Skip to content

Commit 0793c58

Browse files
owen-mcowen-mc
authored
Merge pull request #16963 from owen-mc/go/mad-sources/go-restful-gin-mux
 Go: Convert go-restful, Gin and Mux sources to MaD
2 parents f293b77 + ca06589 commit 0793c58

File tree

48 files changed

+357
-376
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+357
-376
lines changed

‎go/ql/lib/ext/github.com.emicklei.go-restful.model.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: sourceModel
5+
data:
6+
- ["github.com/emicklei/go-restful", "Request", True, "QueryParameters", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
7+
- ["github.com/emicklei/go-restful", "Request", True, "QueryParameter", "", "", "ReturnValue", "remote", "manual"]
8+
- ["github.com/emicklei/go-restful", "Request", True, "BodyParameter", "", "", "ReturnValue[0]", "remote", "manual"]
9+
- ["github.com/emicklei/go-restful", "Request", True, "HeaderParameter", "", "", "ReturnValue", "remote", "manual"]
10+
- ["github.com/emicklei/go-restful", "Request", True, "PathParameter", "", "", "ReturnValue", "remote", "manual"]
11+
- ["github.com/emicklei/go-restful", "Request", True, "PathParameters", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue
12+
- ["github.com/emicklei/go-restful", "Request", True, "ReadEntity", "", "", "Argument[0]", "remote", "manual"]

‎go/ql/lib/ext/github.com.gin-gonic.gin.model.yml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,53 @@ extensions:
55
data:
66
- ["github.com/gin-gonic/gin", "Params", True, "ByName", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
77
- ["github.com/gin-gonic/gin", "Params", True, "Get", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
8+
- addsTo:
9+
pack: codeql/go-all
10+
extensible: sourceModel
11+
data:
12+
- ["github.com/gin-gonic/gin", "Context", True, "Accepted", "", "", "", "remote", "manual"]
13+
- ["github.com/gin-gonic/gin", "Context", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
14+
- ["github.com/gin-gonic/gin", "Context", True, "BindHeader", "", "", "Argument[0]", "remote", "manual"]
15+
- ["github.com/gin-gonic/gin", "Context", True, "BindJSON", "", "", "Argument[0]", "remote", "manual"]
16+
- ["github.com/gin-gonic/gin", "Context", True, "BindQuery", "", "", "Argument[0]", "remote", "manual"]
17+
- ["github.com/gin-gonic/gin", "Context", True, "BindXML", "", "", "Argument[0]", "remote", "manual"]
18+
- ["github.com/gin-gonic/gin", "Context", True, "BindYAML", "", "", "Argument[0]", "remote", "manual"]
19+
- ["github.com/gin-gonic/gin", "Context", True, "BindUri", "", "", "Argument[0]", "remote", "manual"]
20+
- ["github.com/gin-gonic/gin", "Context", True, "BindWith", "", "", "Argument[0]", "remote", "manual"]
21+
- ["github.com/gin-gonic/gin", "Context", True, "ClientIP", "", "", "ReturnValue", "remote", "manual"]
22+
- ["github.com/gin-gonic/gin", "Context", True, "ContentType", "", "", "ReturnValue", "remote", "manual"]
23+
- ["github.com/gin-gonic/gin", "Context", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
24+
- ["github.com/gin-gonic/gin", "Context", True, "DefaultPostForm", "", "", "ReturnValue", "remote", "manual"]
25+
- ["github.com/gin-gonic/gin", "Context", True, "DefaultQuery", "", "", "ReturnValue", "remote", "manual"]
26+
- ["github.com/gin-gonic/gin", "Context", True, "FullPath", "", "", "ReturnValue", "remote", "manual"]
27+
- ["github.com/gin-gonic/gin", "Context", True, "GetHeader", "", "", "ReturnValue", "remote", "manual"]
28+
- ["github.com/gin-gonic/gin", "Context", True, "GetPostForm", "", "", "ReturnValue[0]", "remote", "manual"]
29+
- ["github.com/gin-gonic/gin", "Context", True, "GetPostFormArray", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
30+
- ["github.com/gin-gonic/gin", "Context", True, "GetPostFormMap", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)
31+
- ["github.com/gin-gonic/gin", "Context", True, "GetQuery", "", "", "ReturnValue[0]", "remote", "manual"]
32+
- ["github.com/gin-gonic/gin", "Context", True, "GetQueryArray", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
33+
- ["github.com/gin-gonic/gin", "Context", True, "GetQueryMap", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)
34+
- ["github.com/gin-gonic/gin", "Context", True, "GetRawData", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
35+
- ["github.com/gin-gonic/gin", "Context", True, "GetString", "", "", "ReturnValue", "remote", "manual"]
36+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringMap", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)
37+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringMapString", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)
38+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringMapStringSlice", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue.ArrayElement (and .MapKey?)
39+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringSlice", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
40+
- ["github.com/gin-gonic/gin", "Context", True, "MustBindWith", "", "", "Argument[0]", "remote", "manual"]
41+
- ["github.com/gin-gonic/gin", "Context", True, "Param", "", "", "ReturnValue", "remote", "manual"]
42+
- ["github.com/gin-gonic/gin", "Context", True, "Params", "", "", "", "remote", "manual"]
43+
- ["github.com/gin-gonic/gin", "Context", True, "PostForm", "", "", "ReturnValue", "remote", "manual"]
44+
- ["github.com/gin-gonic/gin", "Context", True, "PostFormArray", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
45+
- ["github.com/gin-gonic/gin", "Context", True, "PostFormMap", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)
46+
- ["github.com/gin-gonic/gin", "Context", True, "Query", "", "", "ReturnValue", "remote", "manual"]
47+
- ["github.com/gin-gonic/gin", "Context", True, "QueryArray", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .ArrayElement
48+
- ["github.com/gin-gonic/gin", "Context", True, "QueryMap", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)
49+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBind", "", "", "Argument[0]", "remote", "manual"]
50+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindBodyWith", "", "", "Argument[0]", "remote", "manual"]
51+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindHeader", "", "", "Argument[0]", "remote", "manual"]
52+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindJSON", "", "", "Argument[0]", "remote", "manual"]
53+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindQuery", "", "", "Argument[0]", "remote", "manual"]
54+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindUri", "", "", "Argument[0]", "remote", "manual"]
55+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindWith", "", "", "Argument[0]", "remote", "manual"]
56+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindXML", "", "", "Argument[0]", "remote", "manual"]
57+
- ["github.com/gin-gonic/gin", "Context", True, "ShouldBindYAML", "", "", "Argument[0]", "remote", "manual"]

‎go/ql/lib/ext/github.com.gorilla.mux.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: sourceModel
5+
data:
6+
- ["github.com/gorilla/mux", "", True, "Vars", "", "", "ReturnValue", "remote", "manual"] # TODO: when sources can have access paths, use .MapValue (and .MapKey?)

‎go/ql/lib/go.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ import semmle.go.frameworks.Gogf
4848
import semmle.go.frameworks.GoJose
4949
import semmle.go.frameworks.GoKit
5050
import semmle.go.frameworks.GoMicro
51-
import semmle.go.frameworks.GoRestfulHttp
5251
import semmle.go.frameworks.Gqlgen
5352
import semmle.go.frameworks.Iris
5453
import semmle.go.frameworks.Jwt

‎go/ql/lib/semmle/go/frameworks/Gin.qll

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -9,52 +9,6 @@ private module Gin {
99
/** Gets the package name `github.com/gin-gonic/gin`. */
1010
string packagePath() { result = package("github.com/gin-gonic/gin", "") }
1111

12-
/**
13-
* Data from a `Context` struct, considered as a source of remote flow.
14-
*/
15-
private class GithubComGinGonicGinContextSource extends RemoteFlowSource::Range {
16-
GithubComGinGonicGinContextSource() {
17-
// Method calls:
18-
exists(DataFlow::MethodCallNode call, string methodName |
19-
call.getTarget().hasQualifiedName(packagePath(), "Context", methodName) and
20-
methodName in [
21-
"FullPath", "GetHeader", "QueryArray", "Query", "PostFormArray", "PostForm", "Param",
22-
"GetStringSlice", "GetString", "GetRawData", "ClientIP", "ContentType", "Cookie",
23-
"GetQueryArray", "GetQuery", "GetPostFormArray", "GetPostForm", "DefaultPostForm",
24-
"DefaultQuery", "GetPostFormMap", "GetQueryMap", "GetStringMap", "GetStringMapString",
25-
"GetStringMapStringSlice", "PostFormMap", "QueryMap"
26-
]
27-
|
28-
this = call.getResult(0)
29-
)
30-
or
31-
// Field reads:
32-
exists(DataFlow::Field fld |
33-
fld.hasQualifiedName(packagePath(), "Context", ["Accepted", "Params"]) and
34-
this = fld.getARead()
35-
)
36-
}
37-
}
38-
39-
/**
40-
* A call to a method on `Context` struct that unmarshals data into a target.
41-
*/
42-
private class GithubComGinGonicGinContextBindSource extends RemoteFlowSource::Range {
43-
GithubComGinGonicGinContextBindSource() {
44-
exists(DataFlow::MethodCallNode call, string methodName |
45-
call.getTarget().hasQualifiedName(packagePath(), "Context", methodName) and
46-
methodName in [
47-
"BindJSON", "BindYAML", "BindXML", "BindUri", "BindQuery", "BindWith", "BindHeader",
48-
"MustBindWith", "Bind", "ShouldBind", "ShouldBindBodyWith", "ShouldBindJSON",
49-
"ShouldBindQuery", "ShouldBindUri", "ShouldBindHeader", "ShouldBindWith",
50-
"ShouldBindXML", "ShouldBindYAML"
51-
]
52-
|
53-
this = FunctionOutput::parameter(0).getExitNode(call)
54-
)
55-
}
56-
}
57-
5812
/**
5913
* The File system access sinks
6014
*/

‎go/ql/lib/semmle/go/frameworks/GoRestfulHttp.qll

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎go/ql/lib/semmle/go/frameworks/Mux.qll

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,17 @@
55
import go
66

77
/**
8+
* DEPRECATED
9+
*
810
* Provides classes for working with concepts in the Mux HTTP middleware library.
911
*/
10-
module Mux {
11-
/** An access to a Mux middleware variable. */
12-
class RequestVars extends DataFlow::RemoteFlowSource::Range, DataFlow::CallNode {
12+
deprecated module Mux {
13+
/**
14+
* DEPRECATED: Use `RemoteFlowSource::Range` instead.
15+
*
16+
* An access to a Mux middleware variable.
17+
*/
18+
deprecated class RequestVars extends DataFlow::RemoteFlowSource::Range, DataFlow::CallNode {
1319
RequestVars() {
1420
this.getTarget().hasQualifiedName(package("github.com/gorilla/mux", ""), "Vars")
1521
}

‎go/ql/test/experimental/CWE-090/LDAPInjection.expected

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
edges
2-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:59:3:59:11 | untrusted | provenance | Src:MaD:703 |
3-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:61:3:61:51 | ...+... | provenance | Src:MaD:703 |
4-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:3:62:33 | slice literal | provenance | Src:MaD:703 |
5-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:24:62:32 | untrusted | provenance | Src:MaD:703 |
6-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:66:3:66:11 | untrusted | provenance | Src:MaD:703 |
7-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:68:3:68:51 | ...+... | provenance | Src:MaD:703 |
8-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:3:69:33 | slice literal | provenance | Src:MaD:703 |
9-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:24:69:32 | untrusted | provenance | Src:MaD:703 |
10-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:73:3:73:11 | untrusted | provenance | Src:MaD:703 |
11-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:75:3:75:51 | ...+... | provenance | Src:MaD:703 |
12-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:3:76:33 | slice literal | provenance | Src:MaD:703 |
13-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:24:76:32 | untrusted | provenance | Src:MaD:703 |
14-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:80:22:80:30 | untrusted | provenance | Src:MaD:703 |
15-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:81:25:81:33 | untrusted | provenance | Src:MaD:703 |
2+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:59:3:59:11 | untrusted | provenance | Src:MaD:757 |
3+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:61:3:61:51 | ...+... | provenance | Src:MaD:757 |
4+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:3:62:33 | slice literal | provenance | Src:MaD:757 |
5+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:24:62:32 | untrusted | provenance | Src:MaD:757 |
6+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:66:3:66:11 | untrusted | provenance | Src:MaD:757 |
7+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:68:3:68:51 | ...+... | provenance | Src:MaD:757 |
8+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:3:69:33 | slice literal | provenance | Src:MaD:757 |
9+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:24:69:32 | untrusted | provenance | Src:MaD:757 |
10+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:73:3:73:11 | untrusted | provenance | Src:MaD:757 |
11+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:75:3:75:51 | ...+... | provenance | Src:MaD:757 |
12+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:3:76:33 | slice literal | provenance | Src:MaD:757 |
13+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:24:76:32 | untrusted | provenance | Src:MaD:757 |
14+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:80:22:80:30 | untrusted | provenance | Src:MaD:757 |
15+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:81:25:81:33 | untrusted | provenance | Src:MaD:757 |
1616
| LDAPInjection.go:62:3:62:33 | slice literal [array] | LDAPInjection.go:62:3:62:33 | slice literal | provenance | |
1717
| LDAPInjection.go:62:24:62:32 | untrusted | LDAPInjection.go:62:3:62:33 | slice literal [array] | provenance | |
1818
| LDAPInjection.go:69:3:69:33 | slice literal [array] | LDAPInjection.go:69:3:69:33 | slice literal | provenance | |

‎go/ql/test/experimental/CWE-203/Timing.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
edges
2-
| timing.go:15:18:15:27 | selection of Header | timing.go:15:18:15:45 | call to Get | provenance | MaD:684 |
2+
| timing.go:15:18:15:27 | selection of Header | timing.go:15:18:15:45 | call to Get | provenance | MaD:738 |
33
| timing.go:15:18:15:45 | call to Get | timing.go:17:31:17:42 | headerSecret | provenance | |
4-
| timing.go:28:18:28:27 | selection of Header | timing.go:28:18:28:45 | call to Get | provenance | MaD:684 |
4+
| timing.go:28:18:28:27 | selection of Header | timing.go:28:18:28:45 | call to Get | provenance | MaD:738 |
55
| timing.go:28:18:28:45 | call to Get | timing.go:30:47:30:58 | headerSecret | provenance | |
6-
| timing.go:41:18:41:27 | selection of Header | timing.go:41:18:41:45 | call to Get | provenance | MaD:684 |
6+
| timing.go:41:18:41:27 | selection of Header | timing.go:41:18:41:45 | call to Get | provenance | MaD:738 |
77
| timing.go:41:18:41:45 | call to Get | timing.go:42:25:42:36 | headerSecret | provenance | |
88
nodes
99
| timing.go:15:18:15:27 | selection of Header | semmle.label | selection of Header |

‎go/ql/test/experimental/CWE-287/ImproperLdapAuth.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
edges
2-
| ImproperLdapAuth.go:18:18:18:24 | selection of URL | ImproperLdapAuth.go:18:18:18:32 | call to Query | provenance | MaD:764 |
2+
| ImproperLdapAuth.go:18:18:18:24 | selection of URL | ImproperLdapAuth.go:18:18:18:32 | call to Query | provenance | MaD:818 |
33
| ImproperLdapAuth.go:18:18:18:32 | call to Query | ImproperLdapAuth.go:28:23:28:34 | bindPassword | provenance | |
44
| ImproperLdapAuth.go:87:18:87:19 | "" | ImproperLdapAuth.go:97:23:97:34 | bindPassword | provenance | |
55
nodes

0 commit comments

Comments
 (0)