Skip to content

Commit f928e4c

Browse files
owen-mcowen-mc
committed
Improve tests
1 parent 4e59ac4 commit f928e4c

File tree

5 files changed

+160
-24
lines changed

5 files changed

+160
-24
lines changed

‎go/ql/test/experimental/CWE-942/CorsGin.go

Lines changed: 90 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,8 @@ import (
88
"github.com/gin-gonic/gin"
99
)
1010

11-
/*
12-
** Function is vulnerable due to AllowAllOrigins = true aka Access-Control-Allow-Origin: null
13-
*/
14-
func vunlnerable() {
11+
// Function is vulnerable due to AllowAllOrigins = true aka Access-Control-Allow-Origin: null
12+
func vulnerable1() {
1513
router := gin.Default()
1614
// CORS for https://foo.com and null
1715
// - PUT and PATCH methods
@@ -25,17 +23,38 @@ func vunlnerable() {
2523
AllowCredentials: true,
2624
MaxAge: 12 * time.Hour,
2725
}
28-
config_vulnerable.AllowOrigins = []string{"null", "https://foo.com"}
26+
config_vulnerable.AllowOrigins = []string{"null", "https://foo.com"} // $ Alert
2927
router.Use(cors.New(config_vulnerable))
3028
router.GET("/", func(c *gin.Context) {
3129
c.String(http.StatusOK, "hello world")
3230
})
3331
router.Run()
3432
}
3533

36-
/*
37-
** Function is safe due to hardcoded origin and AllowCredentials: true
38-
*/
34+
// Function is vulnerable due to AllowAllOrigins = true aka Access-Control-Allow-Origin: null
35+
func vulnerable2() {
36+
router := gin.Default()
37+
// CORS for https://foo.com and null
38+
// - PUT and PATCH methods
39+
// - Origin header
40+
// - Credentials share
41+
// - Preflight requests cached for 12 hours
42+
config_vulnerable := cors.Config{
43+
AllowMethods: []string{"PUT", "PATCH"},
44+
AllowHeaders: []string{"Origin"},
45+
ExposeHeaders: []string{"Content-Length"},
46+
AllowCredentials: true,
47+
AllowOrigins: []string{"null", "https://foo.com"}, // $ Alert
48+
MaxAge: 12 * time.Hour,
49+
}
50+
router.Use(cors.New(config_vulnerable))
51+
router.GET("/", func(c *gin.Context) {
52+
c.String(http.StatusOK, "hello world")
53+
})
54+
router.Run()
55+
}
56+
57+
// Function is safe due to hardcoded origin and AllowCredentials: true
3958
func safe() {
4059
router := gin.Default()
4160
// CORS for https://foo.com origin, allowing:
@@ -58,10 +77,8 @@ func safe() {
5877
router.Run()
5978
}
6079

61-
/*
62-
** Function is safe due to AllowAllOrigins = true aka Access-Control-Allow-Origin: *
63-
*/
64-
func AllowAllTrue() {
80+
// Function is safe due to AllowAllOrigins = true aka Access-Control-Allow-Origin: *
81+
func AllowAllTrue1() {
6582
router := gin.Default()
6683
// CORS for "*" origin, allowing:
6784
// - PUT and PATCH methods
@@ -84,6 +101,30 @@ func AllowAllTrue() {
84101
router.Run()
85102
}
86103

104+
// Function is safe due to AllowAllOrigins = true aka Access-Control-Allow-Origin: *
105+
func AllowAllTrue2() {
106+
router := gin.Default()
107+
// CORS for "*" origin, allowing:
108+
// - PUT and PATCH methods
109+
// - Origin header
110+
// - Credentials share
111+
// - Preflight requests cached for 12 hours
112+
config_allowall := cors.Config{
113+
AllowMethods: []string{"PUT", "PATCH"},
114+
AllowHeaders: []string{"Origin"},
115+
ExposeHeaders: []string{"Content-Length"},
116+
AllowAllOrigins: true,
117+
AllowCredentials: true,
118+
MaxAge: 12 * time.Hour,
119+
}
120+
config_allowall.AllowOrigins = []string{"null"}
121+
router.Use(cors.New(config_allowall))
122+
router.GET("/", func(c *gin.Context) {
123+
c.String(http.StatusOK, "hello world")
124+
})
125+
router.Run()
126+
}
127+
87128
func NoVariableVulnerable() {
88129
router := gin.Default()
89130
// CORS for https://foo.com origin, allowing:
@@ -95,7 +136,7 @@ func NoVariableVulnerable() {
95136
AllowMethods: []string{"GET", "POST"},
96137
AllowHeaders: []string{"Origin"},
97138
ExposeHeaders: []string{"Content-Length"},
98-
AllowOrigins: []string{"null", "https://foo.com"},
139+
AllowOrigins: []string{"null", "https://foo.com"}, // $ Alert
99140
AllowCredentials: true,
100141
MaxAge: 12 * time.Hour,
101142
}))
@@ -104,3 +145,39 @@ func NoVariableVulnerable() {
104145
})
105146
router.Run()
106147
}
148+
149+
var global_config1 = cors.Config{
150+
AllowMethods: []string{"PUT", "PATCH"},
151+
AllowHeaders: []string{"Origin"},
152+
ExposeHeaders: []string{"Content-Length"},
153+
AllowCredentials: true,
154+
AllowOrigins: []string{"null", "https://foo.com"}, // $ Alert
155+
MaxAge: 12 * time.Hour,
156+
}
157+
158+
func vulnerableGlobal1() {
159+
router := gin.Default()
160+
router.Use(cors.New(global_config1))
161+
router.GET("/", func(c *gin.Context) {
162+
c.String(http.StatusOK, "hello world")
163+
})
164+
router.Run()
165+
}
166+
167+
var global_config2 = cors.Config{
168+
AllowMethods: []string{"PUT", "PATCH"},
169+
AllowHeaders: []string{"Origin"},
170+
ExposeHeaders: []string{"Content-Length"},
171+
AllowCredentials: true,
172+
MaxAge: 12 * time.Hour,
173+
}
174+
175+
func vulnerableGlobal2() {
176+
router := gin.Default()
177+
global_config2.AllowOrigins = []string{"null", "https://foo.com"} // $ MISSING: Alert
178+
router.Use(cors.New(global_config2))
179+
router.GET("/", func(c *gin.Context) {
180+
c.String(http.StatusOK, "hello world")
181+
})
182+
router.Run()
183+
}

‎go/ql/test/experimental/CWE-942/CorsMisconfiguration.expected

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
1-
| CorsGin.go:28:35:28:69 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
2-
| CorsGin.go:98:21:98:55 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
1+
| CorsGin.go:26:35:26:69 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
2+
| CorsGin.go:47:21:47:55 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
3+
| CorsGin.go:139:21:139:55 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
4+
| CorsGin.go:154:20:154:54 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
35
| CorsMisconfiguration.go:26:4:26:56 | call to Set | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
46
| CorsMisconfiguration.go:32:4:32:42 | call to Set | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
57
| CorsMisconfiguration.go:53:4:53:44 | call to Set | access-control-allow-origin header is set to a user-defined value, and access-control-allow-credentials is set to `true` |
68
| CorsMisconfiguration.go:60:4:60:56 | call to Set | access-control-allow-origin header is set to a user-defined value, and access-control-allow-credentials is set to `true` |
79
| CorsMisconfiguration.go:67:5:67:57 | call to Set | access-control-allow-origin header is set to a user-defined value, and access-control-allow-credentials is set to `true` |
810
| RsCors.go:11:21:11:59 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
11+
| RsCors.go:31:23:31:61 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |
12+
| RsCors.go:59:20:59:58 | slice literal | access-control-allow-origin header is set to `null`, and access-control-allow-credentials is set to `true` |

‎go/ql/test/experimental/CWE-942/CorsMisconfiguration.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ func main() {
2323
http.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
2424
// BAD: 'null' origin is allowed,
2525
// and Access-Control-Allow-Credentials is set to 'true'.
26-
w.Header().Set("Access-Control-Allow-Origin", "null")
26+
w.Header().Set("Access-Control-Allow-Origin", "null") // $ Alert
2727
w.Header().Set("Access-Control-Allow-Credentials", "true")
2828
})
2929
http.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
3030
// BAD: 'null' origin is allowed,
3131
// and `Access-Control-Allow-Credentials` is set to 'true':
32-
w.Header().Set(HeaderAllowOrigin, Null)
32+
w.Header().Set(HeaderAllowOrigin, Null) // $ Alert
3333
w.Header().Set("Access-Control-Allow-Credentials", "true")
3434
})
3535
http.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
@@ -50,21 +50,21 @@ func main() {
5050
// BAD: the `Access-Control-Allow-Origin` header is set using a user-defined value,
5151
// and `Access-Control-Allow-Credentials` is set to 'true':
5252
origin := req.Header.Get("origin")
53-
w.Header().Set(HeaderAllowOrigin, origin)
53+
w.Header().Set(HeaderAllowOrigin, origin) // $ Alert
5454
w.Header().Set("Access-Control-Allow-Credentials", "true")
5555
})
5656
http.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
5757
// BAD: the `Access-Control-Allow-Origin` header is set using a user-defined value,
5858
// and `Access-Control-Allow-Credentials` is set to 'true':
5959
origin := req.Header.Get("origin")
60-
w.Header().Set("Access-Control-Allow-Origin", origin)
60+
w.Header().Set("Access-Control-Allow-Origin", origin) // $ Alert
6161
w.Header().Set(HeaderAllowCredentials, "true")
6262
})
6363
http.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
6464
// BAD: the `Access-Control-Allow-Origin` header is set using a user-defined value,
6565
// and `Access-Control-Allow-Credentials` is set to 'true':
6666
if origin := req.Header.Get("Origin"); origin != "" {
67-
w.Header().Set("Access-Control-Allow-Origin", origin)
67+
w.Header().Set("Access-Control-Allow-Origin", origin) // $ Alert
6868
}
6969
w.Header().Set(HeaderAllowCredentials, "true")
7070
})

‎go/ql/test/experimental/CWE-942/CorsMisconfiguration.qlref

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
experimental/CWE-942/CorsMisconfiguration.ql
1+
query: experimental/CWE-942/CorsMisconfiguration.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-942/RsCors.go

Lines changed: 57 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ import (
66
"github.com/rs/cors"
77
)
88

9-
func rs_vulnerable() {
9+
func rs_vulnerable1() {
1010
c := cors.New(cors.Options{
11-
AllowedOrigins: []string{"null", "http://foo.com:8080"},
11+
AllowedOrigins: []string{"null", "http://foo.com:8080"}, // $ Alert
1212
AllowCredentials: true,
1313
// Enable Debugging for testing, consider disabling in production
1414
Debug: true,
@@ -22,9 +22,26 @@ func rs_vulnerable() {
2222
http.ListenAndServe(":8080", c.Handler(handler))
2323
}
2424

25+
func rs_vulnerable2() {
26+
opt := cors.Options{
27+
AllowCredentials: true,
28+
// Enable Debugging for testing, consider disabling in production
29+
Debug: true,
30+
}
31+
opt.AllowedOrigins = []string{"null", "http://foo.com:8080"} // $ Alert
32+
c := cors.New(opt)
33+
34+
handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
35+
w.Header().Set("Content-Type", "application/json")
36+
w.Write([]byte("{\"hello\": \"world\"}"))
37+
})
38+
39+
http.ListenAndServe(":8080", c.Handler(handler))
40+
}
41+
2542
func rs_safe() {
2643
c := cors.New(cors.Options{
27-
AllowedOrigins: []string{"http://foo.com:8080"},
44+
AllowedOrigins: []string{"http://foo.com:8080"}, // GOOD
2845
AllowCredentials: true,
2946
// Enable Debugging for testing, consider disabling in production
3047
Debug: true,
@@ -37,3 +54,40 @@ func rs_safe() {
3754

3855
http.ListenAndServe(":8080", c.Handler(handler))
3956
}
57+
58+
var globalCorsOptions1 = cors.Options{
59+
AllowedOrigins: []string{"null", "http://foo.com:8080"}, // $ Alert
60+
AllowCredentials: true,
61+
// Enable Debugging for testing, consider disabling in production
62+
Debug: true,
63+
}
64+
65+
func rs_vulnerable_global1() {
66+
c := cors.New(globalCorsOptions1)
67+
68+
handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
69+
w.Header().Set("Content-Type", "application/json")
70+
w.Write([]byte("{\"hello\": \"world\"}"))
71+
})
72+
73+
http.ListenAndServe(":8080", c.Handler(handler))
74+
75+
}
76+
77+
var globalCorsOptions2 cors.Options
78+
79+
func rs_vulnerable_global2() {
80+
globalCorsOptions2.AllowedOrigins = []string{"null", "http://foo.com:8080"} // $ MISSING: Alert
81+
globalCorsOptions2.AllowCredentials = true
82+
// Enable Debugging for testing, consider disabling in production
83+
globalCorsOptions2.Debug = true
84+
c := cors.New(globalCorsOptions1)
85+
86+
handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
87+
w.Header().Set("Content-Type", "application/json")
88+
w.Write([]byte("{\"hello\": \"world\"}"))
89+
})
90+
91+
http.ListenAndServe(":8080", c.Handler(handler))
92+
93+
}

0 commit comments

Comments
 (0)