Skip to content

Commit 7bfa4c1

Browse files
owen-mcowen-mc
committed
Convert GoRestfulSource to MaD
1 parent 0fb27fb commit 7bfa4c1

File tree

3 files changed

+21
-30
lines changed

3 files changed

+21
-30
lines changed

‎go/ql/lib/ext/github.com.emicklei.go-restful.model.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: sourceModel
5+
data:
6+
- ["github.com/emicklei/go-restful", "Request", True, "QueryParameters", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .ArrayElement
7+
- ["github.com/emicklei/go-restful", "Request", True, "QueryParameter", "", "", "ReturnValue", "remote", "manual"]
8+
- ["github.com/emicklei/go-restful", "Request", True, "BodyParameter", "", "", "ReturnValue[0]", "remote", "manual"]
9+
- ["github.com/emicklei/go-restful", "Request", True, "HeaderParameter", "", "", "ReturnValue", "remote", "manual"]
10+
- ["github.com/emicklei/go-restful", "Request", True, "PathParameter", "", "", "ReturnValue", "remote", "manual"]
11+
- ["github.com/emicklei/go-restful", "Request", True, "PathParameters", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .MapValue

‎go/ql/lib/semmle/go/frameworks/GoRestfulHttp.qll

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,6 @@ private module GoRestfulHttp {
1111
/** Gets the package name `github.com/emicklei/go-restful`. */
1212
string packagePath() { result = package("github.com/emicklei/go-restful", "") }
1313

14-
/**
15-
* A model for methods defined on go-restful's `Request` object that may return user-controlled data.
16-
*/
17-
private class GoRestfulSourceMethod extends Method {
18-
GoRestfulSourceMethod() {
19-
this.hasQualifiedName(packagePath(), "Request",
20-
[
21-
"QueryParameters", "QueryParameter", "BodyParameter", "HeaderParameter", "PathParameter",
22-
"PathParameters"
23-
])
24-
}
25-
}
26-
27-
/**
28-
* A model of go-restful's `Request` object as a source of user-controlled data.
29-
*/
30-
private class GoRestfulSource extends RemoteFlowSource::Range {
31-
GoRestfulSource() { this = any(GoRestfulSourceMethod g).getACall() }
32-
}
33-
3414
/**
3515
* A model of go-restful's `Request.ReadEntity` method as a source of user-controlled data.
3616
*/

‎go/ql/test/library-tests/semmle/go/frameworks/Gorestful/gorestful.expected

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
invalidModelRow
22
edges
3-
| gorestful.go:15:15:15:44 | call to QueryParameters | gorestful.go:15:15:15:47 | index expression | provenance | |
4-
| gorestful.go:17:12:17:39 | call to BodyParameter | gorestful.go:18:15:18:17 | val | provenance | |
5-
| gorestful.go:21:15:21:38 | call to PathParameters | gorestful.go:21:15:21:45 | index expression | provenance | |
3+
| gorestful.go:15:15:15:44 | call to QueryParameters | gorestful.go:15:15:15:47 | index expression | provenance | Src:MaD:316 |
4+
| gorestful.go:17:2:17:39 | ... := ...[0] | gorestful.go:18:15:18:17 | val | provenance | Src:MaD:318 |
5+
| gorestful.go:21:15:21:38 | call to PathParameters | gorestful.go:21:15:21:45 | index expression | provenance | Src:MaD:321 |
66
| gorestful.go:23:21:23:24 | &... | gorestful.go:24:15:24:21 | selection of cmd | provenance | |
7-
| gorestful_v2.go:15:15:15:44 | call to QueryParameters | gorestful_v2.go:15:15:15:47 | index expression | provenance | |
8-
| gorestful_v2.go:17:12:17:39 | call to BodyParameter | gorestful_v2.go:18:15:18:17 | val | provenance | |
9-
| gorestful_v2.go:21:15:21:38 | call to PathParameters | gorestful_v2.go:21:15:21:45 | index expression | provenance | |
7+
| gorestful_v2.go:15:15:15:44 | call to QueryParameters | gorestful_v2.go:15:15:15:47 | index expression | provenance | Src:MaD:316 |
8+
| gorestful_v2.go:17:2:17:39 | ... := ...[0] | gorestful_v2.go:18:15:18:17 | val | provenance | Src:MaD:318 |
9+
| gorestful_v2.go:21:15:21:38 | call to PathParameters | gorestful_v2.go:21:15:21:45 | index expression | provenance | Src:MaD:321 |
1010
| gorestful_v2.go:23:21:23:24 | &... | gorestful_v2.go:24:15:24:21 | selection of cmd | provenance | |
1111
nodes
1212
| gorestful.go:15:15:15:44 | call to QueryParameters | semmle.label | call to QueryParameters |
1313
| gorestful.go:15:15:15:47 | index expression | semmle.label | index expression |
1414
| gorestful.go:16:15:16:43 | call to QueryParameter | semmle.label | call to QueryParameter |
15-
| gorestful.go:17:12:17:39 | call to BodyParameter | semmle.label | call to BodyParameter |
15+
| gorestful.go:17:2:17:39 | ... := ...[0] | semmle.label | ... := ...[0] |
1616
| gorestful.go:18:15:18:17 | val | semmle.label | val |
1717
| gorestful.go:19:15:19:44 | call to HeaderParameter | semmle.label | call to HeaderParameter |
1818
| gorestful.go:20:15:20:42 | call to PathParameter | semmle.label | call to PathParameter |
@@ -23,7 +23,7 @@ nodes
2323
| gorestful_v2.go:15:15:15:44 | call to QueryParameters | semmle.label | call to QueryParameters |
2424
| gorestful_v2.go:15:15:15:47 | index expression | semmle.label | index expression |
2525
| gorestful_v2.go:16:15:16:43 | call to QueryParameter | semmle.label | call to QueryParameter |
26-
| gorestful_v2.go:17:12:17:39 | call to BodyParameter | semmle.label | call to BodyParameter |
26+
| gorestful_v2.go:17:2:17:39 | ... := ...[0] | semmle.label | ... := ...[0] |
2727
| gorestful_v2.go:18:15:18:17 | val | semmle.label | val |
2828
| gorestful_v2.go:19:15:19:44 | call to HeaderParameter | semmle.label | call to HeaderParameter |
2929
| gorestful_v2.go:20:15:20:42 | call to PathParameter | semmle.label | call to PathParameter |
@@ -35,14 +35,14 @@ subpaths
3535
#select
3636
| gorestful.go:15:15:15:47 | index expression | gorestful.go:15:15:15:44 | call to QueryParameters | gorestful.go:15:15:15:47 | index expression | This command depends on $@. | gorestful.go:15:15:15:44 | call to QueryParameters | a user-provided value |
3737
| gorestful.go:16:15:16:43 | call to QueryParameter | gorestful.go:16:15:16:43 | call to QueryParameter | gorestful.go:16:15:16:43 | call to QueryParameter | This command depends on $@. | gorestful.go:16:15:16:43 | call to QueryParameter | a user-provided value |
38-
| gorestful.go:18:15:18:17 | val | gorestful.go:17:12:17:39 | call to BodyParameter | gorestful.go:18:15:18:17 | val | This command depends on $@. | gorestful.go:17:12:17:39 | call to BodyParameter | a user-provided value |
38+
| gorestful.go:18:15:18:17 | val | gorestful.go:17:2:17:39 | ... := ...[0] | gorestful.go:18:15:18:17 | val | This command depends on $@. | gorestful.go:17:2:17:39 | ... := ...[0] | a user-provided value |
3939
| gorestful.go:19:15:19:44 | call to HeaderParameter | gorestful.go:19:15:19:44 | call to HeaderParameter | gorestful.go:19:15:19:44 | call to HeaderParameter | This command depends on $@. | gorestful.go:19:15:19:44 | call to HeaderParameter | a user-provided value |
4040
| gorestful.go:20:15:20:42 | call to PathParameter | gorestful.go:20:15:20:42 | call to PathParameter | gorestful.go:20:15:20:42 | call to PathParameter | This command depends on $@. | gorestful.go:20:15:20:42 | call to PathParameter | a user-provided value |
4141
| gorestful.go:21:15:21:45 | index expression | gorestful.go:21:15:21:38 | call to PathParameters | gorestful.go:21:15:21:45 | index expression | This command depends on $@. | gorestful.go:21:15:21:38 | call to PathParameters | a user-provided value |
4242
| gorestful.go:24:15:24:21 | selection of cmd | gorestful.go:23:21:23:24 | &... | gorestful.go:24:15:24:21 | selection of cmd | This command depends on $@. | gorestful.go:23:21:23:24 | &... | a user-provided value |
4343
| gorestful_v2.go:15:15:15:47 | index expression | gorestful_v2.go:15:15:15:44 | call to QueryParameters | gorestful_v2.go:15:15:15:47 | index expression | This command depends on $@. | gorestful_v2.go:15:15:15:44 | call to QueryParameters | a user-provided value |
4444
| gorestful_v2.go:16:15:16:43 | call to QueryParameter | gorestful_v2.go:16:15:16:43 | call to QueryParameter | gorestful_v2.go:16:15:16:43 | call to QueryParameter | This command depends on $@. | gorestful_v2.go:16:15:16:43 | call to QueryParameter | a user-provided value |
45-
| gorestful_v2.go:18:15:18:17 | val | gorestful_v2.go:17:12:17:39 | call to BodyParameter | gorestful_v2.go:18:15:18:17 | val | This command depends on $@. | gorestful_v2.go:17:12:17:39 | call to BodyParameter | a user-provided value |
45+
| gorestful_v2.go:18:15:18:17 | val | gorestful_v2.go:17:2:17:39 | ... := ...[0] | gorestful_v2.go:18:15:18:17 | val | This command depends on $@. | gorestful_v2.go:17:2:17:39 | ... := ...[0] | a user-provided value |
4646
| gorestful_v2.go:19:15:19:44 | call to HeaderParameter | gorestful_v2.go:19:15:19:44 | call to HeaderParameter | gorestful_v2.go:19:15:19:44 | call to HeaderParameter | This command depends on $@. | gorestful_v2.go:19:15:19:44 | call to HeaderParameter | a user-provided value |
4747
| gorestful_v2.go:20:15:20:42 | call to PathParameter | gorestful_v2.go:20:15:20:42 | call to PathParameter | gorestful_v2.go:20:15:20:42 | call to PathParameter | This command depends on $@. | gorestful_v2.go:20:15:20:42 | call to PathParameter | a user-provided value |
4848
| gorestful_v2.go:21:15:21:45 | index expression | gorestful_v2.go:21:15:21:38 | call to PathParameters | gorestful_v2.go:21:15:21:45 | index expression | This command depends on $@. | gorestful_v2.go:21:15:21:38 | call to PathParameters | a user-provided value |

0 commit comments

Comments
 (0)