Skip to content

Commit 316ed29

Browse files
author
Alvaro Muñoz
authored
Merge pull request #42 from GitHubSecurityLab/go-local-sources
Go: Local Sources
2 parents 641f907 + e258fd3 commit 316ed29

File tree

13 files changed

+147
-69
lines changed

13 files changed

+147
-69
lines changed

‎go/ext/codeql-pack.lock.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies: {}
4+
compiled: false

‎go/ext/generated/.gitkeep

Whitespace-only changes.

‎go/ext/manual/.gitkeep

Whitespace-only changes.

‎go/ext/manual/flag.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
extensions:
2+
# Make sure that the extensible model predicates are at least defined as empty.
3+
- addsTo:
4+
pack: codeql/go-all
5+
extensible: sourceModel
6+
data:
7+
- ["flag", "", True, "String", "", "", "ReturnValue[0]", "remote", "manual"]
8+
- ["flag", "", True, "StringVar", "", "", "ReturnValue[0]", "remote", "manual"]
9+
# local variants
10+
- ["flag", "", True, "String", "", "", "ReturnValue[0]", "local", "manual"]
11+
- ["flag", "", True, "StringVar", "", "", "ReturnValue[0]", "local", "manual"]
12+
- addsTo:
13+
pack: codeql/go-all
14+
extensible: sinkModel
15+
data: []
16+
- addsTo:
17+
pack: codeql/go-all
18+
extensible: summaryModel
19+
data: []

‎go/ext/manual/os.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
extensions:
2+
# Make sure that the extensible model predicates are at least defined as empty.
3+
- addsTo:
4+
pack: codeql/go-all
5+
extensible: sourceModel
6+
data:
7+
- ["os", "Args", True, "", "", "", "ReturnValue[0]", "remote", "manual"]
8+
- ["os", "", True, "Getenv", "", "", "ReturnValue[0]", "remote", "manual"]
9+
- ["os", "", True, "LookupEnv", "", "", "ReturnValue[0]", "remote", "manual"]
10+
- ["os", "", True, "ReadFile", "", "", "ReturnValue[0]", "remote", "manual"]
11+
- ["os", "", True, "Readlink", "", "", "ReturnValue[0]", "remote", "manual"]
12+
- ["os", "", True, "Environ", "", "", "ReturnValue[0]", "remote", "manual"]
13+
# local variants
14+
- ["os", "Args", True, "", "", "", "ReturnValue[0]", "local", "manual"]
15+
- ["os", "", True, "Getenv", "", "", "ReturnValue[0]", "local", "manual"]
16+
- ["os", "", True, "LookupEnv", "", "", "ReturnValue[0]", "local", "manual"]
17+
- ["os", "", True, "ReadFile", "", "", "ReturnValue[0]", "local", "manual"]
18+
- ["os", "", True, "Readlink", "", "", "ReturnValue[0]", "local", "manual"]
19+
- ["os", "", True, "Environ", "", "", "ReturnValue[0]", "local", "manual"]
20+
- addsTo:
21+
pack: codeql/go-all
22+
extensible: sinkModel
23+
data: []
24+
- addsTo:
25+
pack: codeql/go-all
26+
extensible: summaryModel
27+
data: []

‎go/ext/qlpack.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
library: true
2+
name: githubsecuritylab/codeql-go-extensions
3+
version: 0.0.1
4+
extensionTargets:
5+
codeql/go-all: '*'
6+
dataExtensions:
7+
- 'manual/*.yml'
8+
- 'manual/**/*.yml'
9+
- 'generated/*.yml'
10+
- 'generated/**/*.yml'

‎go/lib/ghsl/LocalSources.qll

Lines changed: 23 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -3,82 +3,36 @@ private import go
33
module LocalSources {
44
private import semmle.go.dataflow.DataFlow
55
private import semmle.go.dataflow.TaintTracking
6+
private import semmle.go.dataflow.ExternalFlow as ExternalFlow
67
private import semmle.go.Scopes
7-
8-
abstract class Range extends DataFlow::Node { }
9-
10-
// ========== Sources ==========
11-
12-
abstract class Sources extends DataFlow::Node { }
13-
14-
// ----------------------------------------------------
15-
// Used for finding Selections or Calls for Go imports
16-
// ----------------------------------------------------
178

18-
//class UseOfGoImports extends Sources {
19-
//UseOfGoImports () {
20-
//exists ( ValueEntity read,
21-
//DataFlow::Package pkg |
22-
//read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
23-
//and ( this.toString().regexpMatch("selection of.*")
24-
//or this.toString().regexpMatch("call to .*") )
25-
//)
26-
//}
27-
//}
28-
29-
// ----------------------------------------------------
30-
31-
class OsCmd extends LocalSources::Range {
32-
OsCmd() {
33-
exists ( ValueEntity read,
34-
DataFlow::Package pkg |
35-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
36-
and this.toString() = "selection of Run"
37-
)
38-
}
39-
}
9+
/**
10+
* A source of data that is controlled by the local user.
11+
*/
12+
abstract class Range extends DataFlow::Node { }
4013

41-
class OsExec extends LocalSources::Range {
42-
OsExec() {
43-
exists ( ValueEntity read,
44-
DataFlow::Package pkg |
45-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
46-
and this.toString() = "selection of Command"
47-
)
14+
/**
15+
* Support for Local Sources
16+
*/
17+
class MaDLocalSource extends Range {
18+
MaDLocalSource() { ExternalFlow::sourceNode(this, "local") }
4819
}
49-
}
5020

51-
class OsArgs extends LocalSources::Range {
52-
OsArgs() {
53-
exists ( ValueEntity read,
54-
DataFlow::Package pkg |
55-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
56-
and this.toString() = "selection of Args"
57-
)
21+
class OsCmd extends LocalSources::Range {
22+
OsCmd() {
23+
exists(ValueEntity read, DataFlow::Package pkg |
24+
read.getScope().getEntity(_) = pkg.getScope().getEntity(_) and
25+
this.toString() = "selection of Run"
26+
)
27+
}
5828
}
59-
}
60-
61-
// Not currently working (need a test case)
62-
//class OsGetenv extends Sources, DataFlow::CallNode {
63-
//OsGetenv() {
64-
//// https://pkg.go.dev/os#Getenv
65-
//this.getTarget().hasQualifiedName(package("os", ""), "Getenv")
66-
//or
67-
//// https://pkg.go.dev/os#Environ
68-
//this.getTarget().hasQualifiedName(package("os", ""), "Environ")
69-
//}
70-
//}
7129

72-
// https://pkg.go.dev/flag
73-
class Flag extends LocalSources::Range {
74-
Flag() {
75-
exists ( ValueEntity read,
76-
DataFlow::Package pkg |
77-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
78-
and
79-
( this.toString() = "selection of String"
80-
or this.toString() = "selection of Parse" )
30+
class OsExec extends LocalSources::Range {
31+
OsExec() {
32+
exists(ValueEntity read, DataFlow::Package pkg |
33+
read.getScope().getEntity(_) = pkg.getScope().getEntity(_) and
34+
this.toString() = "selection of Command"
8135
)
8236
}
37+
}
8338
}
84-
}

‎go/test/lib/localsources/cmd/flag.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package main
2+
3+
import (
4+
"flag"
5+
"fmt"
6+
)
7+
8+
func main() {
9+
10+
wordPtr := flag.String("word", "foo", "a string")
11+
12+
numbPtr := flag.Int("numb", 42, "an int")
13+
forkPtr := flag.Bool("fork", false, "a bool")
14+
15+
var svar string
16+
flag.StringVar(&svar, "svar", "bar", "a string var")
17+
18+
flag.Parse()
19+
20+
fmt.Println("word:", *wordPtr)
21+
fmt.Println("numb:", *numbPtr)
22+
fmt.Println("fork:", *forkPtr)
23+
fmt.Println("svar:", svar)
24+
fmt.Println("tail:", flag.Args())
25+
}

‎go/test/lib/localsources/cmd/go_os.go

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"os"
6+
)
7+
8+
func main() {
9+
args := os.Args
10+
fmt.Println(args[0], args[1])
11+
12+
// Environ
13+
env := os.Environ()
14+
fmt.Println(env[0], env[1])
15+
16+
// getenv
17+
myenv := os.Getenv("HOME")
18+
fmt.Println(myenv)
19+
20+
}

‎go/test/lib/localsources/go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
module github.com/GitHubSecurityLab/CodeQLCommunityPacks
2+
3+
go 1.10

‎go/test/lib/localsources/local.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
remoteSources
2+
| cmd/flag.go:10:13:10:50 | call to String |
3+
| cmd/go_os.go:13:9:13:20 | call to Environ |
4+
| cmd/go_os.go:17:11:17:27 | call to Getenv |
5+
localSources
6+
| cmd/flag.go:10:13:10:50 | call to String |
7+
| cmd/go_os.go:13:9:13:20 | call to Environ |
8+
| cmd/go_os.go:17:11:17:27 | call to Getenv |

‎go/test/lib/localsources/local.ql

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import go
2+
import ghsl.Utils
3+
import ghsl.LocalSources
4+
5+
query predicate remoteSources(DataFlow::ExprNode node) { node instanceof RemoteFlowSource::Range }
6+
7+
query predicate localSources(DataFlow::ExprNode node) { node instanceof LocalSources::Range }

‎go/test/qlpack.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,6 @@ dependencies:
55
# codeql/go-queries: '*'
66
githubsecuritylab/codeql-go-queries: '*'
77
githubsecuritylab/codeql-go-libs: '*'
8+
githubsecuritylab/codeql-go-extensions: '*'
89
extractor: go
910
tests: .

0 commit comments

Comments
 (0)