Skip to content

Commit d437a09

Browse files
owen-mcowen-mc
committed
Test more client request URL sinks
1 parent 0788a90 commit d437a09

File tree

2 files changed

+53
-35
lines changed

2 files changed

+53
-35
lines changed

‎go/ql/test/query-tests/Security/CWE-918/RequestForgery.expected

Lines changed: 43 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@
22
| RequestForgery.go:11:15:11:66 | call to Get | RequestForgery.go:8:12:8:34 | call to FormValue | RequestForgery.go:11:24:11:65 | ...+... | The $@ of this request depends on a $@. | RequestForgery.go:11:24:11:65 | ...+... | URL | RequestForgery.go:8:12:8:34 | call to FormValue | user-provided value |
33
| tst.go:14:2:14:18 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:14:11:14:17 | tainted | The $@ of this request depends on a $@. | tst.go:14:11:14:17 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
44
| tst.go:18:2:18:38 | call to Post | tst.go:10:13:10:35 | call to FormValue | tst.go:18:12:18:18 | tainted | The $@ of this request depends on a $@. | tst.go:18:12:18:18 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
5-
| tst.go:22:2:22:14 | call to Do | tst.go:10:13:10:35 | call to FormValue | tst.go:21:34:21:40 | tainted | The $@ of this request depends on a $@. | tst.go:21:34:21:40 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
6-
| tst.go:25:2:25:14 | call to Do | tst.go:10:13:10:35 | call to FormValue | tst.go:24:66:24:72 | tainted | The $@ of this request depends on a $@. | tst.go:24:66:24:72 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
7-
| tst.go:27:2:27:30 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:27:11:27:29 | ...+... | The $@ of this request depends on a $@. | tst.go:27:11:27:29 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
8-
| tst.go:29:2:29:41 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:29:11:29:40 | ...+... | The $@ of this request depends on a $@. | tst.go:29:11:29:40 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
9-
| tst.go:37:2:37:21 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:37:11:37:20 | call to String | The $@ of this request depends on a $@. | tst.go:37:11:37:20 | call to String | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
5+
| tst.go:20:2:20:28 | call to PostForm | tst.go:10:13:10:35 | call to FormValue | tst.go:20:16:20:22 | tainted | The $@ of this request depends on a $@. | tst.go:20:16:20:22 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
6+
| tst.go:24:2:24:15 | call to Do | tst.go:10:13:10:35 | call to FormValue | tst.go:23:35:23:41 | tainted | The $@ of this request depends on a $@. | tst.go:23:35:23:41 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
7+
| tst.go:27:2:27:15 | call to Do | tst.go:10:13:10:35 | call to FormValue | tst.go:26:68:26:74 | tainted | The $@ of this request depends on a $@. | tst.go:26:68:26:74 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
8+
| tst.go:29:2:29:20 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:29:13:29:19 | tainted | The $@ of this request depends on a $@. | tst.go:29:13:29:19 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
9+
| tst.go:30:2:30:40 | call to Post | tst.go:10:13:10:35 | call to FormValue | tst.go:30:14:30:20 | tainted | The $@ of this request depends on a $@. | tst.go:30:14:30:20 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
10+
| tst.go:31:2:31:30 | call to PostForm | tst.go:10:13:10:35 | call to FormValue | tst.go:31:18:31:24 | tainted | The $@ of this request depends on a $@. | tst.go:31:18:31:24 | tainted | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
11+
| tst.go:33:2:33:30 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:33:11:33:29 | ...+... | The $@ of this request depends on a $@. | tst.go:33:11:33:29 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
12+
| tst.go:35:2:35:41 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:35:11:35:40 | ...+... | The $@ of this request depends on a $@. | tst.go:35:11:35:40 | ...+... | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
13+
| tst.go:43:2:43:21 | call to Get | tst.go:10:13:10:35 | call to FormValue | tst.go:43:11:43:20 | call to String | The $@ of this request depends on a $@. | tst.go:43:11:43:20 | call to String | URL | tst.go:10:13:10:35 | call to FormValue | user-provided value |
1014
| websocket.go:65:12:65:53 | call to Dial | websocket.go:60:21:60:31 | call to Referer | websocket.go:65:27:65:40 | untrustedInput | The $@ of this request depends on a $@. | websocket.go:65:27:65:40 | untrustedInput | WebSocket URL | websocket.go:60:21:60:31 | call to Referer | user-provided value |
1115
| websocket.go:79:13:79:40 | call to DialConfig | websocket.go:74:21:74:31 | call to Referer | websocket.go:78:36:78:49 | untrustedInput | The $@ of this request depends on a $@. | websocket.go:78:36:78:49 | untrustedInput | WebSocket URL | websocket.go:74:21:74:31 | call to Referer | user-provided value |
1216
| websocket.go:91:3:91:50 | call to Dial | websocket.go:88:21:88:31 | call to Referer | websocket.go:91:31:91:44 | untrustedInput | The $@ of this request depends on a $@. | websocket.go:91:31:91:44 | untrustedInput | WebSocket URL | websocket.go:88:21:88:31 | call to Referer | user-provided value |
@@ -20,21 +24,25 @@ edges
2024
| RequestForgery.go:8:12:8:34 | call to FormValue | RequestForgery.go:11:24:11:65 | ...+... | provenance | Src:MaD:1 |
2125
| tst.go:10:13:10:35 | call to FormValue | tst.go:14:11:14:17 | tainted | provenance | Src:MaD:1 |
2226
| tst.go:10:13:10:35 | call to FormValue | tst.go:18:12:18:18 | tainted | provenance | Src:MaD:1 |
23-
| tst.go:10:13:10:35 | call to FormValue | tst.go:21:34:21:40 | tainted | provenance | Src:MaD:1 |
24-
| tst.go:10:13:10:35 | call to FormValue | tst.go:24:66:24:72 | tainted | provenance | Src:MaD:1 |
25-
| tst.go:10:13:10:35 | call to FormValue | tst.go:27:11:27:29 | ...+... | provenance | Src:MaD:1 |
26-
| tst.go:10:13:10:35 | call to FormValue | tst.go:29:11:29:40 | ...+... | provenance | Src:MaD:1 |
27-
| tst.go:10:13:10:35 | call to FormValue | tst.go:36:11:36:17 | tainted | provenance | Src:MaD:1 |
28-
| tst.go:35:2:35:2 | definition of u [pointer] | tst.go:36:2:36:2 | u [pointer] | provenance | |
29-
| tst.go:36:2:36:2 | implicit dereference | tst.go:35:2:35:2 | definition of u [pointer] | provenance | |
30-
| tst.go:36:2:36:2 | implicit dereference | tst.go:36:2:36:2 | u | provenance | |
31-
| tst.go:36:2:36:2 | implicit dereference | tst.go:37:11:37:11 | u | provenance | |
32-
| tst.go:36:2:36:2 | u | tst.go:36:2:36:2 | implicit dereference | provenance | |
33-
| tst.go:36:2:36:2 | u | tst.go:37:11:37:11 | u | provenance | |
34-
| tst.go:36:2:36:2 | u [pointer] | tst.go:36:2:36:2 | implicit dereference | provenance | |
35-
| tst.go:36:11:36:17 | tainted | tst.go:36:2:36:2 | u | provenance | Config |
36-
| tst.go:36:11:36:17 | tainted | tst.go:37:11:37:11 | u | provenance | Config |
37-
| tst.go:37:11:37:11 | u | tst.go:37:11:37:20 | call to String | provenance | MaD:3 |
27+
| tst.go:10:13:10:35 | call to FormValue | tst.go:20:16:20:22 | tainted | provenance | Src:MaD:1 |
28+
| tst.go:10:13:10:35 | call to FormValue | tst.go:23:35:23:41 | tainted | provenance | Src:MaD:1 |
29+
| tst.go:10:13:10:35 | call to FormValue | tst.go:26:68:26:74 | tainted | provenance | Src:MaD:1 |
30+
| tst.go:10:13:10:35 | call to FormValue | tst.go:29:13:29:19 | tainted | provenance | Src:MaD:1 |
31+
| tst.go:10:13:10:35 | call to FormValue | tst.go:30:14:30:20 | tainted | provenance | Src:MaD:1 |
32+
| tst.go:10:13:10:35 | call to FormValue | tst.go:31:18:31:24 | tainted | provenance | Src:MaD:1 |
33+
| tst.go:10:13:10:35 | call to FormValue | tst.go:33:11:33:29 | ...+... | provenance | Src:MaD:1 |
34+
| tst.go:10:13:10:35 | call to FormValue | tst.go:35:11:35:40 | ...+... | provenance | Src:MaD:1 |
35+
| tst.go:10:13:10:35 | call to FormValue | tst.go:42:11:42:17 | tainted | provenance | Src:MaD:1 |
36+
| tst.go:41:2:41:2 | definition of u [pointer] | tst.go:42:2:42:2 | u [pointer] | provenance | |
37+
| tst.go:42:2:42:2 | implicit dereference | tst.go:41:2:41:2 | definition of u [pointer] | provenance | |
38+
| tst.go:42:2:42:2 | implicit dereference | tst.go:42:2:42:2 | u | provenance | |
39+
| tst.go:42:2:42:2 | implicit dereference | tst.go:43:11:43:11 | u | provenance | |
40+
| tst.go:42:2:42:2 | u | tst.go:42:2:42:2 | implicit dereference | provenance | |
41+
| tst.go:42:2:42:2 | u | tst.go:43:11:43:11 | u | provenance | |
42+
| tst.go:42:2:42:2 | u [pointer] | tst.go:42:2:42:2 | implicit dereference | provenance | |
43+
| tst.go:42:11:42:17 | tainted | tst.go:42:2:42:2 | u | provenance | Config |
44+
| tst.go:42:11:42:17 | tainted | tst.go:43:11:43:11 | u | provenance | Config |
45+
| tst.go:43:11:43:11 | u | tst.go:43:11:43:20 | call to String | provenance | MaD:3 |
3846
| websocket.go:60:21:60:31 | call to Referer | websocket.go:65:27:65:40 | untrustedInput | provenance | Src:MaD:2 |
3947
| websocket.go:74:21:74:31 | call to Referer | websocket.go:78:36:78:49 | untrustedInput | provenance | Src:MaD:2 |
4048
| websocket.go:88:21:88:31 | call to Referer | websocket.go:91:31:91:44 | untrustedInput | provenance | Src:MaD:2 |
@@ -54,17 +62,21 @@ nodes
5462
| tst.go:10:13:10:35 | call to FormValue | semmle.label | call to FormValue |
5563
| tst.go:14:11:14:17 | tainted | semmle.label | tainted |
5664
| tst.go:18:12:18:18 | tainted | semmle.label | tainted |
57-
| tst.go:21:34:21:40 | tainted | semmle.label | tainted |
58-
| tst.go:24:66:24:72 | tainted | semmle.label | tainted |
59-
| tst.go:27:11:27:29 | ...+... | semmle.label | ...+... |
60-
| tst.go:29:11:29:40 | ...+... | semmle.label | ...+... |
61-
| tst.go:35:2:35:2 | definition of u [pointer] | semmle.label | definition of u [pointer] |
62-
| tst.go:36:2:36:2 | implicit dereference | semmle.label | implicit dereference |
63-
| tst.go:36:2:36:2 | u | semmle.label | u |
64-
| tst.go:36:2:36:2 | u [pointer] | semmle.label | u [pointer] |
65-
| tst.go:36:11:36:17 | tainted | semmle.label | tainted |
66-
| tst.go:37:11:37:11 | u | semmle.label | u |
67-
| tst.go:37:11:37:20 | call to String | semmle.label | call to String |
65+
| tst.go:20:16:20:22 | tainted | semmle.label | tainted |
66+
| tst.go:23:35:23:41 | tainted | semmle.label | tainted |
67+
| tst.go:26:68:26:74 | tainted | semmle.label | tainted |
68+
| tst.go:29:13:29:19 | tainted | semmle.label | tainted |
69+
| tst.go:30:14:30:20 | tainted | semmle.label | tainted |
70+
| tst.go:31:18:31:24 | tainted | semmle.label | tainted |
71+
| tst.go:33:11:33:29 | ...+... | semmle.label | ...+... |
72+
| tst.go:35:11:35:40 | ...+... | semmle.label | ...+... |
73+
| tst.go:41:2:41:2 | definition of u [pointer] | semmle.label | definition of u [pointer] |
74+
| tst.go:42:2:42:2 | implicit dereference | semmle.label | implicit dereference |
75+
| tst.go:42:2:42:2 | u | semmle.label | u |
76+
| tst.go:42:2:42:2 | u [pointer] | semmle.label | u [pointer] |
77+
| tst.go:42:11:42:17 | tainted | semmle.label | tainted |
78+
| tst.go:43:11:43:11 | u | semmle.label | u |
79+
| tst.go:43:11:43:20 | call to String | semmle.label | call to String |
6880
| websocket.go:60:21:60:31 | call to Referer | semmle.label | call to Referer |
6981
| websocket.go:65:27:65:40 | untrustedInput | semmle.label | untrustedInput |
7082
| websocket.go:74:21:74:31 | call to Referer | semmle.label | call to Referer |

‎go/ql/test/query-tests/Security/CWE-918/tst.go

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,18 @@ func handler2(w http.ResponseWriter, req *http.Request) {
1717

1818
http.Post(tainted, "text/basic", nil) // $ Alert
1919

20+
http.PostForm(tainted, nil) // $ Alert
21+
2022
client := &http.Client{}
21-
rq, _ := http.NewRequest("GET", tainted, nil) // $ Sink
22-
client.Do(rq) // $ Alert
23+
rq1, _ := http.NewRequest("GET", tainted, nil) // $ Sink
24+
client.Do(rq1) // $ Alert
25+
26+
rq2, _ := http.NewRequestWithContext(context.Background(), "GET", tainted, nil) // $ Sink
27+
client.Do(rq2) // $ Alert
2328

24-
rq, _ = http.NewRequestWithContext(context.Background(), "GET", tainted, nil) // $ Sink
25-
client.Do(rq) // $ Alert
29+
client.Get(tainted) // $ Alert
30+
client.Post(tainted, "text/basic", nil) // $ Alert
31+
client.PostForm(tainted, nil) // $ Alert
2632

2733
http.Get("http://" + tainted) // $ Alert
2834

0 commit comments

Comments
 (0)