Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit b8d36b9

Browse files
max-schaefermax-schaefer
authored
Merge pull request #321 from gagliardetto/standard-lib-pt-14
Add taint-tracking for packages inside `mime/*`
2 parents c10942d + 25e3f75 commit b8d36b9

File tree

7 files changed

+474
-0
lines changed

7 files changed

+474
-0
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ import semmle.go.frameworks.stdlib.CompressFlate
1212
import semmle.go.frameworks.stdlib.CompressGzip
1313
import semmle.go.frameworks.stdlib.CompressLzw
1414
import semmle.go.frameworks.stdlib.CompressZlib
15+
import semmle.go.frameworks.stdlib.Mime
16+
import semmle.go.frameworks.stdlib.MimeMultipart
17+
import semmle.go.frameworks.stdlib.MimeQuotedprintable
1518
import semmle.go.frameworks.stdlib.Path
1619
import semmle.go.frameworks.stdlib.PathFilepath
1720
import semmle.go.frameworks.stdlib.Reflect

‎ql/src/semmle/go/frameworks/stdlib/Mime.qll

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `mime` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `mime` package. */
8+
module Mime {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func FormatMediaType(t string, param map[string]string) string
15+
hasQualifiedName("mime", "FormatMediaType") and
16+
(inp.isParameter(_) and outp.isResult())
17+
or
18+
// signature: func ParseMediaType(v string) (mediatype string, params map[string]string, err error)
19+
hasQualifiedName("mime", "ParseMediaType") and
20+
(inp.isParameter(0) and outp.isResult([0, 1]))
21+
}
22+
23+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
24+
input = inp and output = outp
25+
}
26+
}
27+
28+
private class MethodModels extends TaintTracking::FunctionModel, Method {
29+
FunctionInput inp;
30+
FunctionOutput outp;
31+
32+
MethodModels() {
33+
// signature: func (*WordDecoder).Decode(word string) (string, error)
34+
this.hasQualifiedName("mime", "WordDecoder", "Decode") and
35+
(inp.isParameter(0) and outp.isResult(0))
36+
or
37+
// signature: func (*WordDecoder).DecodeHeader(header string) (string, error)
38+
this.hasQualifiedName("mime", "WordDecoder", "DecodeHeader") and
39+
(inp.isParameter(0) and outp.isResult(0))
40+
or
41+
// signature: func (WordEncoder).Encode(charset string, s string) string
42+
this.hasQualifiedName("mime", "WordEncoder", "Encode") and
43+
(inp.isParameter(1) and outp.isResult())
44+
}
45+
46+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
47+
input = inp and output = outp
48+
}
49+
}
50+
}

‎ql/src/semmle/go/frameworks/stdlib/MimeMultipart.qll

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `mime/multipart` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `mime/multipart` package. */
8+
module MimeMultipart {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader, boundary string) *Reader
15+
hasQualifiedName("mime/multipart", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func NewWriter(w io.Writer) *Writer
19+
hasQualifiedName("mime/multipart", "NewWriter") and
20+
(inp.isResult() and outp.isParameter(0))
21+
}
22+
23+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
24+
input = inp and output = outp
25+
}
26+
}
27+
28+
private class MethodModels extends TaintTracking::FunctionModel, Method {
29+
FunctionInput inp;
30+
FunctionOutput outp;
31+
32+
MethodModels() {
33+
// signature: func (*FileHeader).Open() (File, error)
34+
this.hasQualifiedName("mime/multipart", "FileHeader", "Open") and
35+
(inp.isReceiver() and outp.isResult(0))
36+
or
37+
// signature: func (*Part).Read(d []byte) (n int, err error)
38+
this.hasQualifiedName("mime/multipart", "Part", "Read") and
39+
(inp.isReceiver() and outp.isParameter(0))
40+
or
41+
// signature: func (*Reader).NextPart() (*Part, error)
42+
this.hasQualifiedName("mime/multipart", "Reader", "NextPart") and
43+
(inp.isReceiver() and outp.isResult(0))
44+
or
45+
// signature: func (*Reader).NextRawPart() (*Part, error)
46+
this.hasQualifiedName("mime/multipart", "Reader", "NextRawPart") and
47+
(inp.isReceiver() and outp.isResult(0))
48+
or
49+
// signature: func (*Reader).ReadForm(maxMemory int64) (*Form, error)
50+
this.hasQualifiedName("mime/multipart", "Reader", "ReadForm") and
51+
(inp.isReceiver() and outp.isResult(0))
52+
or
53+
// signature: func (*Writer).CreateFormField(fieldname string) (io.Writer, error)
54+
this.hasQualifiedName("mime/multipart", "Writer", "CreateFormField") and
55+
(inp.isResult(0) and outp.isReceiver())
56+
or
57+
// signature: func (*Writer).CreateFormFile(fieldname string, filename string) (io.Writer, error)
58+
this.hasQualifiedName("mime/multipart", "Writer", "CreateFormFile") and
59+
(inp.isResult(0) and outp.isReceiver())
60+
or
61+
// signature: func (*Writer).CreatePart(header net/textproto.MIMEHeader) (io.Writer, error)
62+
this.hasQualifiedName("mime/multipart", "Writer", "CreatePart") and
63+
(inp.isResult(0) and outp.isReceiver())
64+
or
65+
// signature: func (*Writer).WriteField(fieldname string, value string) error
66+
this.hasQualifiedName("mime/multipart", "Writer", "WriteField") and
67+
(inp.isParameter(_) and outp.isReceiver())
68+
}
69+
70+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
71+
input = inp and output = outp
72+
}
73+
}
74+
}

‎ql/src/semmle/go/frameworks/stdlib/MimeQuotedprintable.qll

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `mime/quotedprintable` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `mime/quotedprintable` package. */
8+
module MimeQuotedprintable {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReader(r io.Reader) *Reader
15+
hasQualifiedName("mime/quotedprintable", "NewReader") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func NewWriter(w io.Writer) *Writer
19+
hasQualifiedName("mime/quotedprintable", "NewWriter") and
20+
(inp.isResult() and outp.isParameter(0))
21+
}
22+
23+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
24+
input = inp and output = outp
25+
}
26+
}
27+
28+
private class MethodModels extends TaintTracking::FunctionModel, Method {
29+
FunctionInput inp;
30+
FunctionOutput outp;
31+
32+
MethodModels() {
33+
// signature: func (*Reader).Read(p []byte) (n int, err error)
34+
this.hasQualifiedName("mime/quotedprintable", "Reader", "Read") and
35+
(inp.isReceiver() and outp.isParameter(0))
36+
or
37+
// signature: func (*Writer).Write(p []byte) (n int, err error)
38+
this.hasQualifiedName("mime/quotedprintable", "Writer", "Write") and
39+
(inp.isParameter(0) and outp.isReceiver())
40+
}
41+
42+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
43+
input = inp and output = outp
44+
}
45+
}
46+
}

‎ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Mime.go

Lines changed: 88 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)