Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit a813607

Browse files
smowtonsmowton
committed
go-restful model: Add support for ReadEntity method
1 parent 3c4a1b9 commit a813607

File tree

4 files changed

+43
-12
lines changed

4 files changed

+43
-12
lines changed

‎ql/src/semmle/go/frameworks/HTTP.qll

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,4 +254,19 @@ private module GoRestfulHttp {
254254
private class GoRestfulSource extends UntrustedFlowSource::Range {
255255
GoRestfulSource() { this = any(GoRestfulSourceMethod g).getACall() }
256256
}
257+
258+
/**
259+
* A model of go-restful's `Request.ReadEntity` method as a source of user-controlled data.
260+
*/
261+
private class GoRestfulReadEntitySource extends UntrustedFlowSource::Range {
262+
GoRestfulReadEntitySource() {
263+
exists(DataFlow::MethodCallNode call |
264+
call
265+
.getTarget()
266+
.hasQualifiedName(package("github.com/emicklei/go-restful", ""), "Request", "ReadEntity")
267+
|
268+
this = any(FunctionOutput output | output.isParameter(0)).getExitNode(call)
269+
)
270+
}
271+
}
257272
}

‎ql/test/library-tests/semmle/go/frameworks/HTTP/Gorestful/gorestful.expected

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
| gorestful.go:9:15:9:47 | index expression | gorestful.go:9:15:9:44 | call to QueryParameters : slice type | gorestful.go:9:15:9:47 | index expression | This command depends on $@. | gorestful.go:9:15:9:44 | call to QueryParameters | a user-provided value |
2-
| gorestful.go:10:15:10:43 | call to QueryParameter | gorestful.go:10:15:10:43 | call to QueryParameter | gorestful.go:10:15:10:43 | call to QueryParameter | This command depends on $@. | gorestful.go:10:15:10:43 | call to QueryParameter | a user-provided value |
3-
| gorestful.go:12:15:12:17 | val | gorestful.go:11:12:11:39 | call to BodyParameter : tuple type | gorestful.go:12:15:12:17 | val | This command depends on $@. | gorestful.go:11:12:11:39 | call to BodyParameter | a user-provided value |
4-
| gorestful.go:13:15:13:44 | call to HeaderParameter | gorestful.go:13:15:13:44 | call to HeaderParameter | gorestful.go:13:15:13:44 | call to HeaderParameter | This command depends on $@. | gorestful.go:13:15:13:44 | call to HeaderParameter | a user-provided value |
5-
| gorestful.go:14:15:14:42 | call to PathParameter | gorestful.go:14:15:14:42 | call to PathParameter | gorestful.go:14:15:14:42 | call to PathParameter | This command depends on $@. | gorestful.go:14:15:14:42 | call to PathParameter | a user-provided value |
6-
| gorestful.go:15:15:15:45 | index expression | gorestful.go:15:15:15:38 | call to PathParameters : map type | gorestful.go:15:15:15:45 | index expression | This command depends on $@. | gorestful.go:15:15:15:38 | call to PathParameters | a user-provided value |
7-
| gorestful_v2.go:9:15:9:47 | index expression | gorestful_v2.go:9:15:9:44 | call to QueryParameters : slice type | gorestful_v2.go:9:15:9:47 | index expression | This command depends on $@. | gorestful_v2.go:9:15:9:44 | call to QueryParameters | a user-provided value |
8-
| gorestful_v2.go:10:15:10:43 | call to QueryParameter | gorestful_v2.go:10:15:10:43 | call to QueryParameter | gorestful_v2.go:10:15:10:43 | call to QueryParameter | This command depends on $@. | gorestful_v2.go:10:15:10:43 | call to QueryParameter | a user-provided value |
9-
| gorestful_v2.go:12:15:12:17 | val | gorestful_v2.go:11:12:11:39 | call to BodyParameter : tuple type | gorestful_v2.go:12:15:12:17 | val | This command depends on $@. | gorestful_v2.go:11:12:11:39 | call to BodyParameter | a user-provided value |
10-
| gorestful_v2.go:13:15:13:44 | call to HeaderParameter | gorestful_v2.go:13:15:13:44 | call to HeaderParameter | gorestful_v2.go:13:15:13:44 | call to HeaderParameter | This command depends on $@. | gorestful_v2.go:13:15:13:44 | call to HeaderParameter | a user-provided value |
11-
| gorestful_v2.go:14:15:14:42 | call to PathParameter | gorestful_v2.go:14:15:14:42 | call to PathParameter | gorestful_v2.go:14:15:14:42 | call to PathParameter | This command depends on $@. | gorestful_v2.go:14:15:14:42 | call to PathParameter | a user-provided value |
12-
| gorestful_v2.go:15:15:15:45 | index expression | gorestful_v2.go:15:15:15:38 | call to PathParameters : map type | gorestful_v2.go:15:15:15:45 | index expression | This command depends on $@. | gorestful_v2.go:15:15:15:38 | call to PathParameters | a user-provided value |
1+
| gorestful.go:13:15:13:47 | index expression | gorestful.go:13:15:13:44 | call to QueryParameters : slice type | gorestful.go:13:15:13:47 | index expression | This command depends on $@. | gorestful.go:13:15:13:44 | call to QueryParameters | a user-provided value |
2+
| gorestful.go:14:15:14:43 | call to QueryParameter | gorestful.go:14:15:14:43 | call to QueryParameter | gorestful.go:14:15:14:43 | call to QueryParameter | This command depends on $@. | gorestful.go:14:15:14:43 | call to QueryParameter | a user-provided value |
3+
| gorestful.go:16:15:16:17 | val | gorestful.go:15:12:15:39 | call to BodyParameter : tuple type | gorestful.go:16:15:16:17 | val | This command depends on $@. | gorestful.go:15:12:15:39 | call to BodyParameter | a user-provided value |
4+
| gorestful.go:17:15:17:44 | call to HeaderParameter | gorestful.go:17:15:17:44 | call to HeaderParameter | gorestful.go:17:15:17:44 | call to HeaderParameter | This command depends on $@. | gorestful.go:17:15:17:44 | call to HeaderParameter | a user-provided value |
5+
| gorestful.go:18:15:18:42 | call to PathParameter | gorestful.go:18:15:18:42 | call to PathParameter | gorestful.go:18:15:18:42 | call to PathParameter | This command depends on $@. | gorestful.go:18:15:18:42 | call to PathParameter | a user-provided value |
6+
| gorestful.go:19:15:19:45 | index expression | gorestful.go:19:15:19:38 | call to PathParameters : map type | gorestful.go:19:15:19:45 | index expression | This command depends on $@. | gorestful.go:19:15:19:38 | call to PathParameters | a user-provided value |
7+
| gorestful.go:22:15:22:21 | selection of cmd | gorestful.go:21:21:21:24 | &... : pointer type | gorestful.go:22:15:22:21 | selection of cmd | This command depends on $@. | gorestful.go:21:21:21:24 | &... | a user-provided value |
8+
| gorestful_v2.go:13:15:13:47 | index expression | gorestful_v2.go:13:15:13:44 | call to QueryParameters : slice type | gorestful_v2.go:13:15:13:47 | index expression | This command depends on $@. | gorestful_v2.go:13:15:13:44 | call to QueryParameters | a user-provided value |
9+
| gorestful_v2.go:14:15:14:43 | call to QueryParameter | gorestful_v2.go:14:15:14:43 | call to QueryParameter | gorestful_v2.go:14:15:14:43 | call to QueryParameter | This command depends on $@. | gorestful_v2.go:14:15:14:43 | call to QueryParameter | a user-provided value |
10+
| gorestful_v2.go:16:15:16:17 | val | gorestful_v2.go:15:12:15:39 | call to BodyParameter : tuple type | gorestful_v2.go:16:15:16:17 | val | This command depends on $@. | gorestful_v2.go:15:12:15:39 | call to BodyParameter | a user-provided value |
11+
| gorestful_v2.go:17:15:17:44 | call to HeaderParameter | gorestful_v2.go:17:15:17:44 | call to HeaderParameter | gorestful_v2.go:17:15:17:44 | call to HeaderParameter | This command depends on $@. | gorestful_v2.go:17:15:17:44 | call to HeaderParameter | a user-provided value |
12+
| gorestful_v2.go:18:15:18:42 | call to PathParameter | gorestful_v2.go:18:15:18:42 | call to PathParameter | gorestful_v2.go:18:15:18:42 | call to PathParameter | This command depends on $@. | gorestful_v2.go:18:15:18:42 | call to PathParameter | a user-provided value |
13+
| gorestful_v2.go:19:15:19:45 | index expression | gorestful_v2.go:19:15:19:38 | call to PathParameters : map type | gorestful_v2.go:19:15:19:45 | index expression | This command depends on $@. | gorestful_v2.go:19:15:19:38 | call to PathParameters | a user-provided value |
14+
| gorestful_v2.go:22:15:22:21 | selection of cmd | gorestful_v2.go:21:21:21:24 | &... : pointer type | gorestful_v2.go:22:15:22:21 | selection of cmd | This command depends on $@. | gorestful_v2.go:21:21:21:24 | &... | a user-provided value |

‎ql/test/library-tests/semmle/go/frameworks/HTTP/Gorestful/gorestful.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ import (
55
"os/exec"
66
)
77

8+
type myObject struct {
9+
cmd string
10+
}
11+
812
func requestHandler(request *restful.Request, response *restful.Response) {
913
exec.Command(request.QueryParameters("xyz")[0]) // BAD
1014
exec.Command(request.QueryParameter("xyz")) // BAD
@@ -13,4 +17,7 @@ func requestHandler(request *restful.Request, response *restful.Response) {
1317
exec.Command(request.HeaderParameter("xyz")) // BAD
1418
exec.Command(request.PathParameter("xyz")) // BAD
1519
exec.Command(request.PathParameters()["xyz"]) // BAD
20+
obj := myObject{}
21+
request.ReadEntity(&obj)
22+
exec.Command(obj.cmd) // BAD
1623
}

‎ql/test/library-tests/semmle/go/frameworks/HTTP/Gorestful/gorestful_v2.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ import (
55
"os/exec"
66
)
77

8+
type myObjectV2 struct {
9+
cmd string
10+
}
11+
812
func requestHandlerV2(request *restful.Request, response *restful.Response) {
913
exec.Command(request.QueryParameters("xyz")[0]) // BAD
1014
exec.Command(request.QueryParameter("xyz")) // BAD
@@ -13,4 +17,7 @@ func requestHandlerV2(request *restful.Request, response *restful.Response) {
1317
exec.Command(request.HeaderParameter("xyz")) // BAD
1418
exec.Command(request.PathParameter("xyz")) // BAD
1519
exec.Command(request.PathParameters()["xyz"]) // BAD
20+
obj := myObjectV2{}
21+
request.ReadEntity(&obj)
22+
exec.Command(obj.cmd) // BAD
1623
}

0 commit comments

Comments
 (0)