Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 61a0cfa

Browse files
gagliardettogagliardetto
committed
Merge branch 'standard-lib-pt-4' into stdlib-339-340-342-346-347
2 parents 3155140 + dedeb7b commit 61a0cfa

File tree

7 files changed

+559
-0
lines changed

7 files changed

+559
-0
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ import semmle.go.frameworks.stdlib.CompressGzip
1313
import semmle.go.frameworks.stdlib.CompressLzw
1414
import semmle.go.frameworks.stdlib.CompressZlib
1515
import semmle.go.frameworks.stdlib.Fmt
16+
import semmle.go.frameworks.stdlib.ContainerHeap
17+
import semmle.go.frameworks.stdlib.ContainerList
18+
import semmle.go.frameworks.stdlib.ContainerRing
1619
import semmle.go.frameworks.stdlib.Mime
1720
import semmle.go.frameworks.stdlib.MimeMultipart
1821
import semmle.go.frameworks.stdlib.MimeQuotedprintable

‎ql/src/semmle/go/frameworks/stdlib/ContainerHeap.qll

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `container/heap` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `container/heap` package. */
8+
module ContainerHeap {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func Pop(h Interface) interface{}
15+
hasQualifiedName("container/heap", "Pop") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func Push(h Interface, x interface{})
19+
hasQualifiedName("container/heap", "Push") and
20+
(inp.isParameter(1) and outp.isParameter(0))
21+
or
22+
// signature: func Remove(h Interface, i int) interface{}
23+
hasQualifiedName("container/heap", "Remove") and
24+
(inp.isParameter(0) and outp.isResult())
25+
}
26+
27+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
28+
input = inp and output = outp
29+
}
30+
}
31+
32+
private class MethodModels extends TaintTracking::FunctionModel, Method {
33+
FunctionInput inp;
34+
FunctionOutput outp;
35+
36+
MethodModels() {
37+
// signature: func (Interface).Pop() interface{}
38+
this.implements("container/heap", "Interface", "Pop") and
39+
(inp.isReceiver() and outp.isResult())
40+
or
41+
// signature: func (Interface).Push(x interface{})
42+
this.implements("container/heap", "Interface", "Push") and
43+
(inp.isParameter(0) and outp.isReceiver())
44+
}
45+
46+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
47+
input = inp and output = outp
48+
}
49+
}
50+
}

‎ql/src/semmle/go/frameworks/stdlib/ContainerList.qll

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `container/list` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `container/list` package. */
8+
module ContainerList {
9+
private class MethodModels extends TaintTracking::FunctionModel, Method {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
MethodModels() {
14+
// signature: func (*Element).Next() *Element
15+
this.hasQualifiedName("container/list", "Element", "Next") and
16+
(inp.isReceiver() and outp.isResult())
17+
or
18+
// signature: func (*Element).Prev() *Element
19+
this.hasQualifiedName("container/list", "Element", "Prev") and
20+
(inp.isReceiver() and outp.isResult())
21+
or
22+
// signature: func (*List).Back() *Element
23+
this.hasQualifiedName("container/list", "List", "Back") and
24+
(inp.isReceiver() and outp.isResult())
25+
or
26+
// signature: func (*List).Front() *Element
27+
this.hasQualifiedName("container/list", "List", "Front") and
28+
(inp.isReceiver() and outp.isResult())
29+
or
30+
// signature: func (*List).Init() *List
31+
this.hasQualifiedName("container/list", "List", "Init") and
32+
(inp.isReceiver() and outp.isResult())
33+
or
34+
// signature: func (*List).InsertAfter(v interface{}, mark *Element) *Element
35+
this.hasQualifiedName("container/list", "List", "InsertAfter") and
36+
(
37+
inp.isParameter(0) and
38+
(outp.isReceiver() or outp.isResult())
39+
)
40+
or
41+
// signature: func (*List).InsertBefore(v interface{}, mark *Element) *Element
42+
this.hasQualifiedName("container/list", "List", "InsertBefore") and
43+
(
44+
inp.isParameter(0) and
45+
(outp.isReceiver() or outp.isResult())
46+
)
47+
or
48+
// signature: func (*List).MoveAfter(e *Element, mark *Element)
49+
this.hasQualifiedName("container/list", "List", "MoveAfter") and
50+
(inp.isParameter(0) and outp.isReceiver())
51+
or
52+
// signature: func (*List).MoveBefore(e *Element, mark *Element)
53+
this.hasQualifiedName("container/list", "List", "MoveBefore") and
54+
(inp.isParameter(0) and outp.isReceiver())
55+
or
56+
// signature: func (*List).MoveToBack(e *Element)
57+
this.hasQualifiedName("container/list", "List", "MoveToBack") and
58+
(inp.isParameter(0) and outp.isReceiver())
59+
or
60+
// signature: func (*List).MoveToFront(e *Element)
61+
this.hasQualifiedName("container/list", "List", "MoveToFront") and
62+
(inp.isParameter(0) and outp.isReceiver())
63+
or
64+
// signature: func (*List).PushBack(v interface{}) *Element
65+
this.hasQualifiedName("container/list", "List", "PushBack") and
66+
(
67+
inp.isParameter(0) and
68+
(outp.isReceiver() or outp.isResult())
69+
)
70+
or
71+
// signature: func (*List).PushBackList(other *List)
72+
this.hasQualifiedName("container/list", "List", "PushBackList") and
73+
(inp.isParameter(0) and outp.isReceiver())
74+
or
75+
// signature: func (*List).PushFront(v interface{}) *Element
76+
this.hasQualifiedName("container/list", "List", "PushFront") and
77+
(
78+
inp.isParameter(0) and
79+
(outp.isReceiver() or outp.isResult())
80+
)
81+
or
82+
// signature: func (*List).PushFrontList(other *List)
83+
this.hasQualifiedName("container/list", "List", "PushFrontList") and
84+
(inp.isParameter(0) and outp.isReceiver())
85+
or
86+
// signature: func (*List).Remove(e *Element) interface{}
87+
this.hasQualifiedName("container/list", "List", "Remove") and
88+
(inp.isParameter(0) and outp.isResult())
89+
}
90+
91+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
92+
input = inp and output = outp
93+
}
94+
}
95+
}

‎ql/src/semmle/go/frameworks/stdlib/ContainerRing.qll

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `container/ring` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `container/ring` package. */
8+
module ContainerRing {
9+
private class MethodModels extends TaintTracking::FunctionModel, Method {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
MethodModels() {
14+
// signature: func (*Ring).Link(s *Ring) *Ring
15+
this.hasQualifiedName("container/ring", "Ring", "Link") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func (*Ring).Move(n int) *Ring
19+
this.hasQualifiedName("container/ring", "Ring", "Move") and
20+
(inp.isReceiver() and outp.isResult())
21+
or
22+
// signature: func (*Ring).Next() *Ring
23+
this.hasQualifiedName("container/ring", "Ring", "Next") and
24+
(inp.isReceiver() and outp.isResult())
25+
or
26+
// signature: func (*Ring).Prev() *Ring
27+
this.hasQualifiedName("container/ring", "Ring", "Prev") and
28+
(inp.isReceiver() and outp.isResult())
29+
or
30+
// signature: func (*Ring).Unlink(n int) *Ring
31+
this.hasQualifiedName("container/ring", "Ring", "Unlink") and
32+
(inp.isReceiver() and outp.isResult())
33+
}
34+
35+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
36+
input = inp and output = outp
37+
}
38+
}
39+
}

‎ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/ContainerHeap.go

Lines changed: 65 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)