Skip to content

Commit 307fdc0

Browse files
owen-mcowen-mc
committed
Add tests for heuristic logger calls
1 parent e57d898 commit 307fdc0

File tree

3 files changed

+168
-13
lines changed

3 files changed

+168
-13
lines changed

‎go/ql/test/query-tests/Security/CWE-117/LogInjection.go

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030

3131
func handler(req *http.Request, ctx *goproxy.ProxyCtx) {
3232
username := req.URL.Query()["username"][0]
33+
slice := []any{"username", username}
3334
testFlag := req.URL.Query()["testFlag"][0]
3435

3536
{
@@ -412,8 +413,34 @@ func handler(req *http.Request, ctx *goproxy.ProxyCtx) {
412413
sLogger.Named(username) // $ hasTaintFlow="username"
413414
sLogger.With(username) // $ hasTaintFlow="username"
414415
}
416+
// heuristic logger interface
417+
{
418+
logger.Printf(username) // $ hasTaintFlow="username"
419+
logger.Printf("%s", username) // $ hasTaintFlow="username"
420+
simpleLogger.Tracew(username) // $ hasTaintFlow="username"
421+
simpleLogger.Tracew("%s", username) // $ hasTaintFlow="username"
422+
simpleLogger.Debugw("%s %s", slice...) // $ hasTaintFlow="slice"
423+
}
424+
425+
}
426+
427+
type Logger interface {
428+
Printf(string, ...interface{})
415429
}
416430

431+
type SimpleLogger interface {
432+
Debugw(msg string, keysAndValues ...any)
433+
Infow(msg string, keysAndValues ...any)
434+
Warnw(msg string, keysAndValues ...any)
435+
Errorw(msg string, keysAndValues ...any)
436+
Tracew(msg string, keysAndValues ...any)
437+
}
438+
439+
var (
440+
logger Logger
441+
simpleLogger SimpleLogger
442+
)
443+
417444
// GOOD: The user-provided value is escaped before being written to the log.
418445
func handlerGood(req *http.Request) {
419446
username := req.URL.Query()["username"][0]
@@ -649,5 +676,4 @@ func handlerGood4(req *http.Request, ctx *goproxy.ProxyCtx) {
649676
}
650677
sLogger.Warnf("user %#q logged in.\n", username) // $ hasTaintFlow="username"
651678
}
652-
653679
}

‎go/ql/test/query-tests/Security/CWE-117/go.mod

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,33 @@
11
module main
22

3-
go 1.14
3+
go 1.23
44

55
require (
66
github.com/astaxie/beego v1.12.3
7+
github.com/davecgh/go-spew v1.1.1
78
github.com/elazarl/goproxy v0.0.0-20211114080932-d06c3be7c11b
89
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
9-
github.com/kr/text v0.2.0 // indirect
1010
github.com/sirupsen/logrus v1.8.1
11-
github.com/stretchr/testify v1.6.0 // indirect
12-
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f // indirect
11+
go.uber.org/zap v1.27.0
1312
k8s.io/klog v1.0.0
1413
)
14+
15+
require (
16+
github.com/beorn7/perks v1.0.1 // indirect
17+
github.com/cespare/xxhash/v2 v2.1.1 // indirect
18+
github.com/golang/protobuf v1.4.2 // indirect
19+
github.com/hashicorp/golang-lru v0.5.4 // indirect
20+
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
21+
github.com/prometheus/client_golang v1.7.0 // indirect
22+
github.com/prometheus/client_model v0.2.0 // indirect
23+
github.com/prometheus/common v0.10.0 // indirect
24+
github.com/prometheus/procfs v0.1.3 // indirect
25+
github.com/shiena/ansicolor v0.0.0-20151119151921-a422bbe96644 // indirect
26+
go.uber.org/multierr v1.10.0 // indirect
27+
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 // indirect
28+
golang.org/x/net v0.0.0-20190620200207-3b0461eec859 // indirect
29+
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f // indirect
30+
golang.org/x/text v0.3.0 // indirect
31+
google.golang.org/protobuf v1.23.0 // indirect
32+
gopkg.in/yaml.v2 v2.2.8 // indirect
33+
)

‎go/ql/test/query-tests/Security/CWE-117/vendor/modules.txt

Lines changed: 118 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,134 @@
11
# github.com/astaxie/beego v1.12.3
2-
## explicit
2+
## explicit; go 1.13
33
github.com/astaxie/beego
4+
github.com/astaxie/beego/config
5+
github.com/astaxie/beego/context
6+
github.com/astaxie/beego/context/param
7+
github.com/astaxie/beego/grace
8+
github.com/astaxie/beego/logs
9+
github.com/astaxie/beego/session
10+
github.com/astaxie/beego/toolbox
11+
github.com/astaxie/beego/utils
12+
# github.com/beorn7/perks v1.0.1
13+
## explicit; go 1.11
14+
github.com/beorn7/perks/quantile
15+
# github.com/cespare/xxhash/v2 v2.1.1
16+
## explicit; go 1.11
17+
github.com/cespare/xxhash/v2
18+
# github.com/davecgh/go-spew v1.1.1
19+
## explicit
20+
github.com/davecgh/go-spew/spew
421
# github.com/elazarl/goproxy v0.0.0-20211114080932-d06c3be7c11b
522
## explicit
623
github.com/elazarl/goproxy
724
# github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
825
## explicit
926
github.com/golang/glog
10-
# github.com/kr/text v0.2.0
27+
# github.com/golang/protobuf v1.4.2
28+
## explicit; go 1.9
29+
github.com/golang/protobuf/proto
30+
github.com/golang/protobuf/ptypes
31+
github.com/golang/protobuf/ptypes/any
32+
github.com/golang/protobuf/ptypes/duration
33+
github.com/golang/protobuf/ptypes/timestamp
34+
# github.com/hashicorp/golang-lru v0.5.4
35+
## explicit; go 1.12
36+
github.com/hashicorp/golang-lru
37+
github.com/hashicorp/golang-lru/simplelru
38+
# github.com/matttproud/golang_protobuf_extensions v1.0.1
1139
## explicit
12-
github.com/kr/text
13-
# github.com/sirupsen/logrus v1.8.1
40+
github.com/matttproud/golang_protobuf_extensions/pbutil
41+
# github.com/prometheus/client_golang v1.7.0
42+
## explicit; go 1.11
43+
github.com/prometheus/client_golang/prometheus
44+
github.com/prometheus/client_golang/prometheus/internal
45+
github.com/prometheus/client_golang/prometheus/promhttp
46+
# github.com/prometheus/client_model v0.2.0
47+
## explicit; go 1.9
48+
github.com/prometheus/client_model/go
49+
# github.com/prometheus/common v0.10.0
50+
## explicit; go 1.11
51+
github.com/prometheus/common/expfmt
52+
github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg
53+
github.com/prometheus/common/model
54+
# github.com/prometheus/procfs v0.1.3
55+
## explicit; go 1.12
56+
github.com/prometheus/procfs
57+
github.com/prometheus/procfs/internal/fs
58+
github.com/prometheus/procfs/internal/util
59+
# github.com/shiena/ansicolor v0.0.0-20151119151921-a422bbe96644
1460
## explicit
61+
github.com/shiena/ansicolor
62+
# github.com/sirupsen/logrus v1.8.1
63+
## explicit; go 1.13
1564
github.com/sirupsen/logrus
16-
# github.com/stretchr/testify v1.6.0
65+
# go.uber.org/multierr v1.10.0
66+
## explicit; go 1.19
67+
go.uber.org/multierr
68+
# go.uber.org/zap v1.27.0
69+
## explicit; go 1.19
70+
go.uber.org/zap
71+
go.uber.org/zap/buffer
72+
go.uber.org/zap/internal
73+
go.uber.org/zap/internal/bufferpool
74+
go.uber.org/zap/internal/color
75+
go.uber.org/zap/internal/exit
76+
go.uber.org/zap/internal/pool
77+
go.uber.org/zap/internal/stacktrace
78+
go.uber.org/zap/zapcore
79+
# golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550
1780
## explicit
18-
github.com/stretchr/testify
81+
golang.org/x/crypto/acme
82+
golang.org/x/crypto/acme/autocert
83+
# golang.org/x/net v0.0.0-20190620200207-3b0461eec859
84+
## explicit; go 1.11
85+
golang.org/x/net/idna
1986
# golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f
87+
## explicit; go 1.12
88+
golang.org/x/sys/internal/unsafeheader
89+
golang.org/x/sys/unix
90+
golang.org/x/sys/windows
91+
# golang.org/x/text v0.3.0
2092
## explicit
21-
golang.org/x/sys
22-
# k8s.io/klog v1.0.0
93+
golang.org/x/text/secure/bidirule
94+
golang.org/x/text/transform
95+
golang.org/x/text/unicode/bidi
96+
golang.org/x/text/unicode/norm
97+
# google.golang.org/protobuf v1.23.0
98+
## explicit; go 1.9
99+
google.golang.org/protobuf/encoding/prototext
100+
google.golang.org/protobuf/encoding/protowire
101+
google.golang.org/protobuf/internal/descfmt
102+
google.golang.org/protobuf/internal/descopts
103+
google.golang.org/protobuf/internal/detrand
104+
google.golang.org/protobuf/internal/encoding/defval
105+
google.golang.org/protobuf/internal/encoding/messageset
106+
google.golang.org/protobuf/internal/encoding/tag
107+
google.golang.org/protobuf/internal/encoding/text
108+
google.golang.org/protobuf/internal/errors
109+
google.golang.org/protobuf/internal/fieldnum
110+
google.golang.org/protobuf/internal/fieldsort
111+
google.golang.org/protobuf/internal/filedesc
112+
google.golang.org/protobuf/internal/filetype
113+
google.golang.org/protobuf/internal/flags
114+
google.golang.org/protobuf/internal/genname
115+
google.golang.org/protobuf/internal/impl
116+
google.golang.org/protobuf/internal/mapsort
117+
google.golang.org/protobuf/internal/pragma
118+
google.golang.org/protobuf/internal/set
119+
google.golang.org/protobuf/internal/strs
120+
google.golang.org/protobuf/internal/version
121+
google.golang.org/protobuf/proto
122+
google.golang.org/protobuf/reflect/protoreflect
123+
google.golang.org/protobuf/reflect/protoregistry
124+
google.golang.org/protobuf/runtime/protoiface
125+
google.golang.org/protobuf/runtime/protoimpl
126+
google.golang.org/protobuf/types/known/anypb
127+
google.golang.org/protobuf/types/known/durationpb
128+
google.golang.org/protobuf/types/known/timestamppb
129+
# gopkg.in/yaml.v2 v2.2.8
23130
## explicit
131+
gopkg.in/yaml.v2
132+
# k8s.io/klog v1.0.0
133+
## explicit; go 1.12
24134
k8s.io/klog

0 commit comments

Comments
 (0)