1
1
import go
2
2
3
- /**
4
- * The File system access sinks of [fasthttp](https://github.com/valyala/fasthttp) web framework
5
- */
6
- class FastHttpFileSystemAccess extends FileSystemAccess:: Range , DataFlow:: CallNode {
7
- int pathArg ;
8
-
9
- FastHttpFileSystemAccess ( ) {
10
- exists ( Method m |
11
- (
12
- m .hasQualifiedName ( package ( "github.com/valyala/fasthttp" , "" ) , "RequestCtx" ,
13
- [ "SendFileBytes" , "SendFile" ] )
14
- or
15
- m .hasQualifiedName ( package ( "github.com/valyala/fasthttp" , "" ) , "Response" , "SendFile" )
16
- ) and
17
- this = m .getACall ( ) and
18
- pathArg = 0
19
- )
20
- or
21
- exists ( Function f |
22
- f .hasQualifiedName ( package ( "github.com/valyala/fasthttp" , "" ) ,
23
- [
24
- "ServeFile" , "ServeFileUncompressed" , "ServeFileBytes" , "ServeFileBytesUncompressed" ,
25
- "SaveMultipartFile"
26
- ] ) and
27
- this = f .getACall ( ) and
28
- pathArg = 1
29
- )
30
- }
31
-
32
- override DataFlow:: Node getAPathArgument ( ) { result = this .getArgument ( pathArg ) }
33
- }
34
3
35
4
/**
36
5
* The File system access sinks of `net/http` package
@@ -158,12 +127,7 @@ class FiberSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
158
127
override DataFlow:: Node getAPathArgument ( ) { result = this .getArgument ( pathArg ) }
159
128
}
160
129
161
- predicate test ( Function f ) {
162
- f .hasQualifiedName ( "github.com/valyala/fasthttp" ,
163
- [ "WriteReader" , "SafeWriteReader" , "WriteFile" , "ReadFile" , "ReadDir" ] )
164
-
165
- }
166
- string aferoPackage ( ) { result = "github.com/valyala/fasthttp" }
130
+ string aferoPackage ( ) { result = "github.com/spf13/afero" }
167
131
168
132
/**
169
133
* Provide File system access sinks of [afero](https://github.com/spf13/afero) filesystem framework
@@ -175,7 +139,7 @@ class AferoSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
175
139
AferoSystemAccess ( ) {
176
140
// utility functions
177
141
exists ( Function f |
178
- f .hasQualifiedName ( "github.com/valyala/fasthttp" ,
142
+ f .hasQualifiedName ( package ( aferoPackage ( ) , "" ) ,
179
143
[ "WriteReader" , "SafeWriteReader" , "WriteFile" , "ReadFile" , "ReadDir" ] ) and
180
144
this = f .getACall ( ) and
181
145
pathArg = 1
0 commit comments