Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 6d3e6de

Browse files
gagliardettosmowton
authored andcommitted
Fix: the Append* functions do not modify the dst slice argument.
1 parent 9293bcd commit 6d3e6de

File tree

2 files changed

+52
-136
lines changed
  • ql
    • src/semmle/go/frameworks/stdlib
    • test/library-tests/semmle/go/frameworks/StdlibTaintFlow

2 files changed

+52
-136
lines changed

ql/src/semmle/go/frameworks/stdlib/Strconv.qll

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -42,30 +42,15 @@ module Strconv {
4242
FunctionModels() {
4343
// signature: func AppendQuote(dst []byte, s string) []byte
4444
hasQualifiedName("strconv", "AppendQuote") and
45-
(
46-
inp.isParameter(_) and outp.isResult()
47-
or
48-
inp.isParameter(1) and
49-
(outp.isParameter(0) or outp.isResult())
50-
)
45+
(inp.isParameter(_) and outp.isResult())
5146
or
5247
// signature: func AppendQuoteToASCII(dst []byte, s string) []byte
5348
hasQualifiedName("strconv", "AppendQuoteToASCII") and
54-
(
55-
inp.isParameter(_) and outp.isResult()
56-
or
57-
inp.isParameter(1) and
58-
(outp.isParameter(0) or outp.isResult())
59-
)
49+
(inp.isParameter(_) and outp.isResult())
6050
or
6151
// signature: func AppendQuoteToGraphic(dst []byte, s string) []byte
6252
hasQualifiedName("strconv", "AppendQuoteToGraphic") and
63-
(
64-
inp.isParameter(_) and outp.isResult()
65-
or
66-
inp.isParameter(1) and
67-
(outp.isParameter(0) or outp.isResult())
68-
)
53+
(inp.isParameter(_) and outp.isResult())
6954
or
7055
// signature: func Quote(s string) string
7156
hasQualifiedName("strconv", "Quote") and

ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strconv.go

Lines changed: 49 additions & 118 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)