Skip to content

Commit 08c0d8e

Browse files
erik-krogherik-krogh
committed
autoformat go files
1 parent 9aeebc6 commit 08c0d8e

File tree

6 files changed

+74
-73
lines changed

6 files changed

+74
-73
lines changed

‎go/ql/src/Security/CWE-078/examples/CommandInjection.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ func handler(req *http.Request) {
1111
cmd := exec.Command("sh", "-c", fmt.Sprintf("imagetool %s > %s", imageName, outputPath))
1212
cmd.Run()
1313
// ...
14-
}
14+
}

‎go/ql/src/Security/CWE-078/examples/CommandInjectionGood.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,4 @@ func handler(req *http.Request) {
2525
cmd.Stdout = outfile
2626

2727
cmd.Run()
28-
}
28+
}

‎go/ql/src/Security/CWE-078/examples/CommandInjectionGood2.go

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
package main
22

33
import (
4-
"log"
5-
"net/http"
6-
"os/exec"
7-
"regexp"
4+
"log"
5+
"net/http"
6+
"os/exec"
7+
"regexp"
88
)
99

1010
func handler(req *http.Request) {
11-
imageName := req.URL.Query()["imageName"][0]
12-
outputPath := "/tmp/output.svg"
11+
imageName := req.URL.Query()["imageName"][0]
12+
outputPath := "/tmp/output.svg"
1313

14-
// Validate the imageName with a regular expression
15-
validImageName := regexp.MustCompile(`^[a-zA-Z0-9_\-\.]+$`)
16-
if !validImageName.MatchString(imageName) {
17-
log.Fatal("Invalid image name")
18-
return
19-
}
14+
// Validate the imageName with a regular expression
15+
validImageName := regexp.MustCompile(`^[a-zA-Z0-9_\-\.]+$`)
16+
if !validImageName.MatchString(imageName) {
17+
log.Fatal("Invalid image name")
18+
return
19+
}
2020

21-
cmd := exec.Command("sh", "-c", fmt.Sprintf("imagetool %s > %s", imageName, outputPath))
22-
cmd.Run()
23-
}
21+
cmd := exec.Command("sh", "-c", fmt.Sprintf("imagetool %s > %s", imageName, outputPath))
22+
cmd.Run()
23+
}

‎go/ql/test/query-tests/Security/CWE-078/CommandInjection.expected

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ edges
88
| CommandInjection2.go:15:67:15:75 | imageName | CommandInjection2.go:15:34:15:88 | call to Sprintf | provenance | FunctionModel |
99
| CommandInjection.go:9:13:9:19 | selection of URL | CommandInjection.go:9:13:9:27 | call to Query | provenance | MaD:735 |
1010
| CommandInjection.go:9:13:9:27 | call to Query | CommandInjection.go:10:22:10:28 | cmdName | provenance | |
11-
| GitSubcommands.go:10:13:10:19 | selection of URL | GitSubcommands.go:10:13:10:27 | call to Query | provenance | MaD:735 |
12-
| GitSubcommands.go:10:13:10:27 | call to Query | GitSubcommands.go:12:31:12:37 | tainted | provenance | |
13-
| GitSubcommands.go:10:13:10:27 | call to Query | GitSubcommands.go:13:31:13:37 | tainted | provenance | |
14-
| GitSubcommands.go:10:13:10:27 | call to Query | GitSubcommands.go:14:30:14:36 | tainted | provenance | |
15-
| GitSubcommands.go:10:13:10:27 | call to Query | GitSubcommands.go:15:35:15:41 | tainted | provenance | |
16-
| GitSubcommands.go:10:13:10:27 | call to Query | GitSubcommands.go:16:36:16:42 | tainted | provenance | |
17-
| GitSubcommands.go:32:13:32:19 | selection of URL | GitSubcommands.go:32:13:32:27 | call to Query | provenance | MaD:735 |
18-
| GitSubcommands.go:32:13:32:27 | call to Query | GitSubcommands.go:37:32:37:38 | tainted | provenance | |
11+
| GitSubcommands.go:11:13:11:19 | selection of URL | GitSubcommands.go:11:13:11:27 | call to Query | provenance | MaD:735 |
12+
| GitSubcommands.go:11:13:11:27 | call to Query | GitSubcommands.go:13:31:13:37 | tainted | provenance | |
13+
| GitSubcommands.go:11:13:11:27 | call to Query | GitSubcommands.go:14:31:14:37 | tainted | provenance | |
14+
| GitSubcommands.go:11:13:11:27 | call to Query | GitSubcommands.go:15:30:15:36 | tainted | provenance | |
15+
| GitSubcommands.go:11:13:11:27 | call to Query | GitSubcommands.go:16:35:16:41 | tainted | provenance | |
16+
| GitSubcommands.go:11:13:11:27 | call to Query | GitSubcommands.go:17:36:17:42 | tainted | provenance | |
17+
| GitSubcommands.go:33:13:33:19 | selection of URL | GitSubcommands.go:33:13:33:27 | call to Query | provenance | MaD:735 |
18+
| GitSubcommands.go:33:13:33:27 | call to Query | GitSubcommands.go:38:32:38:38 | tainted | provenance | |
1919
| SanitizingDoubleDash.go:9:13:9:19 | selection of URL | SanitizingDoubleDash.go:9:13:9:27 | call to Query | provenance | MaD:735 |
2020
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:13:25:13:31 | tainted | provenance | |
2121
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:14:23:14:33 | slice expression | provenance | |
@@ -118,16 +118,16 @@ nodes
118118
| CommandInjection.go:9:13:9:19 | selection of URL | semmle.label | selection of URL |
119119
| CommandInjection.go:9:13:9:27 | call to Query | semmle.label | call to Query |
120120
| CommandInjection.go:10:22:10:28 | cmdName | semmle.label | cmdName |
121-
| GitSubcommands.go:10:13:10:19 | selection of URL | semmle.label | selection of URL |
122-
| GitSubcommands.go:10:13:10:27 | call to Query | semmle.label | call to Query |
123-
| GitSubcommands.go:12:31:12:37 | tainted | semmle.label | tainted |
121+
| GitSubcommands.go:11:13:11:19 | selection of URL | semmle.label | selection of URL |
122+
| GitSubcommands.go:11:13:11:27 | call to Query | semmle.label | call to Query |
124123
| GitSubcommands.go:13:31:13:37 | tainted | semmle.label | tainted |
125-
| GitSubcommands.go:14:30:14:36 | tainted | semmle.label | tainted |
126-
| GitSubcommands.go:15:35:15:41 | tainted | semmle.label | tainted |
127-
| GitSubcommands.go:16:36:16:42 | tainted | semmle.label | tainted |
128-
| GitSubcommands.go:32:13:32:19 | selection of URL | semmle.label | selection of URL |
129-
| GitSubcommands.go:32:13:32:27 | call to Query | semmle.label | call to Query |
130-
| GitSubcommands.go:37:32:37:38 | tainted | semmle.label | tainted |
124+
| GitSubcommands.go:14:31:14:37 | tainted | semmle.label | tainted |
125+
| GitSubcommands.go:15:30:15:36 | tainted | semmle.label | tainted |
126+
| GitSubcommands.go:16:35:16:41 | tainted | semmle.label | tainted |
127+
| GitSubcommands.go:17:36:17:42 | tainted | semmle.label | tainted |
128+
| GitSubcommands.go:33:13:33:19 | selection of URL | semmle.label | selection of URL |
129+
| GitSubcommands.go:33:13:33:27 | call to Query | semmle.label | call to Query |
130+
| GitSubcommands.go:38:32:38:38 | tainted | semmle.label | tainted |
131131
| SanitizingDoubleDash.go:9:13:9:19 | selection of URL | semmle.label | selection of URL |
132132
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | semmle.label | call to Query |
133133
| SanitizingDoubleDash.go:13:15:13:32 | array literal [array] | semmle.label | array literal [array] |
@@ -212,12 +212,12 @@ subpaths
212212
| ArgumentInjection.go:10:31:10:34 | path | ArgumentInjection.go:9:10:9:16 | selection of URL | ArgumentInjection.go:10:31:10:34 | path | This command depends on a $@. | ArgumentInjection.go:9:10:9:16 | selection of URL | user-provided value |
213213
| CommandInjection2.go:15:34:15:88 | call to Sprintf | CommandInjection2.go:13:15:13:21 | selection of URL | CommandInjection2.go:15:34:15:88 | call to Sprintf | This command depends on a $@. | CommandInjection2.go:13:15:13:21 | selection of URL | user-provided value |
214214
| CommandInjection.go:10:22:10:28 | cmdName | CommandInjection.go:9:13:9:19 | selection of URL | CommandInjection.go:10:22:10:28 | cmdName | This command depends on a $@. | CommandInjection.go:9:13:9:19 | selection of URL | user-provided value |
215-
| GitSubcommands.go:12:31:12:37 | tainted | GitSubcommands.go:10:13:10:19 | selection of URL | GitSubcommands.go:12:31:12:37 | tainted | This command depends on a $@. | GitSubcommands.go:10:13:10:19 | selection of URL | user-provided value |
216-
| GitSubcommands.go:13:31:13:37 | tainted | GitSubcommands.go:10:13:10:19 | selection of URL | GitSubcommands.go:13:31:13:37 | tainted | This command depends on a $@. | GitSubcommands.go:10:13:10:19 | selection of URL | user-provided value |
217-
| GitSubcommands.go:14:30:14:36 | tainted | GitSubcommands.go:10:13:10:19 | selection of URL | GitSubcommands.go:14:30:14:36 | tainted | This command depends on a $@. | GitSubcommands.go:10:13:10:19 | selection of URL | user-provided value |
218-
| GitSubcommands.go:15:35:15:41 | tainted | GitSubcommands.go:10:13:10:19 | selection of URL | GitSubcommands.go:15:35:15:41 | tainted | This command depends on a $@. | GitSubcommands.go:10:13:10:19 | selection of URL | user-provided value |
219-
| GitSubcommands.go:16:36:16:42 | tainted | GitSubcommands.go:10:13:10:19 | selection of URL | GitSubcommands.go:16:36:16:42 | tainted | This command depends on a $@. | GitSubcommands.go:10:13:10:19 | selection of URL | user-provided value |
220-
| GitSubcommands.go:37:32:37:38 | tainted | GitSubcommands.go:32:13:32:19 | selection of URL | GitSubcommands.go:37:32:37:38 | tainted | This command depends on a $@. | GitSubcommands.go:32:13:32:19 | selection of URL | user-provided value |
215+
| GitSubcommands.go:13:31:13:37 | tainted | GitSubcommands.go:11:13:11:19 | selection of URL | GitSubcommands.go:13:31:13:37 | tainted | This command depends on a $@. | GitSubcommands.go:11:13:11:19 | selection of URL | user-provided value |
216+
| GitSubcommands.go:14:31:14:37 | tainted | GitSubcommands.go:11:13:11:19 | selection of URL | GitSubcommands.go:14:31:14:37 | tainted | This command depends on a $@. | GitSubcommands.go:11:13:11:19 | selection of URL | user-provided value |
217+
| GitSubcommands.go:15:30:15:36 | tainted | GitSubcommands.go:11:13:11:19 | selection of URL | GitSubcommands.go:15:30:15:36 | tainted | This command depends on a $@. | GitSubcommands.go:11:13:11:19 | selection of URL | user-provided value |
218+
| GitSubcommands.go:16:35:16:41 | tainted | GitSubcommands.go:11:13:11:19 | selection of URL | GitSubcommands.go:16:35:16:41 | tainted | This command depends on a $@. | GitSubcommands.go:11:13:11:19 | selection of URL | user-provided value |
219+
| GitSubcommands.go:17:36:17:42 | tainted | GitSubcommands.go:11:13:11:19 | selection of URL | GitSubcommands.go:17:36:17:42 | tainted | This command depends on a $@. | GitSubcommands.go:11:13:11:19 | selection of URL | user-provided value |
220+
| GitSubcommands.go:38:32:38:38 | tainted | GitSubcommands.go:33:13:33:19 | selection of URL | GitSubcommands.go:38:32:38:38 | tainted | This command depends on a $@. | GitSubcommands.go:33:13:33:19 | selection of URL | user-provided value |
221221
| SanitizingDoubleDash.go:14:23:14:33 | slice expression | SanitizingDoubleDash.go:9:13:9:19 | selection of URL | SanitizingDoubleDash.go:14:23:14:33 | slice expression | This command depends on a $@. | SanitizingDoubleDash.go:9:13:9:19 | selection of URL | user-provided value |
222222
| SanitizingDoubleDash.go:40:23:40:30 | arrayLit | SanitizingDoubleDash.go:9:13:9:19 | selection of URL | SanitizingDoubleDash.go:40:23:40:30 | arrayLit | This command depends on a $@. | SanitizingDoubleDash.go:9:13:9:19 | selection of URL | user-provided value |
223223
| SanitizingDoubleDash.go:54:23:54:30 | arrayLit | SanitizingDoubleDash.go:9:13:9:19 | selection of URL | SanitizingDoubleDash.go:54:23:54:30 | arrayLit | This command depends on a $@. | SanitizingDoubleDash.go:9:13:9:19 | selection of URL | user-provided value |

‎go/ql/test/query-tests/Security/CWE-078/CommandInjection2.go

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,53 @@
11
package main
22

33
import (
4+
"fmt"
5+
"log"
46
"net/http"
7+
"os"
58
"os/exec"
6-
"log"
7-
"os"
8-
"regexp"
9-
"fmt"
9+
"regexp"
1010
)
1111

1212
func handler(req *http.Request) {
1313
imageName := req.URL.Query()["imageName"][0]
14-
outputPath = "/tmp/output.svg"
14+
outputPath = "/tmp/output.svg"
1515
cmd := exec.Command("sh", "-c", fmt.Sprintf("imagetool %s > %s", imageName, outputPath)) // NOT OK - correctly flagged
16-
cmd.Run()
17-
// ...
16+
cmd.Run()
17+
// ...
1818
}
1919

2020
func handler2(req *http.Request) {
21-
imageName := req.URL.Query()["imageName"][0]
22-
outputPath := "/tmp/output.svg"
21+
imageName := req.URL.Query()["imageName"][0]
22+
outputPath := "/tmp/output.svg"
2323

24-
// Create the output file
25-
outfile, err := os.Create(outputPath)
26-
if err != nil {
27-
log.Fatal(err)
28-
}
29-
defer outfile.Close()
24+
// Create the output file
25+
outfile, err := os.Create(outputPath)
26+
if err != nil {
27+
log.Fatal(err)
28+
}
29+
defer outfile.Close()
3030

31-
// Prepare the command
32-
cmd := exec.Command("imagetool", imageName) // OK - and not flagged
31+
// Prepare the command
32+
cmd := exec.Command("imagetool", imageName) // OK - and not flagged
3333

34-
// Set the output to our file
35-
cmd.Stdout = outfile
34+
// Set the output to our file
35+
cmd.Stdout = outfile
3636

37-
cmd.Run()
37+
cmd.Run()
3838
}
3939

4040
func handler3(req *http.Request) {
41-
imageName := req.URL.Query()["imageName"][0]
42-
outputPath := "/tmp/output.svg"
43-
44-
// Validate the imageName with a regular expression
45-
validImageName := regexp.MustCompile(`^[a-zA-Z0-9_\-\.]+$`)
46-
if !validImageName.MatchString(imageName) {
47-
log.Fatal("Invalid image name")
48-
return
49-
}
50-
51-
cmd := exec.Command("sh", "-c", fmt.Sprintf("imagetool %s > %s", imageName, outputPath)) // OK - but falsely flagged
52-
cmd.Run()
53-
}
41+
imageName := req.URL.Query()["imageName"][0]
42+
outputPath := "/tmp/output.svg"
43+
44+
// Validate the imageName with a regular expression
45+
validImageName := regexp.MustCompile(`^[a-zA-Z0-9_\-\.]+$`)
46+
if !validImageName.MatchString(imageName) {
47+
log.Fatal("Invalid image name")
48+
return
49+
}
50+
51+
cmd := exec.Command("sh", "-c", fmt.Sprintf("imagetool %s > %s", imageName, outputPath)) // OK - but falsely flagged
52+
cmd.Run()
53+
}

‎go/ql/test/query-tests/Security/CWE-078/GitSubcommands.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
package main
2+
23
import (
34
"net/http"
45
"os/exec"

0 commit comments

Comments
 (0)