Skip to content

Commit 990043c

Browse files
owen-mcowen-mc
committed
Add net/http.Head and net/http.Client.Head as client requests
They were previously deliberately excluded.
1 parent 71703aa commit 990043c

File tree

3 files changed

+38
-31
lines changed

3 files changed

+38
-31
lines changed

‎go/ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ module NetHttp {
183183
or
184184
this.getTarget().(Method).hasQualifiedName("net/http", "Client", functionName)
185185
|
186-
functionName = ["Get", "Post", "PostForm"]
186+
functionName = ["Get", "Head", "Post", "PostForm"]
187187
)
188188
}
189189

‎go/ql/test/query-tests/Security/CWE-918/RequestForgery.expected

Lines changed: 35 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,18 @@
11
#select
22
| RequestForgery.go:11:15:11:66 | call to Get | RequestForgery.go:8:12:8:34 | call to FormValue | RequestForgery.go:11:24:11:65 | ...+... | The $@ of this request depends on a $@. | RequestForgery.go:11:24:11:65 | ...+... | URL | RequestForgery.go:8:12:8:34 | call to FormValue | user-provided value |
33
| tst.go:14:2:14:18 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:14:11:14:17 | tainted | The $@ of this request depends on a $@. | tst.go:14:11:14:17 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
4+
| tst.go:16:2:16:19 | call to Head | tst.go:10:13:10:35 | call to FormValue | tst.go:16:12:16:18 | tainted | The $@ of this request depends on a $@. | tst.go:16:12:16:18 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
45
| tst.go:18:2:18:38 | call to Post | tst.go:10:13:10:35 | call to FormValue | tst.go:18:12:18:18 | tainted | The $@ of this request depends on a $@. | tst.go:18:12:18:18 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
56
| tst.go:20:2:20:28 | call to PostForm | tst.go:10:13:10:35 | call to FormValue | tst.go:20:16:20:22 | tainted | The $@ of this request depends on a $@. | tst.go:20:16:20:22 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
67
| tst.go:24:2:24:15 | call to Do | tst.go:10:13:10:35 | call to FormValue | tst.go:23:35:23:41 | tainted | The $@ of this request depends on a $@. | tst.go:23:35:23:41 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
78
| tst.go:27:2:27:15 | call to Do | tst.go:10:13:10:35 | call to FormValue | tst.go:26:68:26:74 | tainted | The $@ of this request depends on a $@. | tst.go:26:68:26:74 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
89
| tst.go:29:2:29:20 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:29:13:29:19 | tainted | The $@ of this request depends on a $@. | tst.go:29:13:29:19 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
9-
| tst.go:30:2:30:40 | call to Post | tst.go:10:13:10:35 | call to FormValue | tst.go:30:14:30:20 | tainted | The $@ of this request depends on a $@. | tst.go:30:14:30:20 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
10-
| tst.go:31:2:31:30 | call to PostForm | tst.go:10:13:10:35 | call to FormValue | tst.go:31:18:31:24 | tainted | The $@ of this request depends on a $@. | tst.go:31:18:31:24 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
11-
| tst.go:33:2:33:30 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:33:11:33:29 | ...+... | The $@ of this request depends on a $@. | tst.go:33:11:33:29 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
12-
| tst.go:35:2:35:41 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:35:11:35:40 | ...+... | The $@ of this request depends on a $@. | tst.go:35:11:35:40 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
13-
| tst.go:43:2:43:21 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:43:11:43:20 | call to String | The $@ of this request depends on a $@. | tst.go:43:11:43:20 | call to String | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
10+
| tst.go:30:2:30:21 | call to Head | tst.go:10:13:10:35 | call to FormValue | tst.go:30:14:30:20 | tainted | The $@ of this request depends on a $@. | tst.go:30:14:30:20 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
11+
| tst.go:31:2:31:40 | call to Post | tst.go:10:13:10:35 | call to FormValue | tst.go:31:14:31:20 | tainted | The $@ of this request depends on a $@. | tst.go:31:14:31:20 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
12+
| tst.go:32:2:32:30 | call to PostForm | tst.go:10:13:10:35 | call to FormValue | tst.go:32:18:32:24 | tainted | The $@ of this request depends on a $@. | tst.go:32:18:32:24 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
13+
| tst.go:34:2:34:30 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:34:11:34:29 | ...+... | The $@ of this request depends on a $@. | tst.go:34:11:34:29 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
14+
| tst.go:36:2:36:41 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:36:11:36:40 | ...+... | The $@ of this request depends on a $@. | tst.go:36:11:36:40 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
15+
| tst.go:44:2:44:21 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:44:11:44:20 | call to String | The $@ of this request depends on a $@. | tst.go:44:11:44:20 | call to String | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
1416
| websocket.go:65:12:65:53 | call to Dial | websocket.go:60:21:60:31 | call to Referer | websocket.go:65:27:65:40 | untrustedInput | The $@ of this request depends on a $@. | websocket.go:65:27:65:40 | untrustedInput | WebSocket URL | websocket.go:60:21:60:31 | call to Referer | user-provided value |
1517
| websocket.go:79:13:79:40 | call to DialConfig | websocket.go:74:21:74:31 | call to Referer | websocket.go:78:36:78:49 | untrustedInput | The $@ of this request depends on a $@. | websocket.go:78:36:78:49 | untrustedInput | WebSocket URL | websocket.go:74:21:74:31 | call to Referer | user-provided value |
1618
| websocket.go:91:3:91:50 | call to Dial | websocket.go:88:21:88:31 | call to Referer | websocket.go:91:31:91:44 | untrustedInput | The $@ of this request depends on a $@. | websocket.go:91:31:91:44 | untrustedInput | WebSocket URL | websocket.go:88:21:88:31 | call to Referer | user-provided value |
@@ -23,26 +25,28 @@
2325
edges
2426
| RequestForgery.go:8:12:8:34 | call to FormValue | RequestForgery.go:11:24:11:65 | ...+... | provenance | Src:MaD:1 |
2527
| tst.go:10:13:10:35 | call to FormValue | tst.go:14:11:14:17 | tainted | provenance | Src:MaD:1 |
28+
| tst.go:10:13:10:35 | call to FormValue | tst.go:16:12:16:18 | tainted | provenance | Src:MaD:1 |
2629
| tst.go:10:13:10:35 | call to FormValue | tst.go:18:12:18:18 | tainted | provenance | Src:MaD:1 |
2730
| tst.go:10:13:10:35 | call to FormValue | tst.go:20:16:20:22 | tainted | provenance | Src:MaD:1 |
2831
| tst.go:10:13:10:35 | call to FormValue | tst.go:23:35:23:41 | tainted | provenance | Src:MaD:1 |
2932
| tst.go:10:13:10:35 | call to FormValue | tst.go:26:68:26:74 | tainted | provenance | Src:MaD:1 |
3033
| tst.go:10:13:10:35 | call to FormValue | tst.go:29:13:29:19 | tainted | provenance | Src:MaD:1 |
3134
| tst.go:10:13:10:35 | call to FormValue | tst.go:30:14:30:20 | tainted | provenance | Src:MaD:1 |
32-
| tst.go:10:13:10:35 | call to FormValue | tst.go:31:18:31:24 | tainted | provenance | Src:MaD:1 |
33-
| tst.go:10:13:10:35 | call to FormValue | tst.go:33:11:33:29 | ...+... | provenance | Src:MaD:1 |
34-
| tst.go:10:13:10:35 | call to FormValue | tst.go:35:11:35:40 | ...+... | provenance | Src:MaD:1 |
35-
| tst.go:10:13:10:35 | call to FormValue | tst.go:42:11:42:17 | tainted | provenance | Src:MaD:1 |
36-
| tst.go:41:2:41:2 | definition of u [pointer] | tst.go:42:2:42:2 | u [pointer] | provenance | |
37-
| tst.go:42:2:42:2 | implicit dereference | tst.go:41:2:41:2 | definition of u [pointer] | provenance | |
38-
| tst.go:42:2:42:2 | implicit dereference | tst.go:42:2:42:2 | u | provenance | |
39-
| tst.go:42:2:42:2 | implicit dereference | tst.go:43:11:43:11 | u | provenance | |
40-
| tst.go:42:2:42:2 | u | tst.go:42:2:42:2 | implicit dereference | provenance | |
41-
| tst.go:42:2:42:2 | u | tst.go:43:11:43:11 | u | provenance | |
42-
| tst.go:42:2:42:2 | u [pointer] | tst.go:42:2:42:2 | implicit dereference | provenance | |
43-
| tst.go:42:11:42:17 | tainted | tst.go:42:2:42:2 | u | provenance | Config |
44-
| tst.go:42:11:42:17 | tainted | tst.go:43:11:43:11 | u | provenance | Config |
45-
| tst.go:43:11:43:11 | u | tst.go:43:11:43:20 | call to String | provenance | MaD:3 |
35+
| tst.go:10:13:10:35 | call to FormValue | tst.go:31:14:31:20 | tainted | provenance | Src:MaD:1 |
36+
| tst.go:10:13:10:35 | call to FormValue | tst.go:32:18:32:24 | tainted | provenance | Src:MaD:1 |
37+
| tst.go:10:13:10:35 | call to FormValue | tst.go:34:11:34:29 | ...+... | provenance | Src:MaD:1 |
38+
| tst.go:10:13:10:35 | call to FormValue | tst.go:36:11:36:40 | ...+... | provenance | Src:MaD:1 |
39+
| tst.go:10:13:10:35 | call to FormValue | tst.go:43:11:43:17 | tainted | provenance | Src:MaD:1 |
40+
| tst.go:42:2:42:2 | definition of u [pointer] | tst.go:43:2:43:2 | u [pointer] | provenance | |
41+
| tst.go:43:2:43:2 | implicit dereference | tst.go:42:2:42:2 | definition of u [pointer] | provenance | |
42+
| tst.go:43:2:43:2 | implicit dereference | tst.go:43:2:43:2 | u | provenance | |
43+
| tst.go:43:2:43:2 | implicit dereference | tst.go:44:11:44:11 | u | provenance | |
44+
| tst.go:43:2:43:2 | u | tst.go:43:2:43:2 | implicit dereference | provenance | |
45+
| tst.go:43:2:43:2 | u | tst.go:44:11:44:11 | u | provenance | |
46+
| tst.go:43:2:43:2 | u [pointer] | tst.go:43:2:43:2 | implicit dereference | provenance | |
47+
| tst.go:43:11:43:17 | tainted | tst.go:43:2:43:2 | u | provenance | Config |
48+
| tst.go:43:11:43:17 | tainted | tst.go:44:11:44:11 | u | provenance | Config |
49+
| tst.go:44:11:44:11 | u | tst.go:44:11:44:20 | call to String | provenance | MaD:3 |
4650
| websocket.go:60:21:60:31 | call to Referer | websocket.go:65:27:65:40 | untrustedInput | provenance | Src:MaD:2 |
4751
| websocket.go:74:21:74:31 | call to Referer | websocket.go:78:36:78:49 | untrustedInput | provenance | Src:MaD:2 |
4852
| websocket.go:88:21:88:31 | call to Referer | websocket.go:91:31:91:44 | untrustedInput | provenance | Src:MaD:2 |
@@ -61,22 +65,24 @@ nodes
6165
| RequestForgery.go:11:24:11:65 | ...+... | semmle.label | ...+... |
6266
| tst.go:10:13:10:35 | call to FormValue | semmle.label | call to FormValue |
6367
| tst.go:14:11:14:17 | tainted | semmle.label | tainted |
68+
| tst.go:16:12:16:18 | tainted | semmle.label | tainted |
6469
| tst.go:18:12:18:18 | tainted | semmle.label | tainted |
6570
| tst.go:20:16:20:22 | tainted | semmle.label | tainted |
6671
| tst.go:23:35:23:41 | tainted | semmle.label | tainted |
6772
| tst.go:26:68:26:74 | tainted | semmle.label | tainted |
6873
| tst.go:29:13:29:19 | tainted | semmle.label | tainted |
6974
| tst.go:30:14:30:20 | tainted | semmle.label | tainted |
70-
| tst.go:31:18:31:24 | tainted | semmle.label | tainted |
71-
| tst.go:33:11:33:29 | ...+... | semmle.label | ...+... |
72-
| tst.go:35:11:35:40 | ...+... | semmle.label | ...+... |
73-
| tst.go:41:2:41:2 | definition of u [pointer] | semmle.label | definition of u [pointer] |
74-
| tst.go:42:2:42:2 | implicit dereference | semmle.label | implicit dereference |
75-
| tst.go:42:2:42:2 | u | semmle.label | u |
76-
| tst.go:42:2:42:2 | u [pointer] | semmle.label | u [pointer] |
77-
| tst.go:42:11:42:17 | tainted | semmle.label | tainted |
78-
| tst.go:43:11:43:11 | u | semmle.label | u |
79-
| tst.go:43:11:43:20 | call to String | semmle.label | call to String |
75+
| tst.go:31:14:31:20 | tainted | semmle.label | tainted |
76+
| tst.go:32:18:32:24 | tainted | semmle.label | tainted |
77+
| tst.go:34:11:34:29 | ...+... | semmle.label | ...+... |
78+
| tst.go:36:11:36:40 | ...+... | semmle.label | ...+... |
79+
| tst.go:42:2:42:2 | definition of u [pointer] | semmle.label | definition of u [pointer] |
80+
| tst.go:43:2:43:2 | implicit dereference | semmle.label | implicit dereference |
81+
| tst.go:43:2:43:2 | u | semmle.label | u |
82+
| tst.go:43:2:43:2 | u [pointer] | semmle.label | u [pointer] |
83+
| tst.go:43:11:43:17 | tainted | semmle.label | tainted |
84+
| tst.go:44:11:44:11 | u | semmle.label | u |
85+
| tst.go:44:11:44:20 | call to String | semmle.label | call to String |
8086
| websocket.go:60:21:60:31 | call to Referer | semmle.label | call to Referer |
8187
| websocket.go:65:27:65:40 | untrustedInput | semmle.label | untrustedInput |
8288
| websocket.go:74:21:74:31 | call to Referer | semmle.label | call to Referer |

‎go/ql/test/query-tests/Security/CWE-918/tst.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ func handler2(w http.ResponseWriter, req *http.Request) {
1313

1414
http.Get(tainted) // $ Alert
1515

16-
http.Head(tainted) // OK
16+
http.Head(tainted) // $ Alert
1717

1818
http.Post(tainted, "text/basic", nil) // $ Alert
1919

@@ -27,6 +27,7 @@ func handler2(w http.ResponseWriter, req *http.Request) {
2727
client.Do(rq2) // $ Alert
2828

2929
client.Get(tainted) // $ Alert
30+
client.Head(tainted) // $ Alert
3031
client.Post(tainted, "text/basic", nil) // $ Alert
3132
client.PostForm(tainted, nil) // $ Alert
3233

0 commit comments

Comments
 (0)