Skip to content

Commit 5376106

Browse files
GeekMasherGeekMasher
committed
feat(go): Update local sources and add tests
1 parent d1ce255 commit 5376106

File tree

7 files changed

+87
-70
lines changed

7 files changed

+87
-70
lines changed

‎go/lib/ghsl/LocalSources.qll

Lines changed: 24 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -3,82 +3,36 @@ private import go
33
module LocalSources {
44
private import semmle.go.dataflow.DataFlow
55
private import semmle.go.dataflow.TaintTracking
6+
private import semmle.go.dataflow.ExternalFlow as ExternalFlow
67
private import semmle.go.Scopes
7-
8-
abstract class Range extends DataFlow::Node { }
9-
10-
// ========== Sources ==========
11-
12-
abstract class Sources extends DataFlow::Node { }
13-
14-
// ----------------------------------------------------
15-
// Used for finding Selections or Calls for Go imports
16-
// ----------------------------------------------------
178

18-
//class UseOfGoImports extends Sources {
19-
//UseOfGoImports () {
20-
//exists ( ValueEntity read,
21-
//DataFlow::Package pkg |
22-
//read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
23-
//and ( this.toString().regexpMatch("selection of.*")
24-
//or this.toString().regexpMatch("call to .*") )
25-
//)
26-
//}
27-
//}
28-
29-
// ----------------------------------------------------
30-
31-
class OsCmd extends LocalSources::Range {
32-
OsCmd() {
33-
exists ( ValueEntity read,
34-
DataFlow::Package pkg |
35-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
36-
and this.toString() = "selection of Run"
37-
)
38-
}
39-
}
9+
/**
10+
* A source of data that is controlled by the local user.
11+
*/
12+
abstract class Range extends DataFlow::Node { }
4013

41-
class OsExec extends LocalSources::Range {
42-
OsExec() {
43-
exists ( ValueEntity read,
44-
DataFlow::Package pkg |
45-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
46-
and this.toString() = "selection of Command"
47-
)
14+
/**
15+
* Support for Local Sources
16+
*/
17+
class MaDLocalSource extends Range {
18+
MaDLocalSource() { ExternalFlow::sourceNode(this, "local") }
4819
}
49-
}
50-
51-
class OsArgs extends LocalSources::Range {
52-
OsArgs() {
53-
exists ( ValueEntity read,
54-
DataFlow::Package pkg |
55-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
56-
and this.toString() = "selection of Args"
57-
)
20+
21+
class OsCmd extends LocalSources::Range {
22+
OsCmd() {
23+
exists(ValueEntity read, DataFlow::Package pkg |
24+
read.getScope().getEntity(_) = pkg.getScope().getEntity(_) and
25+
this.toString() = "selection of Run"
26+
)
27+
}
5828
}
59-
}
6029

61-
// Not currently working (need a test case)
62-
//class OsGetenv extends Sources, DataFlow::CallNode {
63-
//OsGetenv() {
64-
//// https://pkg.go.dev/os#Getenv
65-
//this.getTarget().hasQualifiedName(package("os", ""), "Getenv")
66-
//or
67-
//// https://pkg.go.dev/os#Environ
68-
//this.getTarget().hasQualifiedName(package("os", ""), "Environ")
69-
//}
70-
//}
71-
72-
// https://pkg.go.dev/flag
73-
class Flag extends LocalSources::Range {
74-
Flag() {
75-
exists ( ValueEntity read,
76-
DataFlow::Package pkg |
77-
read.getScope().getEntity(_) = pkg.getScope().getEntity(_)
78-
and
79-
( this.toString() = "selection of String"
80-
or this.toString() = "selection of Parse" )
30+
class OsExec extends LocalSources::Range {
31+
OsExec() {
32+
exists(ValueEntity read, DataFlow::Package pkg |
33+
read.getScope().getEntity(_) = pkg.getScope().getEntity(_) and
34+
this.toString() = "selection of Command"
8135
)
8236
}
37+
}
8338
}
84-
}

‎go/test/lib/localsources/cmd/flag.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package main
2+
3+
import (
4+
"flag"
5+
"fmt"
6+
)
7+
8+
func main() {
9+
10+
wordPtr := flag.String("word", "foo", "a string")
11+
12+
numbPtr := flag.Int("numb", 42, "an int")
13+
forkPtr := flag.Bool("fork", false, "a bool")
14+
15+
var svar string
16+
flag.StringVar(&svar, "svar", "bar", "a string var")
17+
18+
flag.Parse()
19+
20+
fmt.Println("word:", *wordPtr)
21+
fmt.Println("numb:", *numbPtr)
22+
fmt.Println("fork:", *forkPtr)
23+
fmt.Println("svar:", svar)
24+
fmt.Println("tail:", flag.Args())
25+
}

‎go/test/lib/localsources/cmd/go_os.go

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"os"
6+
)
7+
8+
func main() {
9+
args := os.Args
10+
fmt.Println(args[0], args[1])
11+
12+
// Environ
13+
env := os.Environ()
14+
fmt.Println(env[0], env[1])
15+
16+
// getenv
17+
myenv := os.Getenv("HOME")
18+
fmt.Println(myenv)
19+
20+
}

‎go/test/lib/localsources/go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
module github.com/GitHubSecurityLab/CodeQLCommunityPacks
2+
3+
go 1.10

‎go/test/lib/localsources/local.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
| cmd/flag.go:10:13:10:23 | selection of String |
2+
| cmd/flag.go:10:13:10:50 | call to String |
3+
| cmd/flag.go:18:2:18:11 | selection of Parse |
4+
| cmd/flag.go:24:23:24:31 | selection of Args |
5+
| cmd/go_os.go:9:10:9:16 | selection of Args |
6+
| cmd/go_os.go:13:9:13:20 | call to Environ |
7+
| cmd/go_os.go:17:11:17:27 | call to Getenv |

‎go/test/lib/localsources/local.ql

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import go
2+
import ghsl.Utils
3+
import ghsl.LocalSources
4+
5+
query predicate remoteSources(DataFlow::ExprNode node) { node instanceof UntrustedFlowSource }
6+
7+
query predicate localSources(DataFlow::ExprNode node) { node instanceof LocalSources::Range }

‎go/test/qlpack.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,6 @@ dependencies:
55
codeql/go-queries: '*'
66
githubsecuritylab/codeql-go-queries: '*'
77
githubsecuritylab/codeql-go-libs: '*'
8+
githubsecuritylab/codeql-go-extensions: '*'
89
extractor: go
910
tests: .

0 commit comments

Comments
 (0)