Skip to content

Commit 97c9207

Browse files
owen-mcowen-mc
authored
Merge pull request #17104 from owen-mc/go/add-extra-go-jose-package-path
Go: Fix missing `go-jose` package path
2 parents 251036c + 01c6dba commit 97c9207

File tree

10 files changed

+47
-31
lines changed

10 files changed

+47
-31
lines changed

‎go/ql/lib/ext/github.com.go-jose.go-jose.jwt.model.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ extensions:
33
pack: codeql/go-all
44
extensible: packageGrouping
55
data:
6-
- ["go-jose/jwt", "github.com/go-jose/go-jose/jwt"]
76
- ["go-jose/jwt", "gopkg.in/square/go-jose/jwt"]
7+
- ["go-jose/jwt", "gopkg.in/go-jose/go-jose/jwt"]
88
- ["go-jose/jwt", "github.com/square/go-jose/jwt"]
9+
- ["go-jose/jwt", "github.com/go-jose/go-jose/jwt"]
910
- addsTo:
1011
pack: codeql/go-all
1112
extensible: sinkModel

‎go/ql/lib/ext/github.com.go-jose.go-jose.model.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ extensions:
33
pack: codeql/go-all
44
extensible: packageGrouping
55
data:
6-
- ["go-jose", "github.com/go-jose/go-jose"]
76
- ["go-jose", "gopkg.in/square/go-jose"]
7+
- ["go-jose", "gopkg.in/go-jose/go-jose"]
88
- ["go-jose", "github.com/square/go-jose"]
9+
- ["go-jose", "github.com/go-jose/go-jose"]
910
- addsTo:
1011
pack: codeql/go-all
1112
extensible: sinkModel

‎go/ql/lib/semmle/go/frameworks/GoJose.qll

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
2-
* Provides classes for working with the `github.com/square/go-jose`, `github.com/go-jose/go-jose`,
3-
* and `gopkg.in/square-go-jose.v2` packages.
2+
* Provides classes for working with the `gopkg.in/square/go-jose` and `github.com/go-jose/go-jose`
3+
* packages.
44
*/
55

66
import go
@@ -22,9 +22,16 @@ private module GoJose {
2222
override int getTokenArgNum() { result = -1 }
2323
}
2424

25-
/** Gets the package names `gopkg.in/square/go-jose/jwt` and `github.com/go-jose/go-jose/jwt`. */
25+
/**
26+
* Gets the package names `gopkg.in/square/go-jose/jwt`, `gopkg.in/go-jose/go-jose/jwt`,
27+
* `github.com/square/go-jose/jwt`, and `github.com/go-jose/go-jose/jwt`.
28+
*/
2629
private string goJoseJwtPackage() {
27-
result = package(["gopkg.in/square/go-jose", "github.com/go-jose/go-jose"], "jwt")
30+
result =
31+
package([
32+
"gopkg.in/square/go-jose", "gopkg.in/go-jose/go-jose", "github.com/square/go-jose",
33+
"github.com/go-jose/go-jose"
34+
], "jwt")
2835
}
2936
}
3037
}

‎go/ql/lib/semmle/go/security/ExternalAPIs.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,10 @@ private class DefaultSafeExternalApiFunction extends SafeExternalApiFunction {
3636
DefaultSafeExternalApiFunction() {
3737
this instanceof BuiltinFunction or
3838
isDefaultSafePackage(this.getPackage()) or
39-
this.hasQualifiedName(package("gopkg.in/square/go-jose", "jwt"), "ParseSigned") or
39+
this.hasQualifiedName(package([
40+
"gopkg.in/square/go-jose", "gopkg.in/go-jose/go-jose", "github.com/square/go-jose",
41+
"github.com/go-jose/go-jose"
42+
], "jwt"), "ParseSigned") or
4043
this.(Method).hasQualifiedName(Gorm::packagePath(), "DB", "Update") or
4144
this.hasQualifiedName("crypto/hmac", "Equal") or
4245
this.hasQualifiedName("crypto/subtle", "ConstantTimeCompare") or

‎go/ql/src/experimental/frameworks/JWT.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,11 @@ class GolangJwtParseFromRequestWithClaims extends JwtParseWithKeyFunction {
172172
* Gets `gopkg.in/square/go-jose` and `github.com/go-jose/go-jose` jwt package
173173
*/
174174
string goJoseJwtPackage() {
175-
result = package(["gopkg.in/square/go-jose", "github.com/go-jose/go-jose"], "jwt")
175+
result =
176+
package([
177+
"gopkg.in/square/go-jose", "gopkg.in/go-jose/go-jose", "github.com/square/go-jose",
178+
"github.com/go-jose/go-jose"
179+
], "jwt")
176180
}
177181

178182
/**

‎go/ql/test/library-tests/semmle/go/frameworks/Beego/ReflectedXss.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ edges
3434
| test.go:205:21:205:58 | call to Substr | test.go:205:14:205:59 | type conversion | provenance | |
3535
| test.go:205:34:205:51 | type assertion | test.go:205:21:205:58 | call to Substr | provenance | MaD:315 |
3636
| test.go:207:6:207:6 | definition of s | test.go:209:14:209:28 | type conversion | provenance | |
37-
| test.go:208:18:208:33 | selection of Form | test.go:207:6:207:6 | definition of s | provenance | Src:MaD:865 MaD:313 |
37+
| test.go:208:18:208:33 | selection of Form | test.go:207:6:207:6 | definition of s | provenance | Src:MaD:867 MaD:313 |
3838
| test.go:223:2:223:34 | ... := ...[0] | test.go:225:31:225:31 | f | provenance | Src:MaD:317 |
3939
| test.go:223:2:223:34 | ... := ...[1] | test.go:224:14:224:32 | type conversion | provenance | Src:MaD:317 |
4040
| test.go:225:2:225:32 | ... := ...[0] | test.go:226:14:226:20 | content | provenance | |
41-
| test.go:225:31:225:31 | f | test.go:225:2:225:32 | ... := ...[0] | provenance | MaD:728 |
41+
| test.go:225:31:225:31 | f | test.go:225:2:225:32 | ... := ...[0] | provenance | MaD:730 |
4242
| test.go:228:2:228:40 | ... := ...[0] | test.go:229:14:229:38 | type conversion | provenance | Src:MaD:318 |
4343
| test.go:231:7:231:28 | call to GetString | test.go:232:14:232:22 | type conversion | provenance | Src:MaD:319 |
4444
| test.go:234:8:234:35 | call to GetStrings | test.go:235:14:235:26 | type conversion | provenance | Src:MaD:320 |

‎go/ql/test/library-tests/semmle/go/frameworks/Revel/OpenRedirect.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
edges
22
| EndToEnd.go:94:20:94:27 | implicit dereference | EndToEnd.go:94:20:94:27 | selection of Params | provenance | Config |
33
| EndToEnd.go:94:20:94:27 | implicit dereference | EndToEnd.go:94:20:94:32 | selection of Form | provenance | Config |
4-
| EndToEnd.go:94:20:94:27 | selection of Params | EndToEnd.go:94:20:94:27 | implicit dereference | provenance | Src:MaD:523 Config |
5-
| EndToEnd.go:94:20:94:27 | selection of Params | EndToEnd.go:94:20:94:32 | selection of Form | provenance | Src:MaD:523 Config |
4+
| EndToEnd.go:94:20:94:27 | selection of Params | EndToEnd.go:94:20:94:27 | implicit dereference | provenance | Src:MaD:525 Config |
5+
| EndToEnd.go:94:20:94:27 | selection of Params | EndToEnd.go:94:20:94:32 | selection of Form | provenance | Src:MaD:525 Config |
66
| EndToEnd.go:94:20:94:32 | selection of Form | EndToEnd.go:94:20:94:49 | call to Get | provenance | Config |
77
nodes
88
| EndToEnd.go:94:20:94:27 | implicit dereference | semmle.label | implicit dereference |

‎go/ql/test/library-tests/semmle/go/frameworks/Revel/ReflectedXss.expected

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
edges
22
| EndToEnd.go:35:2:35:4 | definition of buf | EndToEnd.go:37:24:37:26 | buf | provenance | |
3-
| EndToEnd.go:36:18:36:25 | selection of Params | EndToEnd.go:36:18:36:30 | selection of Form | provenance | Src:MaD:523 |
4-
| EndToEnd.go:36:18:36:30 | selection of Form | EndToEnd.go:36:18:36:47 | call to Get | provenance | MaD:938 |
5-
| EndToEnd.go:36:18:36:47 | call to Get | EndToEnd.go:35:2:35:4 | definition of buf | provenance | MaD:744 |
6-
| EndToEnd.go:69:22:69:29 | selection of Params | EndToEnd.go:69:22:69:34 | selection of Form | provenance | Src:MaD:523 |
7-
| EndToEnd.go:69:22:69:34 | selection of Form | EndToEnd.go:69:22:69:51 | call to Get | provenance | MaD:938 |
8-
| Revel.go:70:22:70:29 | selection of Params | Revel.go:70:22:70:35 | selection of Query | provenance | Src:MaD:523 |
9-
| examples/booking/app/init.go:36:44:36:48 | selection of URL | examples/booking/app/init.go:36:44:36:53 | selection of Path | provenance | Src:MaD:870 |
10-
| examples/booking/app/init.go:40:49:40:53 | selection of URL | examples/booking/app/init.go:40:49:40:58 | selection of Path | provenance | Src:MaD:870 |
3+
| EndToEnd.go:36:18:36:25 | selection of Params | EndToEnd.go:36:18:36:30 | selection of Form | provenance | Src:MaD:525 |
4+
| EndToEnd.go:36:18:36:30 | selection of Form | EndToEnd.go:36:18:36:47 | call to Get | provenance | MaD:940 |
5+
| EndToEnd.go:36:18:36:47 | call to Get | EndToEnd.go:35:2:35:4 | definition of buf | provenance | MaD:746 |
6+
| EndToEnd.go:69:22:69:29 | selection of Params | EndToEnd.go:69:22:69:34 | selection of Form | provenance | Src:MaD:525 |
7+
| EndToEnd.go:69:22:69:34 | selection of Form | EndToEnd.go:69:22:69:51 | call to Get | provenance | MaD:940 |
8+
| Revel.go:70:22:70:29 | selection of Params | Revel.go:70:22:70:35 | selection of Query | provenance | Src:MaD:525 |
9+
| examples/booking/app/init.go:36:44:36:48 | selection of URL | examples/booking/app/init.go:36:44:36:53 | selection of Path | provenance | Src:MaD:872 |
10+
| examples/booking/app/init.go:40:49:40:53 | selection of URL | examples/booking/app/init.go:40:49:40:58 | selection of Path | provenance | Src:MaD:872 |
1111
nodes
1212
| EndToEnd.go:35:2:35:4 | definition of buf | semmle.label | definition of buf |
1313
| EndToEnd.go:36:18:36:25 | selection of Params | semmle.label | selection of Params |

‎go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.expected

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
edges
2-
| EndToEnd.go:58:18:58:25 | selection of Params | EndToEnd.go:58:18:58:30 | selection of Form | provenance | Src:MaD:523 |
3-
| EndToEnd.go:58:18:58:30 | selection of Form | EndToEnd.go:58:18:58:47 | call to Get | provenance | MaD:938 |
4-
| EndToEnd.go:64:26:64:33 | selection of Params | EndToEnd.go:64:26:64:38 | selection of Form | provenance | Src:MaD:523 |
5-
| EndToEnd.go:64:26:64:38 | selection of Form | EndToEnd.go:64:26:64:55 | call to Get | provenance | MaD:938 |
2+
| EndToEnd.go:58:18:58:25 | selection of Params | EndToEnd.go:58:18:58:30 | selection of Form | provenance | Src:MaD:525 |
3+
| EndToEnd.go:58:18:58:30 | selection of Form | EndToEnd.go:58:18:58:47 | call to Get | provenance | MaD:940 |
4+
| EndToEnd.go:64:26:64:33 | selection of Params | EndToEnd.go:64:26:64:38 | selection of Form | provenance | Src:MaD:525 |
5+
| EndToEnd.go:64:26:64:38 | selection of Form | EndToEnd.go:64:26:64:55 | call to Get | provenance | MaD:940 |
66
nodes
77
| EndToEnd.go:58:18:58:25 | selection of Params | semmle.label | selection of Params |
88
| EndToEnd.go:58:18:58:30 | selection of Form | semmle.label | selection of Form |

‎go/ql/test/query-tests/Security/CWE-347/MissingJwtSignatureCheck.expected

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
edges
2-
| go-jose.v3.go:25:16:25:20 | selection of URL | go-jose.v3.go:25:16:25:28 | call to Query | provenance | Src:MaD:870 MaD:931 |
3-
| go-jose.v3.go:25:16:25:28 | call to Query | go-jose.v3.go:25:16:25:47 | call to Get | provenance | MaD:938 |
2+
| go-jose.v3.go:25:16:25:20 | selection of URL | go-jose.v3.go:25:16:25:28 | call to Query | provenance | Src:MaD:872 MaD:933 |
3+
| go-jose.v3.go:25:16:25:28 | call to Query | go-jose.v3.go:25:16:25:47 | call to Get | provenance | MaD:940 |
44
| go-jose.v3.go:25:16:25:47 | call to Get | go-jose.v3.go:26:15:26:25 | signedToken | provenance | |
55
| go-jose.v3.go:26:15:26:25 | signedToken | go-jose.v3.go:29:19:29:29 | definition of signedToken | provenance | |
66
| go-jose.v3.go:29:19:29:29 | definition of signedToken | go-jose.v3.go:31:37:31:47 | signedToken | provenance | |
7-
| go-jose.v3.go:31:2:31:48 | ... := ...[0] | go-jose.v3.go:33:12:33:23 | DecodedToken | provenance | Sink:MaD:439 |
8-
| go-jose.v3.go:31:37:31:47 | signedToken | go-jose.v3.go:31:2:31:48 | ... := ...[0] | provenance | MaD:441 |
9-
| golang-jwt-v5.go:28:16:28:20 | selection of URL | golang-jwt-v5.go:28:16:28:28 | call to Query | provenance | Src:MaD:870 MaD:931 |
10-
| golang-jwt-v5.go:28:16:28:28 | call to Query | golang-jwt-v5.go:28:16:28:47 | call to Get | provenance | MaD:938 |
7+
| go-jose.v3.go:31:2:31:48 | ... := ...[0] | go-jose.v3.go:33:12:33:23 | DecodedToken | provenance | Sink:MaD:440 |
8+
| go-jose.v3.go:31:37:31:47 | signedToken | go-jose.v3.go:31:2:31:48 | ... := ...[0] | provenance | MaD:442 |
9+
| golang-jwt-v5.go:28:16:28:20 | selection of URL | golang-jwt-v5.go:28:16:28:28 | call to Query | provenance | Src:MaD:872 MaD:933 |
10+
| golang-jwt-v5.go:28:16:28:28 | call to Query | golang-jwt-v5.go:28:16:28:47 | call to Get | provenance | MaD:940 |
1111
| golang-jwt-v5.go:28:16:28:47 | call to Get | golang-jwt-v5.go:29:25:29:35 | signedToken | provenance | |
1212
| golang-jwt-v5.go:29:25:29:35 | signedToken | golang-jwt-v5.go:32:29:32:39 | definition of signedToken | provenance | |
13-
| golang-jwt-v5.go:32:29:32:39 | definition of signedToken | golang-jwt-v5.go:34:58:34:68 | signedToken | provenance | Sink:MaD:463 |
13+
| golang-jwt-v5.go:32:29:32:39 | definition of signedToken | golang-jwt-v5.go:34:58:34:68 | signedToken | provenance | Sink:MaD:465 |
1414
nodes
1515
| go-jose.v3.go:25:16:25:20 | selection of URL | semmle.label | selection of URL |
1616
| go-jose.v3.go:25:16:25:28 | call to Query | semmle.label | call to Query |

0 commit comments

Comments
 (0)