Go: HardcodedCredentials

Author: d10c

go/ql/lib/semmle/go/security/HardcodedCredentials.qll

@@ -36,11 +36,23 @@ module HardcodedCredentials {
     }
 
     Location getASelectedSourceLocation(DataFlow::Node source) {
-      none() // TODO: Make sure that this source location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 62 (/Users/d10c/src/semmle-code/ql/go/ql/src/Security/CWE-798/HardcodedCredentials.ql@65:8:65:11), Column 3 does not select a source or sink originating from the flow call on line 62 (/Users/d10c/src/semmle-code/ql/go/ql/src/Security/CWE-798/HardcodedCredentials.ql@65:23:65:28)
+      result = source.getLocation()
+      or
+      exists(DataFlow::Node node | result = node.getLocation() |
+        sensitiveAssignment(node, _, _)
+        or
+        hardcodedPrivateKey(node, _)
+      )
     }
 
     Location getASelectedSinkLocation(DataFlow::Node sink) {
-      none() // TODO: Make sure that this sink location matches the query's select clause: Column 1 does not select a source or sink originating from the flow call on line 62 (/Users/d10c/src/semmle-code/ql/go/ql/src/Security/CWE-798/HardcodedCredentials.ql@65:8:65:11), Column 3 does not select a source or sink originating from the flow call on line 62 (/Users/d10c/src/semmle-code/ql/go/ql/src/Security/CWE-798/HardcodedCredentials.ql@65:23:65:28)
+      result = sink.getLocation()
+      or
+      exists(DataFlow::Node node | result = node.getLocation() |
+        sensitiveAssignment(_, node, _)
+        or
+        hardcodedPrivateKey(node, _)
+      )
     }
   }
 
@@ -142,4 +154,45 @@ module HardcodedCredentials {
       )
     }
   }
+
+  /**
+   * Holds if `sink` is used in a context that suggests it may hold sensitive data of
+   * the given `type`.
+   */
+  private predicate isSensitive(DataFlow::Node sink, SensitiveExpr::Classification type) {
+    exists(Write write, string name |
+      pragma[only_bind_out](write).getRhs() = sink and
+      name = pragma[only_bind_out](write).getLhs().getName() and
+      // allow obvious test password variables
+      not name.regexpMatch(HeuristicNames::notSensitive())
+    |
+      name.regexpMatch(HeuristicNames::maybeSensitive(type))
+    )
+  }
+
+  /**
+   * Holds if `source` locally flows to a `sink` that is used in a context that suggests
+   * it may hold sensitive data of the given `type`.
+   */
+  predicate sensitiveAssignment(
+    DataFlow::Node source, DataFlow::Node sink, SensitiveExpr::Classification type
+  ) {
+    exists(string val | val = source.getStringValue() and val != "" |
+      DataFlow::localFlow(source, sink) and
+      isSensitive(sink, type) and
+      // allow obvious dummy/test values
+      not PasswordHeuristics::isDummyPassword(val) and
+      not sink.asExpr().(Ident).getName().regexpMatch(HeuristicNames::notSensitive())
+    )
+  }
+
+  /**
+   * Holds if `node` is a hardcoded private key.
+   * The type is set to `SensitiveExpr::certificate()`.
+   */
+  predicate hardcodedPrivateKey(DataFlow::Node node, SensitiveExpr::Classification type) {
+    node.getStringValue()
+        .regexpMatch("(?s)-+BEGIN\\b.*\\bPRIVATE KEY-+.+-+END\\b.*\\bPRIVATE KEY-+\n?") and
+    type = SensitiveExpr::certificate()
+  }
 }

go/ql/src/Security/CWE-798/HardcodedCredentials.ql

@@ -17,45 +17,12 @@ import go
 import semmle.go.security.HardcodedCredentials
 import semmle.go.security.SensitiveActions
 
-/**
- * Holds if `sink` is used in a context that suggests it may hold sensitive data of
- * the given `type`.
- */
-predicate isSensitive(DataFlow::Node sink, SensitiveExpr::Classification type) {
-  exists(Write write, string name |
-    pragma[only_bind_out](write).getRhs() = sink and
-    name = pragma[only_bind_out](write).getLhs().getName() and
-    // allow obvious test password variables
-    not name.regexpMatch(HeuristicNames::notSensitive())
-  |
-    name.regexpMatch(HeuristicNames::maybeSensitive(type))
-  )
-}
-
-predicate sensitiveAssignment(
-  DataFlow::Node source, DataFlow::Node sink, SensitiveExpr::Classification type
-) {
-  exists(string val | val = source.getStringValue() and val != "" |
-    DataFlow::localFlow(source, sink) and
-    isSensitive(sink, type) and
-    // allow obvious dummy/test values
-    not PasswordHeuristics::isDummyPassword(val) and
-    not sink.asExpr().(Ident).getName().regexpMatch(HeuristicNames::notSensitive())
-  )
-}
-
-predicate hardcodedPrivateKey(DataFlow::Node node, SensitiveExpr::Classification type) {
-  node.getStringValue()
-      .regexpMatch("(?s)-+BEGIN\\b.*\\bPRIVATE KEY-+.+-+END\\b.*\\bPRIVATE KEY-+\n?") and
-  type = SensitiveExpr::certificate()
-}
-
 from DataFlow::Node source, string message, DataFlow::Node sink, SensitiveExpr::Classification type
 where
-  sensitiveAssignment(source, sink, type) and
+  HardcodedCredentials::sensitiveAssignment(source, sink, type) and
   message = "Hard-coded $@."
   or
-  hardcodedPrivateKey(source, type) and
+  HardcodedCredentials::hardcodedPrivateKey(source, type) and
   source = sink and
   message = "Hard-coded private key."
   or