Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 84def5f

Browse files
smowtonsmowton
authored
Merge pull request #327 from smowton/smowton/feature/more-post-update-nodes
Add PostUpdateNodes for nested structs and arrays
2 parents 903cffe + 650bc1d commit 84def5f

File tree

6 files changed

+119
-7
lines changed

6 files changed

+119
-7
lines changed

‎ql/src/semmle/go/dataflow/internal/DataFlowUtil.qll

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,18 @@ class ReceiverNode extends ParameterNode {
416416
predicate isReceiverOf(MethodDecl m) { parm.isReceiverOf(m) }
417417
}
418418

419+
private Node getADirectlyWrittenNode() {
420+
exists(Write w | w.writesField(result, _, _) or w.writesElement(result, _, _))
421+
}
422+
423+
private DataFlow::Node getAccessPathPredecessor(DataFlow::Node node) {
424+
result = node.(PointerDereferenceNode).getOperand()
425+
or
426+
result = node.(ComponentReadNode).getBase()
427+
}
428+
429+
private Node getAWrittenNode() { result = getAccessPathPredecessor*(getADirectlyWrittenNode()) }
430+
419431
/**
420432
* A node associated with an object after an operation that might have
421433
* changed its state.
@@ -439,13 +451,7 @@ class PostUpdateNode extends Node {
439451
or
440452
preupd = any(PointerDereferenceNode deref).getOperand()
441453
or
442-
exists(Write w, DataFlow::Node base |
443-
w.writesField(base, _, _) or w.writesElement(base, _, _)
444-
|
445-
preupd = base
446-
or
447-
preupd = base.(PointerDereferenceNode).getOperand()
448-
)
454+
preupd = getAWrittenNode()
449455
or
450456
preupd instanceof ArgumentNode and
451457
mutableType(preupd.getType())

‎ql/test/library-tests/semmle/go/dataflow/PostUpdateNodes/test.expected

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
| test.go:19:2:19:2 | definition of a |
2+
| test.go:20:11:20:14 | &... |
3+
| test.go:20:12:20:14 | selection of b |
4+
| test.go:21:2:21:5 | selection of bs |
5+
| test.go:21:2:21:8 | index expression |
6+
| test.go:21:17:21:20 | &... |
7+
| test.go:21:18:21:20 | struct literal |
8+
| test.go:22:2:22:5 | selection of bs |
9+
| test.go:22:2:22:8 | index expression |
10+
| test.go:22:2:22:13 | implicit dereference |
11+
| test.go:22:2:22:13 | selection of cptr |
12+
| test.go:23:2:23:7 | implicit dereference |
13+
| test.go:23:2:23:7 | selection of bptr |
14+
| test.go:23:2:23:12 | implicit dereference |
15+
| test.go:23:2:23:12 | selection of cptr |

‎ql/test/library-tests/semmle/go/dataflow/PostUpdateNodes/test.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package a
2+
3+
type C struct {
4+
field int
5+
}
6+
7+
type B struct {
8+
cptr *C
9+
}
10+
11+
type A struct {
12+
b B
13+
bptr *B
14+
bs [5]B
15+
}
16+
17+
func f() {
18+
19+
a := A{}
20+
a.bptr = &a.b
21+
a.bs[3].cptr = &C{}
22+
a.bs[3].cptr.field = 100
23+
a.bptr.cptr.field = 101
24+
25+
}

‎ql/test/library-tests/semmle/go/dataflow/PostUpdateNodes/test.ql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import go
2+
3+
from DataFlow::PostUpdateNode pun
4+
select pun

‎ql/test/library-tests/semmle/go/frameworks/Protobuf/TaintFlows.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
| testDeprecatedApi.go:143:20:143:39 | call to getUntrustedString : string | testDeprecatedApi.go:148:12:148:21 | serialized |
1313
| testDeprecatedApi.go:152:25:152:43 | call to getUntrustedBytes : slice type | testDeprecatedApi.go:157:13:157:36 | index expression |
1414
| testDeprecatedApi.go:161:25:161:43 | call to getUntrustedBytes : slice type | testDeprecatedApi.go:168:13:168:25 | index expression |
15+
| testDeprecatedApi.go:176:24:176:43 | call to getUntrustedString : string | testDeprecatedApi.go:180:12:180:21 | serialized |
1516
| testModernApi.go:11:22:11:41 | call to getUntrustedString : string | testModernApi.go:15:12:15:21 | serialized |
1617
| testModernApi.go:20:22:20:41 | call to getUntrustedString : string | testModernApi.go:26:12:26:21 | serialized |
1718
| testModernApi.go:30:25:30:43 | call to getUntrustedBytes : slice type | testModernApi.go:34:13:34:29 | selection of Description |
@@ -29,3 +30,4 @@
2930
| testModernApi.go:200:20:200:39 | call to getUntrustedString : string | testModernApi.go:205:12:205:21 | serialized |
3031
| testModernApi.go:209:25:209:43 | call to getUntrustedBytes : slice type | testModernApi.go:214:13:214:36 | index expression |
3132
| testModernApi.go:218:25:218:43 | call to getUntrustedBytes : slice type | testModernApi.go:225:13:225:25 | index expression |
33+
| testModernApi.go:233:24:233:43 | call to getUntrustedString : string | testModernApi.go:237:12:237:21 | serialized |

‎ql/test/query-tests/Security/CWE-601/OpenUrlRedirect/OpenUrlRedirect.expected

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,44 @@ edges
66
| stdlib.go:44:13:44:18 | selection of Form : Values | stdlib.go:46:23:46:28 | target |
77
| stdlib.go:64:13:64:18 | selection of Form : Values | stdlib.go:67:23:67:40 | ...+... |
88
| stdlib.go:89:13:89:18 | selection of Form : Values | stdlib.go:92:23:92:28 | target |
9+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL, ... (3)] | stdlib.go:112:4:112:4 | r [pointer, URL, ... (3)] |
10+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL, ... (3)] | stdlib.go:112:4:112:4 | r [pointer, URL, ... (3)] |
11+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL] | stdlib.go:112:4:112:4 | r [pointer, URL] |
12+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL] | stdlib.go:112:4:112:4 | r [pointer, URL] |
13+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL] | stdlib.go:113:24:113:24 | r [pointer, URL] |
14+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL] | stdlib.go:113:24:113:24 | r [pointer, URL] |
15+
| stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] | stdlib.go:107:54:107:54 | definition of r [pointer, URL, ... (3)] |
16+
| stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] | stdlib.go:107:54:107:54 | definition of r [pointer, URL, ... (3)] |
17+
| stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] | stdlib.go:112:4:112:8 | selection of URL [pointer] : URL |
18+
| stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] | stdlib.go:112:4:112:8 | selection of URL [pointer] : URL |
19+
| stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type | stdlib.go:107:54:107:54 | definition of r [pointer, URL] |
20+
| stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type | stdlib.go:107:54:107:54 | definition of r [pointer, URL] |
21+
| stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type | stdlib.go:112:4:112:8 | selection of URL : pointer type |
22+
| stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type | stdlib.go:112:4:112:8 | selection of URL : pointer type |
23+
| stdlib.go:112:4:112:4 | r [pointer, URL, ... (3)] | stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] |
24+
| stdlib.go:112:4:112:4 | r [pointer, URL, ... (3)] | stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] |
25+
| stdlib.go:112:4:112:4 | r [pointer, URL] | stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type |
26+
| stdlib.go:112:4:112:4 | r [pointer, URL] | stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type |
27+
| stdlib.go:112:4:112:8 | implicit dereference : URL | stdlib.go:112:4:112:8 | implicit dereference : URL |
28+
| stdlib.go:112:4:112:8 | implicit dereference : URL | stdlib.go:112:4:112:8 | implicit dereference : URL |
29+
| stdlib.go:112:4:112:8 | implicit dereference : URL | stdlib.go:112:4:112:8 | selection of URL : pointer type |
30+
| stdlib.go:112:4:112:8 | implicit dereference : URL | stdlib.go:112:4:112:8 | selection of URL : pointer type |
31+
| stdlib.go:112:4:112:8 | implicit dereference : URL | stdlib.go:112:4:112:8 | selection of URL [pointer] : URL |
32+
| stdlib.go:112:4:112:8 | implicit dereference : URL | stdlib.go:112:4:112:8 | selection of URL [pointer] : URL |
33+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type |
34+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type |
35+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | stdlib.go:112:4:112:8 | implicit dereference : URL |
36+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | stdlib.go:112:4:112:8 | implicit dereference : URL |
37+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | stdlib.go:112:4:112:8 | selection of URL : pointer type |
38+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | stdlib.go:112:4:112:8 | selection of URL : pointer type |
39+
| stdlib.go:112:4:112:8 | selection of URL [pointer] : URL | stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] |
40+
| stdlib.go:112:4:112:8 | selection of URL [pointer] : URL | stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] |
41+
| stdlib.go:112:4:112:8 | selection of URL [pointer] : URL | stdlib.go:112:4:112:8 | implicit dereference : URL |
42+
| stdlib.go:112:4:112:8 | selection of URL [pointer] : URL | stdlib.go:112:4:112:8 | implicit dereference : URL |
43+
| stdlib.go:113:24:113:24 | implicit dereference [URL] : pointer type | stdlib.go:113:24:113:28 | selection of URL : pointer type |
44+
| stdlib.go:113:24:113:24 | implicit dereference [URL] : pointer type | stdlib.go:113:24:113:28 | selection of URL : pointer type |
45+
| stdlib.go:113:24:113:24 | r [pointer, URL] | stdlib.go:113:24:113:24 | implicit dereference [URL] : pointer type |
46+
| stdlib.go:113:24:113:24 | r [pointer, URL] | stdlib.go:113:24:113:24 | implicit dereference [URL] : pointer type |
947
| stdlib.go:113:24:113:28 | selection of URL : pointer type | stdlib.go:113:24:113:37 | call to String |
1048
| stdlib.go:113:24:113:28 | selection of URL : pointer type | stdlib.go:113:24:113:37 | call to String |
1149
| stdlib.go:146:13:146:18 | selection of Form : Values | stdlib.go:152:23:152:28 | target |
@@ -37,6 +75,28 @@ nodes
3775
| stdlib.go:67:23:67:40 | ...+... | semmle.label | ...+... |
3876
| stdlib.go:89:13:89:18 | selection of Form : Values | semmle.label | selection of Form : Values |
3977
| stdlib.go:92:23:92:28 | target | semmle.label | target |
78+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL, ... (3)] | semmle.label | definition of r [pointer, URL, ... (3)] |
79+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL, ... (3)] | semmle.label | definition of r [pointer, URL, ... (3)] |
80+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL] | semmle.label | definition of r [pointer, URL] |
81+
| stdlib.go:107:54:107:54 | definition of r [pointer, URL] | semmle.label | definition of r [pointer, URL] |
82+
| stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] | semmle.label | implicit dereference [URL, pointer] |
83+
| stdlib.go:112:4:112:4 | implicit dereference [URL, pointer] | semmle.label | implicit dereference [URL, pointer] |
84+
| stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type | semmle.label | implicit dereference [URL] : pointer type |
85+
| stdlib.go:112:4:112:4 | implicit dereference [URL] : pointer type | semmle.label | implicit dereference [URL] : pointer type |
86+
| stdlib.go:112:4:112:4 | r [pointer, URL, ... (3)] | semmle.label | r [pointer, URL, ... (3)] |
87+
| stdlib.go:112:4:112:4 | r [pointer, URL, ... (3)] | semmle.label | r [pointer, URL, ... (3)] |
88+
| stdlib.go:112:4:112:4 | r [pointer, URL] | semmle.label | r [pointer, URL] |
89+
| stdlib.go:112:4:112:4 | r [pointer, URL] | semmle.label | r [pointer, URL] |
90+
| stdlib.go:112:4:112:8 | implicit dereference : URL | semmle.label | implicit dereference : URL |
91+
| stdlib.go:112:4:112:8 | implicit dereference : URL | semmle.label | implicit dereference : URL |
92+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
93+
| stdlib.go:112:4:112:8 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
94+
| stdlib.go:112:4:112:8 | selection of URL [pointer] : URL | semmle.label | selection of URL [pointer] : URL |
95+
| stdlib.go:112:4:112:8 | selection of URL [pointer] : URL | semmle.label | selection of URL [pointer] : URL |
96+
| stdlib.go:113:24:113:24 | implicit dereference [URL] : pointer type | semmle.label | implicit dereference [URL] : pointer type |
97+
| stdlib.go:113:24:113:24 | implicit dereference [URL] : pointer type | semmle.label | implicit dereference [URL] : pointer type |
98+
| stdlib.go:113:24:113:24 | r [pointer, URL] | semmle.label | r [pointer, URL] |
99+
| stdlib.go:113:24:113:24 | r [pointer, URL] | semmle.label | r [pointer, URL] |
40100
| stdlib.go:113:24:113:28 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
41101
| stdlib.go:113:24:113:28 | selection of URL : pointer type | semmle.label | selection of URL : pointer type |
42102
| stdlib.go:113:24:113:37 | call to String | semmle.label | call to String |

0 commit comments

Comments
 (0)