Go: RequestForgery

d10c · d10c · commit f899c3a11556 · 2025-07-07T11:39:54.000+02:00
diff --git a/go/ql/lib/semmle/go/security/RequestForgery.qll b/go/ql/lib/semmle/go/security/RequestForgery.qll
@@ -32,8 +32,12 @@ module RequestForgery {
       )
     }
 
-    predicate observeDiffInformedIncrementalMode() {
-      any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 selects sink.getARequest (/Users/d10c/src/semmle-code/ql/go/ql/src/Security/CWE-918/RequestForgery.ql@25:8:25:14)
+    predicate observeDiffInformedIncrementalMode() { any() }
+
+    Location getASelectedSinkLocation(DataFlow::Node sink) {
+      result = sink.getLocation()
+      or
+      result = sink.(Sink).getARequest().getLocation()
     }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -32,8 +32,12 @@ module RequestForgery {`
`32`	`32`	`)`
`33`	`33`	`}`
`34`	`34`
`35`		`- predicate observeDiffInformedIncrementalMode() {`
`36`		`- any() // TODO: Make sure that the location overrides match the query's select clause: Column 1 selects sink.getARequest (/Users/d10c/src/semmle-code/ql/go/ql/src/Security/CWE-918/RequestForgery.ql@25:8:25:14)`
	`35`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`36`	`+`
	`37`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`38`	`+ result = sink.getLocation()`
	`39`	`+ or`
	`40`	`+ result = sink.(Sink).getARequest().getLocation()`
`37`	`41`	`}`
`38`	`42`	`}`
`39`	`43`