Skip to content

Commit 94c812c

Browse files
owen-mcowen-mc
committed
Convert cleartext logging tests to inline expectations
1 parent 59d82b3 commit 94c812c

File tree

7 files changed

+85
-82
lines changed

7 files changed

+85
-82
lines changed

‎go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#select
2-
| klog.go:22:15:22:20 | header | klog.go:20:30:20:37 | selection of Header | klog.go:22:15:22:20 | header | $@ flows to a logging call. | klog.go:20:30:20:37 | selection of Header | Sensitive data returned by HTTP request headers |
3-
| klog.go:28:13:28:41 | call to Get | klog.go:28:13:28:20 | selection of Header | klog.go:28:13:28:41 | call to Get | $@ flows to a logging call. | klog.go:28:13:28:20 | selection of Header | Sensitive data returned by HTTP request headers |
2+
| klog.go:23:15:23:20 | header | klog.go:21:30:21:37 | selection of Header | klog.go:23:15:23:20 | header | $@ flows to a logging call. | klog.go:21:30:21:37 | selection of Header | Sensitive data returned by HTTP request headers |
3+
| klog.go:29:13:29:41 | call to Get | klog.go:29:13:29:20 | selection of Header | klog.go:29:13:29:41 | call to Get | $@ flows to a logging call. | klog.go:29:13:29:20 | selection of Header | Sensitive data returned by HTTP request headers |
44
| main.go:15:12:15:19 | password | main.go:15:12:15:19 | password | main.go:15:12:15:19 | password | $@ flows to a logging call. | main.go:15:12:15:19 | password | Sensitive data returned by an access to password |
55
| main.go:16:17:16:24 | password | main.go:16:17:16:24 | password | main.go:16:17:16:24 | password | $@ flows to a logging call. | main.go:16:17:16:24 | password | Sensitive data returned by an access to password |
66
| main.go:17:13:17:20 | password | main.go:17:13:17:20 | password | main.go:17:13:17:20 | password | $@ flows to a logging call. | main.go:17:13:17:20 | password | Sensitive data returned by an access to password |
@@ -55,11 +55,11 @@
5555
| passwords.go:127:14:127:21 | selection of y | passwords.go:122:13:122:25 | call to getPassword | passwords.go:127:14:127:21 | selection of y | $@ flows to a logging call. | passwords.go:122:13:122:25 | call to getPassword | Sensitive data returned by a call to getPassword |
5656
| protobuf.go:14:14:14:35 | call to GetDescription | protobuf.go:12:22:12:29 | password | protobuf.go:14:14:14:35 | call to GetDescription | $@ flows to a logging call. | protobuf.go:12:22:12:29 | password | Sensitive data returned by an access to password |
5757
edges
58-
| klog.go:20:3:25:3 | range statement[1] | klog.go:21:27:21:33 | headers | provenance | |
59-
| klog.go:20:30:20:37 | selection of Header | klog.go:20:3:25:3 | range statement[1] | provenance | Src:MaD:1 Config |
60-
| klog.go:21:4:24:4 | range statement[1] | klog.go:22:15:22:20 | header | provenance | |
61-
| klog.go:21:27:21:33 | headers | klog.go:21:4:24:4 | range statement[1] | provenance | Config |
62-
| klog.go:28:13:28:20 | selection of Header | klog.go:28:13:28:41 | call to Get | provenance | Src:MaD:1 Config |
58+
| klog.go:21:3:26:3 | range statement[1] | klog.go:22:27:22:33 | headers | provenance | |
59+
| klog.go:21:30:21:37 | selection of Header | klog.go:21:3:26:3 | range statement[1] | provenance | Src:MaD:1 Config |
60+
| klog.go:22:4:25:4 | range statement[1] | klog.go:23:15:23:20 | header | provenance | |
61+
| klog.go:22:27:22:33 | headers | klog.go:22:4:25:4 | range statement[1] | provenance | Config |
62+
| klog.go:29:13:29:20 | selection of Header | klog.go:29:13:29:41 | call to Get | provenance | Src:MaD:1 Config |
6363
| overrides.go:9:9:9:16 | password | overrides.go:13:14:13:23 | call to String | provenance | |
6464
| passwords.go:8:12:8:12 | definition of x | passwords.go:9:14:9:14 | x | provenance | |
6565
| passwords.go:30:8:30:15 | password | passwords.go:8:12:8:12 | definition of x | provenance | |
@@ -101,13 +101,13 @@ edges
101101
models
102102
| 1 | Source: net/http; Request; true; Header; ; ; ; remote; manual |
103103
nodes
104-
| klog.go:20:3:25:3 | range statement[1] | semmle.label | range statement[1] |
105-
| klog.go:20:30:20:37 | selection of Header | semmle.label | selection of Header |
106-
| klog.go:21:4:24:4 | range statement[1] | semmle.label | range statement[1] |
107-
| klog.go:21:27:21:33 | headers | semmle.label | headers |
108-
| klog.go:22:15:22:20 | header | semmle.label | header |
109-
| klog.go:28:13:28:20 | selection of Header | semmle.label | selection of Header |
110-
| klog.go:28:13:28:41 | call to Get | semmle.label | call to Get |
104+
| klog.go:21:3:26:3 | range statement[1] | semmle.label | range statement[1] |
105+
| klog.go:21:30:21:37 | selection of Header | semmle.label | selection of Header |
106+
| klog.go:22:4:25:4 | range statement[1] | semmle.label | range statement[1] |
107+
| klog.go:22:27:22:33 | headers | semmle.label | headers |
108+
| klog.go:23:15:23:20 | header | semmle.label | header |
109+
| klog.go:29:13:29:20 | selection of Header | semmle.label | selection of Header |
110+
| klog.go:29:13:29:41 | call to Get | semmle.label | call to Get |
111111
| main.go:15:12:15:19 | password | semmle.label | password |
112112
| main.go:16:17:16:24 | password | semmle.label | password |
113113
| main.go:17:13:17:20 | password | semmle.label | password |

‎go/ql/test/query-tests/Security/CWE-312/CleartextLogging.qlref

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: Security/CWE-312/CleartextLogging.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/query-tests/Security/CWE-312/klog.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ package main
33
//go:generate depstubber -vendor k8s.io/klog "" Info
44

55
import (
6-
"k8s.io/klog"
76
"net/http"
87
"strings"
8+
9+
"k8s.io/klog"
910
)
1011

1112
func mask(key, value string) string {
@@ -17,15 +18,15 @@ func mask(key, value string) string {
1718

1819
func klogTest() {
1920
http.HandleFunc("/klog", func(w http.ResponseWriter, r *http.Request) {
20-
for name, headers := range r.Header {
21+
for name, headers := range r.Header { // $ Source
2122
for _, header := range headers {
22-
klog.Info(header) // NOT OK
23+
klog.Info(header) // $ Alert
2324
klog.Info(mask(name, header)) // OK
2425
}
2526
}
2627
klog.Info(r.Header.Get("Accept")) // OK
2728
klog.Info(r.Header["Content-Type"]) // OK
28-
klog.Info(r.Header.Get("Authorization")) // NOT OK
29+
klog.Info(r.Header.Get("Authorization")) // $ Alert
2930
})
3031
http.ListenAndServe(":80", nil)
3132
}

‎go/ql/test/query-tests/Security/CWE-312/main.go

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -12,43 +12,43 @@ import (
1212
func main() {
1313
password := "P4ssw0rd"
1414

15-
log.Print(password)
16-
log.Printf("", password)
17-
log.Printf(password, "")
18-
log.Println(password)
19-
log.Fatal(password)
20-
log.Fatalf("", password)
21-
log.Fatalf(password, "")
22-
log.Fatalln(password)
23-
log.Panic(password)
24-
log.Panicf("", password)
25-
log.Panicf(password, "")
26-
log.Panicln(password)
27-
log.Output(0, password)
15+
log.Print(password) // $ Alert
16+
log.Printf("", password) // $ Alert
17+
log.Printf(password, "") // $ Alert
18+
log.Println(password) // $ Alert
19+
log.Fatal(password) // $ Alert
20+
log.Fatalf("", password) // $ Alert
21+
log.Fatalf(password, "") // $ Alert
22+
log.Fatalln(password) // $ Alert
23+
log.Panic(password) // $ Alert
24+
log.Panicf("", password) // $ Alert
25+
log.Panicf(password, "") // $ Alert
26+
log.Panicln(password) // $ Alert
27+
log.Output(0, password) // $ Alert
2828

2929
l := log.Default()
30-
l.Print(password)
31-
l.Printf("", password)
32-
l.Printf(password, "")
33-
l.Println(password)
34-
l.Fatal(password)
35-
l.Fatalf("", password)
36-
l.Fatalf(password, "")
37-
l.Fatalln(password)
38-
l.Panic(password)
39-
l.Panicf("", password)
40-
l.Panicf(password, "")
41-
l.Panicln(password)
42-
l.Output(0, password)
43-
44-
glog.Info(password)
45-
logrus.Warning(password)
30+
l.Print(password) // $ Alert
31+
l.Printf("", password) // $ Alert
32+
l.Printf(password, "") // $ Alert
33+
l.Println(password) // $ Alert
34+
l.Fatal(password) // $ Alert
35+
l.Fatalf("", password) // $ Alert
36+
l.Fatalf(password, "") // $ Alert
37+
l.Fatalln(password) // $ Alert
38+
l.Panic(password) // $ Alert
39+
l.Panicf("", password) // $ Alert
40+
l.Panicf(password, "") // $ Alert
41+
l.Panicln(password) // $ Alert
42+
l.Output(0, password) // $ Alert
43+
44+
glog.Info(password) // $ Alert
45+
logrus.Warning(password) // $ Alert
4646

4747
fields := make(logrus.Fields)
4848
fields["pass"] = password
4949
entry := logrus.WithFields(fields)
5050
entry.Errorf("")
5151

52-
entry = logrus.WithField("pass", password)
52+
entry = logrus.WithField("pass", password) // $ Alert
5353
entry.Panic("")
5454
}

‎go/ql/test/query-tests/Security/CWE-312/overrides.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ type s struct{}
66

77
func (_ s) String() string {
88
password := "horsebatterystaplecorrect"
9-
return password
9+
return password // $ Source
1010
}
1111

1212
func overrideTest(x s, y fmt.Stringer) {
13-
fmt.Println(x.String()) // NOT OK
13+
fmt.Println(x.String()) // $ Alert
1414
fmt.Println(y.String()) // OK
1515
}

‎go/ql/test/query-tests/Security/CWE-312/passwords.go

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
)
77

88
func myLog(x string) {
9-
log.Println(x) // NOT OK
9+
log.Println(x) // $ Alert
1010
}
1111

1212
func redact(kind, value string) string {
@@ -22,33 +22,33 @@ func test() {
2222
x := "horsebatterystapleincorrect"
2323
var o passStruct
2424

25-
log.Println(password) // NOT OK
26-
log.Println(o.password) // NOT OK
27-
log.Println(getPassword()) // NOT OK
28-
log.Println(o.getPassword()) // NOT OK
25+
log.Println(password) // $ Alert
26+
log.Println(o.password) // $ Alert
27+
log.Println(getPassword()) // $ Alert
28+
log.Println(o.getPassword()) // $ Alert
2929

30-
myLog(password)
30+
myLog(password) // $ Source
3131

32-
log.Panic(password) // NOT OK
32+
log.Panic(password) // $ Alert
3333

34-
log.Println(name + ", " + password) // NOT OK
34+
log.Println(name + ", " + password) // $ Alert
3535

3636
obj1 := passStruct{
37-
password: x,
37+
password: x, // $ Source
3838
}
39-
log.Println(obj1) // NOT OK
39+
log.Println(obj1) // $ Alert
4040

4141
obj2 := xStruct{
42-
x: password,
42+
x: password, // $ Source
4343
}
44-
log.Println(obj2) // NOT OK
44+
log.Println(obj2) // $ Alert
4545

4646
var obj3 xStruct
47-
log.Println(obj3) // caught because of the below line
48-
obj3.x = password // NOT OK
47+
log.Println(obj3) // $ SPURIOUS: Alert // caught because of the below line and def-use flow
48+
obj3.x = password // $ Source
4949

5050
fixed_password := "cowbatterystaplecorrect"
51-
log.Println(fixed_password) // Probably OK, but caught
51+
log.Println(fixed_password) // $ Alert // Probably OK
5252

5353
log.Println(IncorrectPasswordError) // OK
5454

@@ -83,12 +83,12 @@ func test() {
8383
log.Println(password_sha) // OK
8484

8585
utilityObject := passSetStruct{
86-
passwordSet: make(map[string]bool),
86+
passwordSet: make(map[string]bool), // $ Source
8787
}
88-
log.Println(utilityObject) // NOT OK
88+
log.Println(utilityObject) // $ Alert
8989

90-
secret := password
91-
log.Printf("pw: %s", secret) // NOT OK
90+
secret := password // $ Source
91+
log.Printf("pw: %s", secret) // $ Alert
9292

9393
log.Println("Password is: " + redact("password", password))
9494

@@ -98,33 +98,33 @@ func test() {
9898
if t.test(y) {
9999
f()
100100
// ...
101-
log.Println("Password is: " + password) // NOT OK
101+
log.Println("Password is: " + password) // $ Alert
102102
// ...
103103
}
104104

105105
if t.test(y) {
106106
if f() {
107-
log.Println("Password is: " + password) // NOT OK
107+
log.Println("Password is: " + password) // $ Alert
108108
}
109109
}
110110

111111
if os.Getenv("APP_ENV") != "production" {
112-
log.Println("Password is: " + password) // OK, but still flagged
112+
log.Println("Password is: " + password) // $ SPURIOUS: Alert
113113
}
114114

115115
var password1 stringable = stringable{"arstneio"}
116-
log.Println(name + ", " + password1.String()) // NOT OK
116+
log.Println(name + ", " + password1.String()) // $ Alert
117117

118118
config := Config{
119-
password: x,
119+
password: x, // $ Source
120120
hostname: "tarski",
121-
x: password,
122-
y: getPassword(),
121+
x: password, // $ Source
122+
y: getPassword(), // $ Source
123123
}
124124
log.Println(config.hostname) // OK
125-
log.Println(config) // NOT OK
126-
log.Println(config.x) // NOT OK
127-
log.Println(config.y) // NOT OK
125+
log.Println(config) // $ Alert
126+
log.Println(config.x) // $ Alert
127+
log.Println(config.y) // $ Alert
128128

129129
obj4 := xStruct{
130130
x: "aaaaa",

‎go/ql/test/query-tests/Security/CWE-312/protobuf.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ func testProtobuf() {
99
password := "P@ssw0rd"
1010

1111
query := &query.Query{}
12-
query.Description = password
12+
query.Description = password // $ Source
1313

14-
log.Println(query.GetDescription()) // NOT OK
14+
log.Println(query.GetDescription()) // $ Alert
1515
log.Println(query.GetId()) // OK
1616
}

0 commit comments

Comments
 (0)