Skip to content

Commit 2921992

Browse files
am0o0am0o0
committed
add inline tests for UntrustedFlowSource, and fix some not necessarily flow sources
1 parent defe964 commit 2921992

File tree

4 files changed

+65
-91
lines changed

4 files changed

+65
-91
lines changed

‎go/ql/lib/semmle/go/frameworks/Fasthttp.qll

Lines changed: 9 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -147,13 +147,6 @@ module Fasthttp {
147147
frn.getARead() = m.getReceiver() and
148148
succ = frn.getARead()
149149
)
150-
or
151-
// CopyTo method copy receiver to first argument
152-
exists(DataFlow::MethodCallNode m |
153-
m.getTarget().hasQualifiedName(packagePath(), "URI", "CopyTo") and
154-
pred = m.getReceiver() and
155-
succ = m.getArgument(1)
156-
)
157150
}
158151
}
159152

@@ -166,9 +159,6 @@ module Fasthttp {
166159
m.hasQualifiedName(packagePath(), "URI",
167160
["Path", "PathOriginal", "LastPathSegment", "FullURI", "QueryString", "String"]) and
168161
this = m.getACall()
169-
or
170-
m.hasQualifiedName(packagePath(), "URI", "WriteTo") and
171-
this = m.getACall().getArgument(0)
172162
)
173163
}
174164
}
@@ -187,9 +177,6 @@ module Fasthttp {
187177
m.hasQualifiedName(packagePath(), "Args",
188178
["Peek", "PeekBytes", "PeekMulti", "PeekMultiBytes", "QueryString", "String"]) and
189179
this = m.getACall()
190-
or
191-
m.hasQualifiedName(packagePath(), "Args", "WriteTo") and
192-
this = m.getACall().getArgument(0)
193180
)
194181
}
195182
}
@@ -373,7 +360,10 @@ module Fasthttp {
373360
exists(DataFlow::MethodCallNode m, DataFlow::Variable frn |
374361
m.getTarget()
375362
.hasQualifiedName(packagePath(), "Request",
376-
["SetRequestURI", "SetRequestURIBytes", "SetURI", "SetHost", "SetHostBytes"]) and
363+
[
364+
"SetRequestURI", "SetRequestURIBytes", "SetURI", "String", "SetHost",
365+
"SetHostBytes"
366+
]) and
377367
pred = m.getArgument(0) and
378368
frn.getARead() = m.getReceiver() and
379369
succ = frn.getARead()
@@ -429,13 +419,6 @@ module Fasthttp {
429419
"BodyStream", "BodyUncompressed"
430420
]) and
431421
this = m.getACall()
432-
or
433-
m.hasQualifiedName(packagePath(), "Request",
434-
[
435-
"BodyWriteTo", "WriteTo", "ReadBody", "ReadLimitBody", "ContinueReadBodyStream",
436-
"ContinueReadBody"
437-
]) and
438-
this = m.getACall().getArgument(0)
439422
)
440423
}
441424
}
@@ -485,7 +468,10 @@ module Fasthttp {
485468
UntrustedFlowSource() {
486469
exists(Method m |
487470
m.hasQualifiedName(packagePath(), "RequestCtx",
488-
["Path", "Referer", "PostBody", "RequestBodyStream", "RequestURI", "UserAgent", "Host"]) and
471+
[
472+
"Path", "Referer", "PostBody", "RequestBodyStream", "RequestURI", "UserAgent", "Host",
473+
"String"
474+
]) and
489475
this = m.getACall()
490476
)
491477
}
@@ -519,12 +505,9 @@ module Fasthttp {
519505
[
520506
"Header", "TrailerHeader", "RequestURI", "Host", "UserAgent", "ContentEncoding",
521507
"ContentType", "Cookie", "CookieBytes", "MultipartFormBoundary", "Peek", "PeekAll",
522-
"PeekBytes", "PeekKeys", "PeekTrailerKeys", "Referer", "RawHeaders"
508+
"PeekBytes", "PeekKeys", "PeekTrailerKeys", "Referer", "RawHeaders", "String"
523509
]) and
524510
this = m.getACall()
525-
or
526-
m.hasQualifiedName(packagePath(), "RequestHeader", "Write") and
527-
this = m.getACall().getArgument(0)
528511
)
529512
}
530513
}

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/UntrustedRemoteFlowSource.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
testFailures
2+
failures

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/UntrustedRemoteFlowSource.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ module FasthttpTest implements TestSig {
99
q.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
1010
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
1111
element = q.toString() and
12-
value = q.toString() and
12+
value = "\"" + q.toString() + "\"" and
1313
tag = "UntrustedFlowSource"
1414
)
1515
}

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/fasthttp.go

Lines changed: 53 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ func fasthttpClient() {
3838
uri.Update("http://httpbin.org/ip") // $ URI=uri
3939
uri.UpdateBytes([]byte("http://httpbin.org/ip")) // $ URI=uri
4040
uri.Parse(nil, []byte("http://httpbin.org/ip")) // $ URI=uri
41-
uri.CopyTo(uri2) // $ URI=uri
4241

4342
req.SetHost("UserControlled.com:80") // $ req=req
4443
req.SetHostBytes([]byte("UserControlled.com:80")) // $ req=req
@@ -94,7 +93,7 @@ func main() {
9493
func fasthttpServer() {
9594
ln, _ := net.Listen("tcp4", "127.0.0.1:8080")
9695
requestHandler := func(requestCtx *fasthttp.RequestCtx) {
97-
filePath := requestCtx.QueryArgs().Peek("filePath") // $ UntrustedFlowSource='call to Peek'
96+
filePath := requestCtx.QueryArgs().Peek("filePath") // $ UntrustedFlowSource="call to Peek"
9897
// File System Access
9998
_ = requestCtx.Response.SendFile(string(filePath)) // $ FileSystemAccess=string(filePath)
10099
requestCtx.SendFile(string(filePath)) // $ FileSystemAccess=string(filePath)
@@ -106,80 +105,70 @@ func fasthttpServer() {
106105
fasthttp.ServeFileBytes(requestCtx, filePath) // $ FileSystemAccess=filePath
107106
fasthttp.ServeFileBytesUncompressed(requestCtx, filePath) // $ FileSystemAccess=filePath
108107

109-
dstWriter := &bufio.Writer{}
110108
dstReader := &bufio.Reader{}
111109
// user controlled methods as source
112110
requestHeader := &fasthttp.RequestHeader{}
113-
requestCtx.Request.Header.CopyTo(requestHeader) // $ UntrustedFlowSource=requestHeader
114-
requestHeader.Write(dstWriter) // $ UntrustedFlowSource=dstWriter
115-
requestHeader.Header() // $ UntrustedFlowSource=Header
116-
requestHeader.TrailerHeader() // $ UntrustedFlowSource=TrailerHeader
117-
requestHeader.String() // $ UntrustedFlowSource=String
118-
requestHeader.RequestURI() // $ UntrustedFlowSource=RequestURI
119-
requestHeader.Host() // $ UntrustedFlowSource=Host
120-
requestHeader.UserAgent() // $ UntrustedFlowSource=UserAgent
121-
requestHeader.ContentEncoding() // $ UntrustedFlowSource=ContentEncoding
122-
requestHeader.ContentType() // $ UntrustedFlowSource=ContentType
123-
requestHeader.Cookie("ACookie") // $ UntrustedFlowSource=Cookie
124-
requestHeader.CookieBytes([]byte("ACookie")) // $ UntrustedFlowSource=CookieBytes
125-
requestHeader.MultipartFormBoundary() // $ UntrustedFlowSource=MultipartFormBoundary
126-
requestHeader.Peek("AHeaderName") // $ UntrustedFlowSource=Peek
127-
requestHeader.PeekAll("AHeaderName") // $ UntrustedFlowSource=PeekAll
128-
requestHeader.PeekBytes([]byte("AHeaderName")) // $ UntrustedFlowSource=PeekBytes
129-
requestHeader.PeekKeys() // $ UntrustedFlowSource=PeekKeys
130-
requestHeader.PeekTrailerKeys() // $ UntrustedFlowSource=PeekTrailerKeys
131-
requestHeader.Referer() // $ UntrustedFlowSource=Referer
132-
requestHeader.RawHeaders() // $ UntrustedFlowSource=RawHeaders
111+
requestHeader.Header() // $ UntrustedFlowSource="call to Header"
112+
requestHeader.TrailerHeader() // $ UntrustedFlowSource="call to TrailerHeader"
113+
requestHeader.String() // $ UntrustedFlowSource="call to String"
114+
requestHeader.RequestURI() // $ UntrustedFlowSource="call to RequestURI"
115+
requestHeader.Host() // $ UntrustedFlowSource="call to Host"
116+
requestHeader.UserAgent() // $ UntrustedFlowSource="call to UserAgent"
117+
requestHeader.ContentEncoding() // $ UntrustedFlowSource="call to ContentEncoding"
118+
requestHeader.ContentType() // $ UntrustedFlowSource="call to ContentType"
119+
requestHeader.Cookie("ACookie") // $ UntrustedFlowSource="call to Cookie"
120+
requestHeader.CookieBytes([]byte("ACookie")) // $ UntrustedFlowSource="call to CookieBytes"
121+
requestHeader.MultipartFormBoundary() // $ UntrustedFlowSource="call to MultipartFormBoundary"
122+
requestHeader.Peek("AHeaderName") // $ UntrustedFlowSource="call to Peek"
123+
requestHeader.PeekAll("AHeaderName") // $ UntrustedFlowSource="call to PeekAll"
124+
requestHeader.PeekBytes([]byte("AHeaderName")) // $ UntrustedFlowSource="call to PeekBytes"
125+
requestHeader.PeekKeys() // $ UntrustedFlowSource="call to PeekKeys"
126+
requestHeader.PeekTrailerKeys() // $ UntrustedFlowSource="call to PeekTrailerKeys"
127+
requestHeader.Referer() // $ UntrustedFlowSource="call to Referer"
128+
requestHeader.RawHeaders() // $ UntrustedFlowSource="call to RawHeaders"
133129
// multipart.Form is already implemented
134130
// requestCtx.MultipartForm()
135-
requestCtx.URI().Path() // $ UntrustedFlowSource=newArgs
136-
requestCtx.URI().PathOriginal() // $ UntrustedFlowSource=newArgs
137-
newURI := &fasthttp.URI{}
138-
requestCtx.URI().CopyTo(newURI) // $ UntrustedFlowSource=CopyTo
139-
requestCtx.URI().FullURI() // $ UntrustedFlowSource=FullURI
140-
requestCtx.URI().LastPathSegment() // $ UntrustedFlowSource=LastPathSegment
141-
requestCtx.URI().QueryString() // $ UntrustedFlowSource=QueryString
142-
requestCtx.URI().String() // $ UntrustedFlowSource=String
143-
requestCtx.URI().WriteTo(dstWriter) // $ UntrustedFlowSource=WriteTo
144-
145-
newArgs := &fasthttp.Args{}
131+
requestCtx.URI().Path() // $ UntrustedFlowSource="call to Path"
132+
requestCtx.URI().PathOriginal() // $ UntrustedFlowSource="call to PathOriginal"
133+
requestCtx.URI().FullURI() // $ UntrustedFlowSource="call to FullURI"
134+
requestCtx.URI().LastPathSegment() // $ UntrustedFlowSource="call to LastPathSegment"
135+
requestCtx.URI().QueryString() // $ UntrustedFlowSource="call to QueryString"
136+
requestCtx.URI().String() // $ UntrustedFlowSource="call to String"
137+
146138
//or requestCtx.PostArgs()
147-
requestCtx.URI().QueryArgs().CopyTo(newArgs) // $ UntrustedFlowSource=newArgs
148-
requestCtx.URI().QueryArgs().Peek("arg1") // $ UntrustedFlowSource=Peek
149-
requestCtx.URI().QueryArgs().PeekBytes([]byte("arg1")) // $ UntrustedFlowSource=PeekBytes
150-
requestCtx.URI().QueryArgs().PeekMulti("arg1") // $ UntrustedFlowSource=PeekMulti
151-
requestCtx.URI().QueryArgs().PeekMultiBytes([]byte("arg1")) // $ UntrustedFlowSource=PeekMultiBytes
152-
requestCtx.URI().QueryArgs().QueryString() // $ UntrustedFlowSource=QueryString
153-
requestCtx.URI().QueryArgs().String() // $ UntrustedFlowSource=String
154-
requestCtx.URI().QueryArgs().WriteTo(dstWriter) // $ UntrustedFlowSource=dstWriter
139+
requestCtx.URI().QueryArgs().Peek("arg1") // $ UntrustedFlowSource="call to Peek"
140+
requestCtx.URI().QueryArgs().PeekBytes([]byte("arg1")) // $ UntrustedFlowSource="call to PeekBytes"
141+
requestCtx.URI().QueryArgs().PeekMulti("arg1") // $ UntrustedFlowSource="call to PeekMulti"
142+
requestCtx.URI().QueryArgs().PeekMultiBytes([]byte("arg1")) // $ UntrustedFlowSource="call to PeekMultiBytes"
143+
requestCtx.URI().QueryArgs().QueryString() // $ UntrustedFlowSource="call to QueryString"
144+
requestCtx.URI().QueryArgs().String() // $ UntrustedFlowSource="call to String"
145+
requestCtx.String() // $ UntrustedFlowSource="call to String"
155146
// not sure what is the best way to write query for following
156147
//requestCtx.URI().QueryArgs().VisitAll(type func(,))
157148

158-
requestCtx.Path()
149+
requestCtx.Path() // $ UntrustedFlowSource="call to Path"
159150
// multipart.Form is already implemented
160151
// requestCtx.FormFile("FileName")
161152
// requestCtx.FormValue("ValueName")
162-
requestCtx.Referer() // $ UntrustedFlowSource=Referer
163-
requestCtx.PostBody() // $ UntrustedFlowSource=PostBody
164-
requestCtx.RequestBodyStream() // $ UntrustedFlowSource=RequestBodyStream
165-
requestCtx.RequestURI() // $ UntrustedFlowSource=RequestURI
166-
requestCtx.UserAgent() // $ UntrustedFlowSource=UserAgent
167-
requestCtx.Host() // $ UntrustedFlowSource=Host
168-
169-
requestCtx.Request.Host() // $ UntrustedFlowSource=Host
170-
requestCtx.Request.Body() // $ UntrustedFlowSource=Body
171-
requestCtx.Request.RequestURI() // $ UntrustedFlowSource=RequestURI
172-
requestCtx.Request.BodyGunzip() // $ UntrustedFlowSource=BodyGunzip
173-
requestCtx.Request.BodyInflate() // $ UntrustedFlowSource=BodyInflate
174-
requestCtx.Request.BodyUnbrotli() // $ UntrustedFlowSource=BodyUnbrotli
175-
requestCtx.Request.BodyStream() // $ UntrustedFlowSource=BodyStream
176-
requestCtx.Request.BodyWriteTo(dstWriter) // $ UntrustedFlowSource=dstWriter
177-
requestCtx.Request.WriteTo(dstWriter) // $ UntrustedFlowSource=dstWriter
178-
requestCtx.Request.BodyUncompressed() // $ UntrustedFlowSource=BodyUncompressed
179-
requestCtx.Request.ReadBody(dstReader, 100, 1000) // $ UntrustedFlowSource=dstReader
180-
requestCtx.Request.ReadLimitBody(dstReader, 100) // $ UntrustedFlowSource=dstReader
181-
requestCtx.Request.ContinueReadBodyStream(dstReader, 100, true) // $ UntrustedFlowSource=dstReader
182-
requestCtx.Request.ContinueReadBody(dstReader, 100) // $ UntrustedFlowSource=dstReader
153+
requestCtx.Referer() // $ UntrustedFlowSource="call to Referer"
154+
requestCtx.PostBody() // $ UntrustedFlowSource="call to PostBody"
155+
requestCtx.RequestBodyStream() // $ UntrustedFlowSource="call to RequestBodyStream"
156+
requestCtx.RequestURI() // $ UntrustedFlowSource="call to RequestURI"
157+
requestCtx.UserAgent() // $ UntrustedFlowSource="call to UserAgent"
158+
requestCtx.Host() // $ UntrustedFlowSource="call to Host"
159+
160+
requestCtx.Request.Host() // $ UntrustedFlowSource="call to Host"
161+
requestCtx.Request.Body() // $ UntrustedFlowSource="call to Body"
162+
requestCtx.Request.RequestURI() // $ UntrustedFlowSource="call to RequestURI"
163+
requestCtx.Request.BodyGunzip() // $ UntrustedFlowSource="call to BodyGunzip"
164+
requestCtx.Request.BodyInflate() // $ UntrustedFlowSource="call to BodyInflate"
165+
requestCtx.Request.BodyUnbrotli() // $ UntrustedFlowSource="call to BodyUnbrotli"
166+
requestCtx.Request.BodyStream() // $ UntrustedFlowSource="call to BodyStream"
167+
requestCtx.Request.BodyUncompressed() // $ UntrustedFlowSource="call to BodyUncompressed"
168+
requestCtx.Request.ReadBody(dstReader, 100, 1000)
169+
requestCtx.Request.ReadLimitBody(dstReader, 100)
170+
requestCtx.Request.ContinueReadBodyStream(dstReader, 100, true)
171+
requestCtx.Request.ContinueReadBody(dstReader, 100)
183172
// not sure what is the best way to write query for following
184173
//requestCtx.Request.Header.VisitAllCookie()
185174

0 commit comments

Comments
 (0)