Skip to content

Commit c7ad0ad

Browse files
owen-mcowen-mc
authored
Merge pull request github#16809 from owen-mc/go/mad-sources-beego
Go: Convert Beego sources to MaD
2 parents 25b2018 + 801edda commit c7ad0ad

40 files changed

+392
-380
lines changed

‎go/ql/lib/ext/github.com.astaxie.beego.context.model.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,54 @@ extensions:
55
data:
66
- ["github.com/astaxie/beego/context", "", False, "WriteBody", "", "", "Argument[2]", "Argument[1]", "taint", "manual"]
77
- ["github.com/beego/beego/server/web/context", "", False, "WriteBody", "", "", "Argument[2]", "Argument[1]", "taint", "manual"]
8+
- addsTo:
9+
pack: codeql/go-all
10+
extensible: sourceModel
11+
data:
12+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
13+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
14+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Data", "", "", "ReturnValue[0]", "remote", "manual"]
15+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "GetData", "", "", "ReturnValue[0]", "remote", "manual"]
16+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Header", "", "", "ReturnValue[0]", "remote", "manual"]
17+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Param", "", "", "ReturnValue[0]", "remote", "manual"]
18+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Params", "", "", "ReturnValue[0]", "remote", "manual"]
19+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Query", "", "", "ReturnValue[0]", "remote", "manual"]
20+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Refer", "", "", "ReturnValue[0]", "remote", "manual"]
21+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "Referer", "", "", "ReturnValue[0]", "remote", "manual"]
22+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "RequestBody", "", "", "", "remote", "manual"]
23+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "URI", "", "", "ReturnValue[0]", "remote", "manual"]
24+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "URL", "", "", "ReturnValue[0]", "remote", "manual"]
25+
- ["github.com/astaxie/beego/context", "BeegoInput", True, "UserAgent", "", "", "ReturnValue[0]", "remote", "manual"]
26+
- ["github.com/astaxie/beego/context", "Context", True, "GetCookie", "", "", "ReturnValue", "remote", "manual"]
27+
28+
- ["github.com/beego/beego/context", "BeegoInput", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
29+
- ["github.com/beego/beego/context", "BeegoInput", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
30+
- ["github.com/beego/beego/context", "BeegoInput", True, "Data", "", "", "ReturnValue[0]", "remote", "manual"]
31+
- ["github.com/beego/beego/context", "BeegoInput", True, "GetData", "", "", "ReturnValue[0]", "remote", "manual"]
32+
- ["github.com/beego/beego/context", "BeegoInput", True, "Header", "", "", "ReturnValue[0]", "remote", "manual"]
33+
- ["github.com/beego/beego/context", "BeegoInput", True, "Param", "", "", "ReturnValue[0]", "remote", "manual"]
34+
- ["github.com/beego/beego/context", "BeegoInput", True, "Params", "", "", "ReturnValue[0]", "remote", "manual"]
35+
- ["github.com/beego/beego/context", "BeegoInput", True, "Query", "", "", "ReturnValue[0]", "remote", "manual"]
36+
- ["github.com/beego/beego/context", "BeegoInput", True, "Refer", "", "", "ReturnValue[0]", "remote", "manual"]
37+
- ["github.com/beego/beego/context", "BeegoInput", True, "Referer", "", "", "ReturnValue[0]", "remote", "manual"]
38+
- ["github.com/beego/beego/context", "BeegoInput", True, "RequestBody", "", "", "", "remote", "manual"]
39+
- ["github.com/beego/beego/context", "BeegoInput", True, "URI", "", "", "ReturnValue[0]", "remote", "manual"]
40+
- ["github.com/beego/beego/context", "BeegoInput", True, "URL", "", "", "ReturnValue[0]", "remote", "manual"]
41+
- ["github.com/beego/beego/context", "BeegoInput", True, "UserAgent", "", "", "ReturnValue[0]", "remote", "manual"]
42+
- ["github.com/beego/beego/context", "Context", True, "GetCookie", "", "", "ReturnValue", "remote", "manual"]
43+
44+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Bind", "", "", "Argument[0]", "remote", "manual"]
45+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
46+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Data", "", "", "ReturnValue[0]", "remote", "manual"]
47+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "GetData", "", "", "ReturnValue[0]", "remote", "manual"]
48+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Header", "", "", "ReturnValue[0]", "remote", "manual"]
49+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Param", "", "", "ReturnValue[0]", "remote", "manual"]
50+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Params", "", "", "ReturnValue[0]", "remote", "manual"]
51+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Query", "", "", "ReturnValue[0]", "remote", "manual"]
52+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Refer", "", "", "ReturnValue[0]", "remote", "manual"]
53+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "Referer", "", "", "ReturnValue[0]", "remote", "manual"]
54+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "RequestBody", "", "", "", "remote", "manual"]
55+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "URI", "", "", "ReturnValue[0]", "remote", "manual"]
56+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "URL", "", "", "ReturnValue[0]", "remote", "manual"]
57+
- ["github.com/beego/beego/server/web/context", "BeegoInput", True, "UserAgent", "", "", "ReturnValue[0]", "remote", "manual"]
58+
- ["github.com/beego/beego/server/web/context", "Context", True, "GetCookie", "", "", "ReturnValue", "remote", "manual"]

‎go/ql/lib/ext/github.com.astaxie.beego.model.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,39 @@ extensions:
1010
- ["github.com/astaxie/beego", "", False, "ParseForm", "", "", "Argument[0]", "Argument[1]", "taint", "manual"]
1111
- ["github.com/astaxie/beego", "", False, "Str2html", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1212
- ["github.com/astaxie/beego", "", False, "Substr", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
13+
- ["github.com/beego/beego", "", False, "HTML2str", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
14+
- ["github.com/beego/beego", "", False, "Htmlquote", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
15+
- ["github.com/beego/beego", "", False, "Htmlunquote", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
16+
- ["github.com/beego/beego", "", False, "MapGet", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
17+
- ["github.com/beego/beego", "", False, "ParseForm", "", "", "Argument[0]", "Argument[1]", "taint", "manual"]
18+
- ["github.com/beego/beego", "", False, "Str2html", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
19+
- ["github.com/beego/beego", "", False, "Substr", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1320
- ["github.com/beego/beego/server/web", "", False, "HTML2str", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1421
- ["github.com/beego/beego/server/web", "", False, "Htmlquote", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1522
- ["github.com/beego/beego/server/web", "", False, "Htmlunquote", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1623
- ["github.com/beego/beego/server/web", "", False, "MapGet", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
1724
- ["github.com/beego/beego/server/web", "", False, "ParseForm", "", "", "Argument[0]", "Argument[1]", "taint", "manual"]
1825
- ["github.com/beego/beego/server/web", "", False, "Str2html", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
1926
- ["github.com/beego/beego/server/web", "", False, "Substr", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
27+
- addsTo:
28+
pack: codeql/go-all
29+
extensible: sourceModel
30+
data:
31+
- ["github.com/astaxie/beego", "Controller", True, "ParseForm", "", "", "Argument[0]", "remote", "manual"]
32+
- ["github.com/astaxie/beego", "Controller", True, "GetFile", "", "", "ReturnValue[0..1]", "remote", "manual"]
33+
- ["github.com/astaxie/beego", "Controller", True, "GetFiles", "", "", "ReturnValue[0]", "remote", "manual"]
34+
- ["github.com/astaxie/beego", "Controller", True, "GetString", "", "", "ReturnValue[0]", "remote", "manual"]
35+
- ["github.com/astaxie/beego", "Controller", True, "GetStrings", "", "", "ReturnValue[0]", "remote", "manual"]
36+
- ["github.com/astaxie/beego", "Controller", True, "Input", "", "", "ReturnValue[0]", "remote", "manual"]
37+
- ["github.com/beego/beego", "Controller", True, "ParseForm", "", "", "Argument[0]", "remote", "manual"]
38+
- ["github.com/beego/beego", "Controller", True, "GetFile", "", "", "ReturnValue[0..1]", "remote", "manual"]
39+
- ["github.com/beego/beego", "Controller", True, "GetFiles", "", "", "ReturnValue[0]", "remote", "manual"]
40+
- ["github.com/beego/beego", "Controller", True, "GetString", "", "", "ReturnValue[0]", "remote", "manual"]
41+
- ["github.com/beego/beego", "Controller", True, "GetStrings", "", "", "ReturnValue[0]", "remote", "manual"]
42+
- ["github.com/beego/beego", "Controller", True, "Input", "", "", "ReturnValue[0]", "remote", "manual"]
43+
- ["github.com/beego/beego/server/web", "Controller", True, "ParseForm", "", "", "Argument[0]", "remote", "manual"]
44+
- ["github.com/beego/beego/server/web", "Controller", True, "GetFile", "", "", "ReturnValue[0..1]", "remote", "manual"]
45+
- ["github.com/beego/beego/server/web", "Controller", True, "GetFiles", "", "", "ReturnValue[0]", "remote", "manual"]
46+
- ["github.com/beego/beego/server/web", "Controller", True, "GetString", "", "", "ReturnValue[0]", "remote", "manual"]
47+
- ["github.com/beego/beego/server/web", "Controller", True, "GetStrings", "", "", "ReturnValue[0]", "remote", "manual"]
48+
- ["github.com/beego/beego/server/web", "Controller", True, "Input", "", "", "ReturnValue[0]", "remote", "manual"]

‎go/ql/lib/semmle/go/frameworks/Beego.qll

Lines changed: 3 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -47,79 +47,11 @@ module Beego {
4747
result = package(v2modulePath(), "core/utils")
4848
}
4949

50-
/**
51-
* `BeegoInput` sources of untrusted data.
52-
*/
53-
private class BeegoInputSource extends RemoteFlowSource::Range {
54-
string methodName;
55-
56-
BeegoInputSource() {
57-
exists(FunctionOutput output |
58-
methodName = "Bind" and
59-
output.isParameter(0)
60-
or
61-
methodName in [
62-
"Cookie", "Data", "GetData", "Header", "Param", "Params", "Query", "Refer", "Referer",
63-
"URI", "URL", "UserAgent"
64-
] and
65-
output.isResult(0)
66-
|
67-
exists(DataFlow::MethodCallNode c | this = output.getExitNode(c) |
68-
c.getTarget().hasQualifiedName(contextPackagePath(), "BeegoInput", methodName)
69-
)
70-
)
71-
}
72-
73-
predicate isSafeUrlSource() { methodName in ["URI", "URL"] }
74-
}
75-
7650
/** `BeegoInput` sources that are safe to use for redirection. */
7751
private class BeegoInputSafeUrlSource extends SafeUrlFlow::Source {
78-
BeegoInputSafeUrlSource() { this.(BeegoInputSource).isSafeUrlSource() }
79-
}
80-
81-
/**
82-
* `beego.Controller` sources of untrusted data.
83-
*/
84-
private class BeegoControllerSource extends RemoteFlowSource::Range {
85-
BeegoControllerSource() {
86-
exists(string methodName, FunctionOutput output |
87-
methodName = "ParseForm" and
88-
output.isParameter(0)
89-
or
90-
methodName in ["GetFile", "GetFiles", "GetString", "GetStrings", "Input"] and
91-
output.isResult(0)
92-
or
93-
methodName = "GetFile" and
94-
output.isResult(1)
95-
|
96-
exists(DataFlow::MethodCallNode c |
97-
c.getTarget().hasQualifiedName(packagePath(), "Controller", methodName)
98-
|
99-
this = output.getExitNode(c)
100-
)
101-
)
102-
}
103-
}
104-
105-
/**
106-
* `BeegoInputRequestBody` sources of untrusted data.
107-
*/
108-
private class BeegoInputRequestBodySource extends RemoteFlowSource::Range {
109-
BeegoInputRequestBodySource() {
110-
exists(DataFlow::FieldReadNode frn | this = frn |
111-
frn.getField().hasQualifiedName(contextPackagePath(), "BeegoInput", "RequestBody")
112-
)
113-
}
114-
}
115-
116-
/**
117-
* `beego/context.Context` sources of untrusted data.
118-
*/
119-
private class BeegoContextSource extends RemoteFlowSource::Range {
120-
BeegoContextSource() {
121-
exists(Method m | m.hasQualifiedName(contextPackagePath(), "Context", "GetCookie") |
122-
this = m.getACall().getResult()
52+
BeegoInputSafeUrlSource() {
53+
exists(Method m | m.hasQualifiedName(contextPackagePath(), "BeegoInput", ["URI", "URL"]) |
54+
this = m.getACall().getResult(0)
12355
)
12456
}
12557
}

‎go/ql/test/experimental/CWE-090/LDAPInjection.expected

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
edges
2-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:59:3:59:11 | untrusted | provenance | Src:MaD:677 |
3-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:61:3:61:51 | ...+... | provenance | Src:MaD:677 |
4-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:3:62:33 | slice literal | provenance | Src:MaD:677 |
5-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:24:62:32 | untrusted | provenance | Src:MaD:677 |
6-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:66:3:66:11 | untrusted | provenance | Src:MaD:677 |
7-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:68:3:68:51 | ...+... | provenance | Src:MaD:677 |
8-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:3:69:33 | slice literal | provenance | Src:MaD:677 |
9-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:24:69:32 | untrusted | provenance | Src:MaD:677 |
10-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:73:3:73:11 | untrusted | provenance | Src:MaD:677 |
11-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:75:3:75:51 | ...+... | provenance | Src:MaD:677 |
12-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:3:76:33 | slice literal | provenance | Src:MaD:677 |
13-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:24:76:32 | untrusted | provenance | Src:MaD:677 |
14-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:80:22:80:30 | untrusted | provenance | Src:MaD:677 |
15-
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:81:25:81:33 | untrusted | provenance | Src:MaD:677 |
2+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:59:3:59:11 | untrusted | provenance | Src:MaD:747 |
3+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:61:3:61:51 | ...+... | provenance | Src:MaD:747 |
4+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:3:62:33 | slice literal | provenance | Src:MaD:747 |
5+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:62:24:62:32 | untrusted | provenance | Src:MaD:747 |
6+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:66:3:66:11 | untrusted | provenance | Src:MaD:747 |
7+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:68:3:68:51 | ...+... | provenance | Src:MaD:747 |
8+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:3:69:33 | slice literal | provenance | Src:MaD:747 |
9+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:69:24:69:32 | untrusted | provenance | Src:MaD:747 |
10+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:73:3:73:11 | untrusted | provenance | Src:MaD:747 |
11+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:75:3:75:51 | ...+... | provenance | Src:MaD:747 |
12+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:3:76:33 | slice literal | provenance | Src:MaD:747 |
13+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:76:24:76:32 | untrusted | provenance | Src:MaD:747 |
14+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:80:22:80:30 | untrusted | provenance | Src:MaD:747 |
15+
| LDAPInjection.go:57:15:57:29 | call to UserAgent | LDAPInjection.go:81:25:81:33 | untrusted | provenance | Src:MaD:747 |
1616
| LDAPInjection.go:62:3:62:33 | slice literal [array] | LDAPInjection.go:62:3:62:33 | slice literal | provenance | |
1717
| LDAPInjection.go:62:24:62:32 | untrusted | LDAPInjection.go:62:3:62:33 | slice literal [array] | provenance | |
1818
| LDAPInjection.go:69:3:69:33 | slice literal [array] | LDAPInjection.go:69:3:69:33 | slice literal | provenance | |

‎go/ql/test/experimental/CWE-203/Timing.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
edges
2-
| timing.go:15:18:15:27 | selection of Header | timing.go:15:18:15:45 | call to Get | provenance | MaD:658 |
2+
| timing.go:15:18:15:27 | selection of Header | timing.go:15:18:15:45 | call to Get | provenance | MaD:728 |
33
| timing.go:15:18:15:45 | call to Get | timing.go:17:31:17:42 | headerSecret | provenance | |
4-
| timing.go:28:18:28:27 | selection of Header | timing.go:28:18:28:45 | call to Get | provenance | MaD:658 |
4+
| timing.go:28:18:28:27 | selection of Header | timing.go:28:18:28:45 | call to Get | provenance | MaD:728 |
55
| timing.go:28:18:28:45 | call to Get | timing.go:30:47:30:58 | headerSecret | provenance | |
6-
| timing.go:41:18:41:27 | selection of Header | timing.go:41:18:41:45 | call to Get | provenance | MaD:658 |
6+
| timing.go:41:18:41:27 | selection of Header | timing.go:41:18:41:45 | call to Get | provenance | MaD:728 |
77
| timing.go:41:18:41:45 | call to Get | timing.go:42:25:42:36 | headerSecret | provenance | |
88
nodes
99
| timing.go:15:18:15:27 | selection of Header | semmle.label | selection of Header |

‎go/ql/test/experimental/CWE-287/ImproperLdapAuth.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
edges
2-
| ImproperLdapAuth.go:18:18:18:24 | selection of URL | ImproperLdapAuth.go:18:18:18:32 | call to Query | provenance | MaD:738 |
2+
| ImproperLdapAuth.go:18:18:18:24 | selection of URL | ImproperLdapAuth.go:18:18:18:32 | call to Query | provenance | MaD:808 |
33
| ImproperLdapAuth.go:18:18:18:32 | call to Query | ImproperLdapAuth.go:28:23:28:34 | bindPassword | provenance | |
44
| ImproperLdapAuth.go:87:18:87:19 | "" | ImproperLdapAuth.go:97:23:97:34 | bindPassword | provenance | |
55
nodes

0 commit comments

Comments
 (0)