Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 49abd0b

Browse files
owen-mcowen-mc
committed
Add test using hashing
1 parent 83697f6 commit 49abd0b

File tree

2 files changed

+52
-36
lines changed

2 files changed

+52
-36
lines changed

‎ql/test/query-tests/Security/CWE-640/EmailInjection.expected

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,43 @@
11
edges
22
| EmailBad.go:9:10:9:17 | selection of Header : Header | EmailBad.go:12:56:12:67 | type conversion |
3-
| main.go:26:21:26:31 | call to Referer : string | main.go:28:57:28:78 | type conversion |
4-
| main.go:34:21:34:31 | call to Referer : string | main.go:37:3:37:7 | definition of write |
5-
| main.go:43:21:43:31 | call to Referer : string | main.go:49:46:49:59 | untrustedInput |
6-
| main.go:43:21:43:31 | call to Referer : string | main.go:50:52:50:65 | untrustedInput |
7-
| main.go:55:21:55:31 | call to Referer : string | main.go:60:16:60:22 | content |
8-
| main.go:65:21:65:31 | call to Referer : string | main.go:73:50:73:56 | content |
9-
| main.go:65:21:65:31 | call to Referer : string | main.go:73:59:73:65 | content |
10-
| main.go:65:21:65:31 | call to Referer : string | main.go:74:16:74:22 | content |
11-
| main.go:79:21:79:31 | call to Referer : string | main.go:86:37:86:50 | untrustedInput |
12-
| main.go:79:21:79:31 | call to Referer : string | main.go:90:16:90:23 | content2 |
3+
| main.go:29:21:29:31 | call to Referer : string | main.go:31:57:31:78 | type conversion |
4+
| main.go:37:21:37:31 | call to Referer : string | main.go:40:3:40:7 | definition of write |
5+
| main.go:46:21:46:31 | call to Referer : string | main.go:52:46:52:59 | untrustedInput |
6+
| main.go:46:21:46:31 | call to Referer : string | main.go:53:52:53:65 | untrustedInput |
7+
| main.go:58:21:58:31 | call to Referer : string | main.go:63:16:63:22 | content |
8+
| main.go:68:21:68:31 | call to Referer : string | main.go:76:50:76:56 | content |
9+
| main.go:68:21:68:31 | call to Referer : string | main.go:76:59:76:65 | content |
10+
| main.go:68:21:68:31 | call to Referer : string | main.go:77:16:77:22 | content |
11+
| main.go:82:21:82:31 | call to Referer : string | main.go:89:37:89:50 | untrustedInput |
12+
| main.go:82:21:82:31 | call to Referer : string | main.go:93:16:93:23 | content2 |
1313
nodes
1414
| EmailBad.go:9:10:9:17 | selection of Header : Header | semmle.label | selection of Header : Header |
1515
| EmailBad.go:12:56:12:67 | type conversion | semmle.label | type conversion |
16-
| main.go:26:21:26:31 | call to Referer : string | semmle.label | call to Referer : string |
17-
| main.go:28:57:28:78 | type conversion | semmle.label | type conversion |
18-
| main.go:34:21:34:31 | call to Referer : string | semmle.label | call to Referer : string |
19-
| main.go:37:3:37:7 | definition of write | semmle.label | definition of write |
20-
| main.go:43:21:43:31 | call to Referer : string | semmle.label | call to Referer : string |
21-
| main.go:49:46:49:59 | untrustedInput | semmle.label | untrustedInput |
22-
| main.go:50:52:50:65 | untrustedInput | semmle.label | untrustedInput |
23-
| main.go:55:21:55:31 | call to Referer : string | semmle.label | call to Referer : string |
24-
| main.go:60:16:60:22 | content | semmle.label | content |
25-
| main.go:65:21:65:31 | call to Referer : string | semmle.label | call to Referer : string |
26-
| main.go:73:50:73:56 | content | semmle.label | content |
27-
| main.go:73:59:73:65 | content | semmle.label | content |
28-
| main.go:74:16:74:22 | content | semmle.label | content |
29-
| main.go:79:21:79:31 | call to Referer : string | semmle.label | call to Referer : string |
30-
| main.go:86:37:86:50 | untrustedInput | semmle.label | untrustedInput |
31-
| main.go:90:16:90:23 | content2 | semmle.label | content2 |
16+
| main.go:29:21:29:31 | call to Referer : string | semmle.label | call to Referer : string |
17+
| main.go:31:57:31:78 | type conversion | semmle.label | type conversion |
18+
| main.go:37:21:37:31 | call to Referer : string | semmle.label | call to Referer : string |
19+
| main.go:40:3:40:7 | definition of write | semmle.label | definition of write |
20+
| main.go:46:21:46:31 | call to Referer : string | semmle.label | call to Referer : string |
21+
| main.go:52:46:52:59 | untrustedInput | semmle.label | untrustedInput |
22+
| main.go:53:52:53:65 | untrustedInput | semmle.label | untrustedInput |
23+
| main.go:58:21:58:31 | call to Referer : string | semmle.label | call to Referer : string |
24+
| main.go:63:16:63:22 | content | semmle.label | content |
25+
| main.go:68:21:68:31 | call to Referer : string | semmle.label | call to Referer : string |
26+
| main.go:76:50:76:56 | content | semmle.label | content |
27+
| main.go:76:59:76:65 | content | semmle.label | content |
28+
| main.go:77:16:77:22 | content | semmle.label | content |
29+
| main.go:82:21:82:31 | call to Referer : string | semmle.label | call to Referer : string |
30+
| main.go:89:37:89:50 | untrustedInput | semmle.label | untrustedInput |
31+
| main.go:93:16:93:23 | content2 | semmle.label | content2 |
3232
#select
3333
| EmailBad.go:12:56:12:67 | type conversion | EmailBad.go:9:10:9:17 | selection of Header : Header | EmailBad.go:12:56:12:67 | type conversion | Email content may contain $@. | EmailBad.go:9:10:9:17 | selection of Header | untrusted input |
34-
| main.go:28:57:28:78 | type conversion | main.go:26:21:26:31 | call to Referer : string | main.go:28:57:28:78 | type conversion | Email content may contain $@. | main.go:26:21:26:31 | call to Referer | untrusted input |
35-
| main.go:37:3:37:7 | definition of write | main.go:34:21:34:31 | call to Referer : string | main.go:37:3:37:7 | definition of write | Email content may contain $@. | main.go:34:21:34:31 | call to Referer | untrusted input |
36-
| main.go:49:46:49:59 | untrustedInput | main.go:43:21:43:31 | call to Referer : string | main.go:49:46:49:59 | untrustedInput | Email content may contain $@. | main.go:43:21:43:31 | call to Referer | untrusted input |
37-
| main.go:50:52:50:65 | untrustedInput | main.go:43:21:43:31 | call to Referer : string | main.go:50:52:50:65 | untrustedInput | Email content may contain $@. | main.go:43:21:43:31 | call to Referer | untrusted input |
38-
| main.go:60:16:60:22 | content | main.go:55:21:55:31 | call to Referer : string | main.go:60:16:60:22 | content | Email content may contain $@. | main.go:55:21:55:31 | call to Referer | untrusted input |
39-
| main.go:73:50:73:56 | content | main.go:65:21:65:31 | call to Referer : string | main.go:73:50:73:56 | content | Email content may contain $@. | main.go:65:21:65:31 | call to Referer | untrusted input |
40-
| main.go:73:59:73:65 | content | main.go:65:21:65:31 | call to Referer : string | main.go:73:59:73:65 | content | Email content may contain $@. | main.go:65:21:65:31 | call to Referer | untrusted input |
41-
| main.go:74:16:74:22 | content | main.go:65:21:65:31 | call to Referer : string | main.go:74:16:74:22 | content | Email content may contain $@. | main.go:65:21:65:31 | call to Referer | untrusted input |
42-
| main.go:86:37:86:50 | untrustedInput | main.go:79:21:79:31 | call to Referer : string | main.go:86:37:86:50 | untrustedInput | Email content may contain $@. | main.go:79:21:79:31 | call to Referer | untrusted input |
43-
| main.go:90:16:90:23 | content2 | main.go:79:21:79:31 | call to Referer : string | main.go:90:16:90:23 | content2 | Email content may contain $@. | main.go:79:21:79:31 | call to Referer | untrusted input |
34+
| main.go:31:57:31:78 | type conversion | main.go:29:21:29:31 | call to Referer : string | main.go:31:57:31:78 | type conversion | Email content may contain $@. | main.go:29:21:29:31 | call to Referer | untrusted input |
35+
| main.go:40:3:40:7 | definition of write | main.go:37:21:37:31 | call to Referer : string | main.go:40:3:40:7 | definition of write | Email content may contain $@. | main.go:37:21:37:31 | call to Referer | untrusted input |
36+
| main.go:52:46:52:59 | untrustedInput | main.go:46:21:46:31 | call to Referer : string | main.go:52:46:52:59 | untrustedInput | Email content may contain $@. | main.go:46:21:46:31 | call to Referer | untrusted input |
37+
| main.go:53:52:53:65 | untrustedInput | main.go:46:21:46:31 | call to Referer : string | main.go:53:52:53:65 | untrustedInput | Email content may contain $@. | main.go:46:21:46:31 | call to Referer | untrusted input |
38+
| main.go:63:16:63:22 | content | main.go:58:21:58:31 | call to Referer : string | main.go:63:16:63:22 | content | Email content may contain $@. | main.go:58:21:58:31 | call to Referer | untrusted input |
39+
| main.go:76:50:76:56 | content | main.go:68:21:68:31 | call to Referer : string | main.go:76:50:76:56 | content | Email content may contain $@. | main.go:68:21:68:31 | call to Referer | untrusted input |
40+
| main.go:76:59:76:65 | content | main.go:68:21:68:31 | call to Referer : string | main.go:76:59:76:65 | content | Email content may contain $@. | main.go:68:21:68:31 | call to Referer | untrusted input |
41+
| main.go:77:16:77:22 | content | main.go:68:21:68:31 | call to Referer : string | main.go:77:16:77:22 | content | Email content may contain $@. | main.go:68:21:68:31 | call to Referer | untrusted input |
42+
| main.go:89:37:89:50 | untrustedInput | main.go:82:21:82:31 | call to Referer : string | main.go:89:37:89:50 | untrustedInput | Email content may contain $@. | main.go:82:21:82:31 | call to Referer | untrusted input |
43+
| main.go:93:16:93:23 | content2 | main.go:82:21:82:31 | call to Referer : string | main.go:93:16:93:23 | content2 | Email content may contain $@. | main.go:82:21:82:31 | call to Referer | untrusted input |

‎ql/test/query-tests/Security/CWE-640/main.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ package main
33
//go:generate depstubber -vendor github.com/sendgrid/sendgrid-go/helpers/mail "" NewEmail,NewSingleEmail,NewContent,NewV3Mail,NewV3MailInit
44

55
import (
6+
"crypto/hmac"
7+
"crypto/sha256"
8+
"encoding/base64"
69
"io"
710
"log"
811
"net/http"
@@ -90,6 +93,19 @@ func main() {
9093
v.AddContent(content2)
9194
})
9295

96+
// OK
97+
http.HandleFunc("/ex6", func(w http.ResponseWriter, r *http.Request) {
98+
untrustedInput := r.Referer()
99+
100+
sha256 := sha256.New
101+
appsecret := "appid"
102+
hash := hmac.New(sha256, []byte(appsecret))
103+
hash.Write([]byte(untrustedInput))
104+
signature := base64.StdEncoding.EncodeToString(hash.Sum(nil))
105+
106+
smtp.SendMail("test.test", nil, "[email protected]", nil, []byte(signature))
107+
})
108+
93109
log.Println(http.ListenAndServe(":80", nil))
94110

95111
}

0 commit comments

Comments
 (0)