Skip to content

Commit 6bc0ffe

Browse files
owen-mcowen-mc
committed
Convert BeegoInputSource to MaD
1 parent 2bbd9ab commit 6bc0ffe

File tree

2 files changed

+45
-24
lines changed

2 files changed

+45
-24
lines changed

‎go/ql/lib/ext/github.com.astaxie.beego.context.model.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,48 @@ extensions:
55
data:
66
- ["github.com/astaxie/beego/context", "", False, "WriteBody", "", "", "Argument[2]", "Argument[1]", "taint", "manual"]
77
- ["github.com/beego/beego/server/web/context", "", False, "WriteBody", "", "", "Argument[2]", "Argument[1]", "taint", "manual"]
8+
- addsTo:
9+
pack: codeql/go-all
10+
extensible: sourceModel
11+
data:
12+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
13+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
14+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Data", "", "", "ReturnValue[0]", "remote", "manual"]
15+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "GetData", "", "", "ReturnValue[0]", "remote", "manual"]
16+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Header", "", "", "ReturnValue[0]", "remote", "manual"]
17+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Param", "", "", "ReturnValue[0]", "remote", "manual"]
18+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Params", "", "", "ReturnValue[0]", "remote", "manual"]
19+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Query", "", "", "ReturnValue[0]", "remote", "manual"]
20+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Refer", "", "", "ReturnValue[0]", "remote", "manual"]
21+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Referer", "", "", "ReturnValue[0]", "remote", "manual"]
22+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "URI", "", "", "ReturnValue[0]", "remote", "manual"]
23+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "URL", "", "", "ReturnValue[0]", "remote", "manual"]
24+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "UserAgent", "", "", "ReturnValue[0]", "remote", "manual"]
25+
26+
- ["github.com/beego/beego/context", "BeegoInput", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
27+
- ["github.com/beego/beego/context", "BeegoInput", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
28+
- ["github.com/beego/beego/context", "BeegoInput", True, "Data", "", "", "ReturnValue[0]", "remote", "manual"]
29+
- ["github.com/beego/beego/context", "BeegoInput", True, "GetData", "", "", "ReturnValue[0]", "remote", "manual"]
30+
- ["github.com/beego/beego/context", "BeegoInput", True, "Header", "", "", "ReturnValue[0]", "remote", "manual"]
31+
- ["github.com/beego/beego/context", "BeegoInput", True, "Param", "", "", "ReturnValue[0]", "remote", "manual"]
32+
- ["github.com/beego/beego/context", "BeegoInput", True, "Params", "", "", "ReturnValue[0]", "remote", "manual"]
33+
- ["github.com/beego/beego/context", "BeegoInput", True, "Query", "", "", "ReturnValue[0]", "remote", "manual"]
34+
- ["github.com/beego/beego/context", "BeegoInput", True, "Refer", "", "", "ReturnValue[0]", "remote", "manual"]
35+
- ["github.com/beego/beego/context", "BeegoInput", True, "Referer", "", "", "ReturnValue[0]", "remote", "manual"]
36+
- ["github.com/beego/beego/context", "BeegoInput", True, "URI", "", "", "ReturnValue[0]", "remote", "manual"]
37+
- ["github.com/beego/beego/context", "BeegoInput", True, "URL", "", "", "ReturnValue[0]", "remote", "manual"]
38+
- ["github.com/beego/beego/context", "BeegoInput", True, "UserAgent", "", "", "ReturnValue[0]", "remote", "manual"]
39+
40+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
41+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
42+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Data", "", "", "ReturnValue[0]", "remote", "manual"]
43+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "GetData", "", "", "ReturnValue[0]", "remote", "manual"]
44+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Header", "", "", "ReturnValue[0]", "remote", "manual"]
45+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Param", "", "", "ReturnValue[0]", "remote", "manual"]
46+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Params", "", "", "ReturnValue[0]", "remote", "manual"]
47+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Query", "", "", "ReturnValue[0]", "remote", "manual"]
48+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Refer", "", "", "ReturnValue[0]", "remote", "manual"]
49+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Referer", "", "", "ReturnValue[0]", "remote", "manual"]
50+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "URI", "", "", "ReturnValue[0]", "remote", "manual"]
51+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "URL", "", "", "ReturnValue[0]", "remote", "manual"]
52+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "UserAgent", "", "", "ReturnValue[0]", "remote", "manual"]

‎go/ql/lib/semmle/go/frameworks/Beego.qll

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -47,30 +47,6 @@ module Beego {
4747
result = package(v2modulePath(), "core/utils")
4848
}
4949

50-
/**
51-
* `BeegoInput` sources of untrusted data.
52-
*/
53-
private class BeegoInputSource extends RemoteFlowSource::Range {
54-
string methodName;
55-
56-
BeegoInputSource() {
57-
exists(FunctionOutput output |
58-
methodName = "Bind" and
59-
output.isParameter(0)
60-
or
61-
methodName in [
62-
"Cookie", "Data", "GetData", "Header", "Param", "Params", "Query", "Refer", "Referer",
63-
"URI", "URL", "UserAgent"
64-
] and
65-
output.isResult(0)
66-
|
67-
exists(DataFlow::MethodCallNode c | this = output.getExitNode(c) |
68-
c.getTarget().hasQualifiedName(contextPackagePath(), "BeegoInput", methodName)
69-
)
70-
)
71-
}
72-
}
73-
7450
/** `BeegoInput` sources that are safe to use for redirection. */
7551
private class BeegoInputSafeUrlSource extends SafeUrlFlow::Source {
7652
BeegoInputSafeUrlSource() {

0 commit comments

Comments
 (0)