hasQualifiedName("bytes", "Buffer", "ReadString") and
184+
(inp.isReceiver() and outp.isResult(0))
185+
or
186+
// signature: func (*Buffer).String() string
187+
this.(Method).hasQualifiedName("bytes", "Buffer", "String") and
188+
(inp.isReceiver() and outp.isResult())
189+
or
190+
// signature: func (*Buffer).Write(p []byte) (n int, err error)
191+
this.(Method).hasQualifiedName("bytes", "Buffer", "Write") and
192+
(inp.isParameter(0) and outp.isReceiver())
193+
or
194+
// signature: func (*Buffer).WriteByte(c byte) error
195+
this.(Method).hasQualifiedName("bytes", "Buffer", "WriteByte") and
196+
(inp.isParameter(0) and outp.isReceiver())
197+
or
198+
// signature: func (*Buffer).WriteRune(r rune) (n int, err error)
199+
this.(Method).hasQualifiedName("bytes", "Buffer", "WriteRune") and
200+
(inp.isParameter(0) and outp.isReceiver())
201+
or
202+
// signature: func (*Buffer).WriteString(s string) (n int, err error)
203+
this.(Method).hasQualifiedName("bytes", "Buffer", "WriteString") and
204+
(inp.isParameter(0) and outp.isReceiver())
205+
or
206+
// signature: func (*Buffer).WriteTo(w io.Writer) (n int64, err error)
207+
this.(Method).hasQualifiedName("bytes", "Buffer", "WriteTo") and
208+
(inp.isReceiver() and outp.isParameter(0))
209+
or
210+
// signature: func (*Reader).Read(b []byte) (n int, err error)
211+
this.(Method).hasQualifiedName("bytes", "Reader", "Read") and
212+
(inp.isReceiver() and outp.isParameter(0))
213+
or
214+
// signature: func (*Reader).ReadAt(b []byte, off int64) (n int, err error)
215+
this.(Method).hasQualifiedName("bytes", "Reader", "ReadAt") and
216+
(inp.isReceiver() and outp.isParameter(0))
217+
or
218+
// signature: func (*Reader).ReadByte() (byte, error)
219+
this.(Method).hasQualifiedName("bytes", "Reader", "ReadByte") and
220+
(inp.isReceiver() and outp.isResult(0))
221+
or
222+
// signature: func (*Reader).ReadRune() (ch rune, size int, err error)
223+
this.(Method).hasQualifiedName("bytes", "Reader", "ReadRune") and
224+
(inp.isReceiver() and outp.isResult(0))
225+
or
226+
// signature: func (*Reader).Reset(b []byte)
227+
this.(Method).hasQualifiedName("bytes", "Reader", "Reset") and
228+
(inp.isParameter(0) and outp.isReceiver())
229+
or
230+
// signature: func (*Reader).WriteTo(w io.Writer) (n int64, err error)
231+
this.(Method).hasQualifiedName("bytes", "Reader", "WriteTo") and
232+
(inp.isReceiver() and outp.isParameter(0))
233+
}
234+
235+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
236+
input = inp and output = outp
237+
}
238+
}
239+
}

0 commit comments

Comments
 (0)