Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit dd8e124

Browse files
gagliardettogagliardetto
committed
Add bufio taint-tracking
1 parent b057cbe commit dd8e124

File tree

3 files changed

+491
-11
lines changed

3 files changed

+491
-11
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
import go
66
import semmle.go.frameworks.stdlib.ArchiveTar
77
import semmle.go.frameworks.stdlib.ArchiveZip
8+
import semmle.go.frameworks.stdlib.Bufio
89

910
/** A `String()` method. */
1011
class StringMethod extends TaintTracking::FunctionModel, Method {
@@ -384,17 +385,6 @@ module Io {
384385
}
385386
}
386387

387-
/** Provides models of commonly used functions in the `bufio` package. */
388-
module Bufio {
389-
private class NewWriter extends TaintTracking::FunctionModel {
390-
NewWriter() { this.hasQualifiedName("bufio", "NewWriter") }
391-
392-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
393-
input.isResult() and output.isParameter(0)
394-
}
395-
}
396-
}
397-
398388
/** Provides models of commonly used functions in the `io/ioutil` package. */
399389
module IoUtil {
400390
private class IoUtilFileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {

‎ql/src/semmle/go/frameworks/stdlib/Bufio.qll

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `bufio` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `bufio` package. */
8+
module Bufio {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func NewReadWriter(r *Reader, w *Writer) *ReadWriter
15+
hasQualifiedName("bufio", "NewReadWriter") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
inp.isResult() and outp.isParameter(1)
19+
or
20+
// signature: func NewReader(rd io.Reader) *Reader
21+
hasQualifiedName("bufio", "NewReader") and
22+
(inp.isParameter(0) and outp.isResult())
23+
or
24+
// signature: func NewReaderSize(rd io.Reader, size int) *Reader
25+
hasQualifiedName("bufio", "NewReaderSize") and
26+
(inp.isParameter(0) and outp.isResult())
27+
or
28+
// signature: func NewScanner(r io.Reader) *Scanner
29+
hasQualifiedName("bufio", "NewScanner") and
30+
(inp.isParameter(0) and outp.isResult())
31+
or
32+
// signature: func NewWriter(w io.Writer) *Writer
33+
hasQualifiedName("bufio", "NewWriter") and
34+
(inp.isResult() and outp.isParameter(0))
35+
or
36+
// signature: func NewWriterSize(w io.Writer, size int) *Writer
37+
hasQualifiedName("bufio", "NewWriterSize") and
38+
(inp.isResult() and outp.isParameter(0))
39+
or
40+
// signature: func ScanBytes(data []byte, atEOF bool) (advance int, token []byte, err error)
41+
hasQualifiedName("bufio", "ScanBytes") and
42+
(inp.isParameter(0) and outp.isResult(1))
43+
or
44+
// signature: func ScanLines(data []byte, atEOF bool) (advance int, token []byte, err error)
45+
hasQualifiedName("bufio", "ScanLines") and
46+
(inp.isParameter(0) and outp.isResult(1))
47+
or
48+
// signature: func ScanRunes(data []byte, atEOF bool) (advance int, token []byte, err error)
49+
hasQualifiedName("bufio", "ScanRunes") and
50+
(inp.isParameter(0) and outp.isResult(1))
51+
or
52+
// signature: func ScanWords(data []byte, atEOF bool) (advance int, token []byte, err error)
53+
hasQualifiedName("bufio", "ScanWords") and
54+
(inp.isParameter(0) and outp.isResult(1))
55+
}
56+
57+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
58+
input = inp and output = outp
59+
}
60+
}
61+
62+
private class MethodModels extends TaintTracking::FunctionModel, Method {
63+
FunctionInput inp;
64+
FunctionOutput outp;
65+
66+
MethodModels() {
67+
// Methods:
68+
// signature: func (*Reader).Peek(n int) ([]byte, error)
69+
this.(Method).hasQualifiedName("bufio", "Reader", "Peek") and
70+
(inp.isReceiver() and outp.isResult(0))
71+
or
72+
// signature: func (*Reader).Read(p []byte) (n int, err error)
73+
this.(Method).hasQualifiedName("bufio", "Reader", "Read") and
74+
(inp.isReceiver() and outp.isParameter(0))
75+
or
76+
// signature: func (*Reader).ReadByte() (byte, error)
77+
this.(Method).hasQualifiedName("bufio", "Reader", "ReadByte") and
78+
(inp.isReceiver() and outp.isResult(0))
79+
or
80+
// signature: func (*Reader).ReadBytes(delim byte) ([]byte, error)
81+
this.(Method).hasQualifiedName("bufio", "Reader", "ReadBytes") and
82+
(inp.isReceiver() and outp.isResult(0))
83+
or
84+
// signature: func (*Reader).ReadLine() (line []byte, isPrefix bool, err error)
85+
this.(Method).hasQualifiedName("bufio", "Reader", "ReadLine") and
86+
(inp.isReceiver() and outp.isResult(0))
87+
or
88+
// signature: func (*Reader).ReadRune() (r rune, size int, err error)
89+
this.(Method).hasQualifiedName("bufio", "Reader", "ReadRune") and
90+
(inp.isReceiver() and outp.isResult(0))
91+
or
92+
// signature: func (*Reader).ReadSlice(delim byte) (line []byte, err error)
93+
this.(Method).hasQualifiedName("bufio", "Reader", "ReadSlice") and
94+
(inp.isReceiver() and outp.isResult(0))
95+
or
96+
// signature: func (*Reader).ReadString(delim byte) (string, error)
97+
this.(Method).hasQualifiedName("bufio", "Reader", "ReadString") and
98+
(inp.isReceiver() and outp.isResult(0))
99+
or
100+
// signature: func (*Reader).Reset(r io.Reader)
101+
this.(Method).hasQualifiedName("bufio", "Reader", "Reset") and
102+
(inp.isParameter(0) and outp.isReceiver())
103+
or
104+
// signature: func (*Reader).WriteTo(w io.Writer) (n int64, err error)
105+
this.(Method).hasQualifiedName("bufio", "Reader", "WriteTo") and
106+
(inp.isReceiver() and outp.isParameter(0))
107+
or
108+
// signature: func (*Scanner).Bytes() []byte
109+
this.(Method).hasQualifiedName("bufio", "Scanner", "Bytes") and
110+
(inp.isReceiver() and outp.isResult())
111+
or
112+
// signature: func (*Scanner).Text() string
113+
this.(Method).hasQualifiedName("bufio", "Scanner", "Text") and
114+
(inp.isReceiver() and outp.isResult())
115+
or
116+
// signature: func (*Writer).ReadFrom(r io.Reader) (n int64, err error)
117+
this.(Method).hasQualifiedName("bufio", "Writer", "ReadFrom") and
118+
(inp.isParameter(0) and outp.isReceiver())
119+
or
120+
// signature: func (*Writer).Reset(w io.Writer)
121+
this.(Method).hasQualifiedName("bufio", "Writer", "Reset") and
122+
(inp.isReceiver() and outp.isParameter(0))
123+
or
124+
// signature: func (*Writer).Write(p []byte) (nn int, err error)
125+
this.(Method).hasQualifiedName("bufio", "Writer", "Write") and
126+
(inp.isParameter(0) and outp.isReceiver())
127+
or
128+
// signature: func (*Writer).WriteByte(c byte) error
129+
this.(Method).hasQualifiedName("bufio", "Writer", "WriteByte") and
130+
(inp.isParameter(0) and outp.isReceiver())
131+
or
132+
// signature: func (*Writer).WriteRune(r rune) (size int, err error)
133+
this.(Method).hasQualifiedName("bufio", "Writer", "WriteRune") and
134+
(inp.isParameter(0) and outp.isReceiver())
135+
or
136+
// signature: func (*Writer).WriteString(s string) (int, error)
137+
this.(Method).hasQualifiedName("bufio", "Writer", "WriteString") and
138+
(inp.isParameter(0) and outp.isReceiver())
139+
}
140+
141+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
142+
input = inp and output = outp
143+
}
144+
}
145+
}

0 commit comments

Comments
 (0)