Skip to content

Commit 3a3e053

Browse files
owen-mcowen-mc
committed
Only add taint steps for implicit varargs slice post-update nodes
1 parent b58e6eb commit 3a3e053

File tree

7 files changed

+6
-46
lines changed

7 files changed

+6
-46
lines changed

‎go/ql/lib/semmle/go/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,6 @@ predicate localAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ, str
112112
stringConcatStep(pred, succ)
113113
or
114114
sliceStep(pred, succ)
115-
or
116-
// Treat container read steps as taint for global taint flow.
117-
exists(DataFlow::Content c | DataFlowPrivate::containerContent(c) |
118-
DataFlowPrivate::readStep(pred, c, succ)
119-
)
120115
) and
121116
model = ""
122117
or
@@ -185,6 +180,12 @@ predicate elementStep(DataFlow::Node pred, DataFlow::Node succ) {
185180
// only step into the value, not the index
186181
succ.asInstruction() = IR::extractTupleElement(nextEntry, 1)
187182
)
183+
or
184+
exists(DataFlow::ImplicitVarargsSlice ivs |
185+
pred.(DataFlow::PostUpdateNode).getPreUpdateNode() = ivs and
186+
succ.(DataFlow::PostUpdateNode).getPreUpdateNode() =
187+
ivs.getCallNode().getAnImplicitVarargsArgument()
188+
)
188189
}
189190

190191
/** Holds if taint flows from `pred` to `succ` via an extract tuple operation. */

‎go/ql/test/experimental/CWE-74/DsnInjectionLocal.expected‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,9 @@
22
| Dsn.go:29:29:29:33 | dbDSN | Dsn.go:26:11:26:17 | selection of Args | Dsn.go:29:29:29:33 | dbDSN | This query depends on a $@. | Dsn.go:26:11:26:17 | selection of Args | user-provided value |
33
| Dsn.go:68:29:68:33 | dbDSN | Dsn.go:63:19:63:25 | selection of Args | Dsn.go:68:29:68:33 | dbDSN | This query depends on a $@. | Dsn.go:63:19:63:25 | selection of Args | user-provided value |
44
edges
5-
| Dsn.go:26:11:26:17 | selection of Args | Dsn.go:26:11:26:21 | slice element node | provenance | |
65
| Dsn.go:26:11:26:17 | selection of Args | Dsn.go:28:102:28:109 | index expression | provenance | |
7-
| Dsn.go:26:11:26:21 | slice element node | Dsn.go:26:11:26:21 | slice expression [array] | provenance | |
8-
| Dsn.go:26:11:26:21 | slice expression [array] | Dsn.go:28:102:28:106 | name2 [array] | provenance | |
96
| Dsn.go:28:11:28:110 | []type{args} [array] | Dsn.go:28:11:28:110 | call to Sprintf | provenance | MaD:1 |
107
| Dsn.go:28:11:28:110 | call to Sprintf | Dsn.go:29:29:29:33 | dbDSN | provenance | |
11-
| Dsn.go:28:102:28:106 | name2 [array] | Dsn.go:28:102:28:109 | index expression | provenance | |
128
| Dsn.go:28:102:28:109 | index expression | Dsn.go:28:11:28:110 | []type{args} [array] | provenance | |
139
| Dsn.go:28:102:28:109 | index expression | Dsn.go:28:11:28:110 | call to Sprintf | provenance | FunctionModel |
1410
| Dsn.go:62:2:62:4 | definition of cfg [pointer] | Dsn.go:63:9:63:11 | cfg [pointer] | provenance | |
@@ -29,11 +25,8 @@ models
2925
| 1 | Summary: fmt; ; false; Sprintf; ; ; Argument[1].ArrayElement; ReturnValue; taint; manual |
3026
nodes
3127
| Dsn.go:26:11:26:17 | selection of Args | semmle.label | selection of Args |
32-
| Dsn.go:26:11:26:21 | slice element node | semmle.label | slice element node |
33-
| Dsn.go:26:11:26:21 | slice expression [array] | semmle.label | slice expression [array] |
3428
| Dsn.go:28:11:28:110 | []type{args} [array] | semmle.label | []type{args} [array] |
3529
| Dsn.go:28:11:28:110 | call to Sprintf | semmle.label | call to Sprintf |
36-
| Dsn.go:28:102:28:106 | name2 [array] | semmle.label | name2 [array] |
3730
| Dsn.go:28:102:28:109 | index expression | semmle.label | index expression |
3831
| Dsn.go:29:29:29:33 | dbDSN | semmle.label | dbDSN |
3932
| Dsn.go:62:2:62:4 | definition of cfg [pointer] | semmle.label | definition of cfg [pointer] |

‎go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
| main.go:47:20:47:21 | next key-value pair in range | main.go:47:2:50:2 | range statement[1] |
1616
| main.go:47:20:47:21 | xs | main.go:47:2:50:2 | range statement[1] |
1717
| main.go:56:8:56:11 | true | main.go:56:2:56:3 | ch |
18-
| main.go:57:4:57:5 | ch | main.go:57:2:57:5 | <-... |
1918
| strings.go:9:24:9:24 | s | strings.go:9:8:9:38 | call to Replace |
2019
| strings.go:9:32:9:34 | "_" | strings.go:9:8:9:38 | call to Replace |
2120
| strings.go:10:27:10:27 | s | strings.go:10:8:10:42 | call to ReplaceAll |

‎go/ql/test/query-tests/Security/CWE-078/CommandInjection.expected‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ edges
5050
| GitSubcommands.go:33:13:33:27 | call to Query | GitSubcommands.go:38:32:38:38 | tainted | provenance | |
5151
| SanitizingDoubleDash.go:9:13:9:19 | selection of URL | SanitizingDoubleDash.go:9:13:9:27 | call to Query | provenance | Src:MaD:2 MaD:7 |
5252
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:13:25:13:31 | tainted | provenance | |
53-
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:14:23:14:33 | slice element node | provenance | |
5453
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:14:23:14:33 | slice expression | provenance | |
5554
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:39:31:39:37 | tainted | provenance | |
5655
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:52:24:52:30 | tainted | provenance | |
@@ -71,8 +70,6 @@ edges
7170
| SanitizingDoubleDash.go:53:14:53:35 | call to append | SanitizingDoubleDash.go:54:23:54:30 | arrayLit | provenance | |
7271
| SanitizingDoubleDash.go:53:14:53:35 | call to append [array] | SanitizingDoubleDash.go:54:23:54:30 | arrayLit | provenance | |
7372
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit | SanitizingDoubleDash.go:53:14:53:35 | call to append | provenance | MaD:4 |
74-
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit | SanitizingDoubleDash.go:53:14:53:35 | call to append | provenance | MaD:3 |
75-
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit | SanitizingDoubleDash.go:53:14:53:35 | call to append [array] | provenance | MaD:3 |
7673
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit [array] | SanitizingDoubleDash.go:53:14:53:35 | call to append | provenance | MaD:3 |
7774
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit [array] | SanitizingDoubleDash.go:53:14:53:35 | call to append [array] | provenance | MaD:3 |
7875
| SanitizingDoubleDash.go:68:14:68:38 | []type{args} [array] | SanitizingDoubleDash.go:68:14:68:38 | call to append | provenance | MaD:5 |
@@ -83,16 +80,12 @@ edges
8380
| SanitizingDoubleDash.go:69:14:69:35 | call to append | SanitizingDoubleDash.go:70:23:70:30 | arrayLit | provenance | |
8481
| SanitizingDoubleDash.go:69:14:69:35 | call to append [array] | SanitizingDoubleDash.go:70:23:70:30 | arrayLit | provenance | |
8582
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit | SanitizingDoubleDash.go:69:14:69:35 | call to append | provenance | MaD:4 |
86-
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit | SanitizingDoubleDash.go:69:14:69:35 | call to append | provenance | MaD:3 |
87-
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit | SanitizingDoubleDash.go:69:14:69:35 | call to append [array] | provenance | MaD:3 |
8883
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit [array] | SanitizingDoubleDash.go:69:14:69:35 | call to append | provenance | MaD:3 |
8984
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit [array] | SanitizingDoubleDash.go:69:14:69:35 | call to append [array] | provenance | MaD:3 |
9085
| SanitizingDoubleDash.go:92:13:92:19 | selection of URL | SanitizingDoubleDash.go:92:13:92:27 | call to Query | provenance | Src:MaD:2 MaD:7 |
9186
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:95:25:95:31 | tainted | provenance | |
92-
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:96:24:96:34 | slice element node | provenance | |
9387
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:96:24:96:34 | slice expression | provenance | |
9488
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:100:31:100:37 | tainted | provenance | |
95-
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:101:24:101:34 | slice element node | provenance | |
9689
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:101:24:101:34 | slice expression | provenance | |
9790
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:105:30:105:36 | tainted | provenance | |
9891
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:106:24:106:31 | arrayLit | provenance | |
@@ -135,8 +128,6 @@ edges
135128
| SanitizingDoubleDash.go:129:14:129:35 | call to append | SanitizingDoubleDash.go:130:24:130:31 | arrayLit | provenance | |
136129
| SanitizingDoubleDash.go:129:14:129:35 | call to append [array] | SanitizingDoubleDash.go:130:24:130:31 | arrayLit | provenance | |
137130
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit | SanitizingDoubleDash.go:129:14:129:35 | call to append | provenance | MaD:4 |
138-
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit | SanitizingDoubleDash.go:129:14:129:35 | call to append | provenance | MaD:3 |
139-
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit | SanitizingDoubleDash.go:129:14:129:35 | call to append [array] | provenance | MaD:3 |
140131
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit [array] | SanitizingDoubleDash.go:129:14:129:35 | call to append | provenance | MaD:3 |
141132
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit [array] | SanitizingDoubleDash.go:129:14:129:35 | call to append [array] | provenance | MaD:3 |
142133
| SanitizingDoubleDash.go:136:14:136:38 | []type{args} [array] | SanitizingDoubleDash.go:136:14:136:38 | call to append | provenance | MaD:5 |
@@ -152,8 +143,6 @@ edges
152143
| SanitizingDoubleDash.go:143:14:143:35 | call to append | SanitizingDoubleDash.go:144:24:144:31 | arrayLit | provenance | |
153144
| SanitizingDoubleDash.go:143:14:143:35 | call to append [array] | SanitizingDoubleDash.go:144:24:144:31 | arrayLit | provenance | |
154145
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit | SanitizingDoubleDash.go:143:14:143:35 | call to append | provenance | MaD:4 |
155-
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit | SanitizingDoubleDash.go:143:14:143:35 | call to append | provenance | MaD:3 |
156-
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit | SanitizingDoubleDash.go:143:14:143:35 | call to append [array] | provenance | MaD:3 |
157146
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit [array] | SanitizingDoubleDash.go:143:14:143:35 | call to append | provenance | MaD:3 |
158147
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit [array] | SanitizingDoubleDash.go:143:14:143:35 | call to append [array] | provenance | MaD:3 |
159148
models

‎go/ql/test/query-tests/Security/CWE-209/StackTraceExposure.expected‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,16 @@
11
edges
2-
| test.go:14:2:14:4 | definition of buf | test.go:15:8:15:37 | slice element node | provenance | |
32
| test.go:14:2:14:4 | definition of buf | test.go:17:10:17:12 | buf | provenance | |
43
| test.go:14:2:14:4 | definition of buf | test.go:20:29:20:31 | buf | provenance | |
54
| test.go:15:2:15:4 | definition of buf | test.go:17:10:17:12 | buf | provenance | |
65
| test.go:15:2:15:4 | definition of buf | test.go:20:29:20:31 | buf | provenance | |
7-
| test.go:15:2:15:4 | definition of buf [array] | test.go:17:10:17:12 | buf | provenance | |
8-
| test.go:15:2:15:4 | definition of buf [array] | test.go:20:29:20:31 | buf [array] | provenance | |
9-
| test.go:15:8:15:37 | slice element node | test.go:15:8:15:37 | slice expression [array] | provenance | |
10-
| test.go:15:8:15:37 | slice expression [array] | test.go:17:10:17:12 | buf | provenance | |
11-
| test.go:15:8:15:37 | slice expression [array] | test.go:20:29:20:31 | buf [array] | provenance | |
12-
| test.go:20:2:20:32 | []type{args} [array, array] | test.go:15:2:15:4 | definition of buf [array] | provenance | |
136
| test.go:20:2:20:32 | []type{args} [array] | test.go:15:2:15:4 | definition of buf | provenance | |
147
| test.go:20:29:20:31 | buf | test.go:20:2:20:32 | []type{args} [array] | provenance | |
15-
| test.go:20:29:20:31 | buf [array] | test.go:20:2:20:32 | []type{args} [array, array] | provenance | |
168
nodes
179
| test.go:14:2:14:4 | definition of buf | semmle.label | definition of buf |
1810
| test.go:15:2:15:4 | definition of buf | semmle.label | definition of buf |
19-
| test.go:15:2:15:4 | definition of buf [array] | semmle.label | definition of buf [array] |
20-
| test.go:15:8:15:37 | slice element node | semmle.label | slice element node |
21-
| test.go:15:8:15:37 | slice expression [array] | semmle.label | slice expression [array] |
2211
| test.go:17:10:17:12 | buf | semmle.label | buf |
23-
| test.go:20:2:20:32 | []type{args} [array, array] | semmle.label | []type{args} [array, array] |
2412
| test.go:20:2:20:32 | []type{args} [array] | semmle.label | []type{args} [array] |
2513
| test.go:20:29:20:31 | buf | semmle.label | buf |
26-
| test.go:20:29:20:31 | buf [array] | semmle.label | buf [array] |
2714
subpaths
2815
#select
2916
| test.go:17:10:17:12 | buf | test.go:14:2:14:4 | definition of buf | test.go:17:10:17:12 | buf | HTTP response depends on $@ and may be exposed to an external user. | test.go:14:2:14:4 | definition of buf | stack trace information |

‎go/ql/test/query-tests/Security/CWE-327/UnsafeTLS.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,6 @@ edges
6060
| UnsafeTLS.go:344:19:344:44 | call to append | UnsafeTLS.go:346:25:346:36 | cipherSuites | provenance | |
6161
| UnsafeTLS.go:344:19:344:44 | call to append [array] | UnsafeTLS.go:344:26:344:37 | cipherSuites [array] | provenance | |
6262
| UnsafeTLS.go:344:26:344:37 | cipherSuites | UnsafeTLS.go:344:19:344:44 | call to append | provenance | MaD:2 |
63-
| UnsafeTLS.go:344:26:344:37 | cipherSuites | UnsafeTLS.go:344:19:344:44 | call to append | provenance | MaD:1 |
64-
| UnsafeTLS.go:344:26:344:37 | cipherSuites | UnsafeTLS.go:344:19:344:44 | call to append [array] | provenance | MaD:1 |
6563
| UnsafeTLS.go:344:26:344:37 | cipherSuites [array] | UnsafeTLS.go:344:19:344:44 | call to append | provenance | MaD:1 |
6664
| UnsafeTLS.go:344:26:344:37 | cipherSuites [array] | UnsafeTLS.go:344:19:344:44 | call to append [array] | provenance | MaD:1 |
6765
| UnsafeTLS.go:344:40:344:43 | selection of ID | UnsafeTLS.go:344:19:344:44 | []type{args} [array] | provenance | |
@@ -72,8 +70,6 @@ edges
7270
| UnsafeTLS.go:353:19:353:52 | call to append | UnsafeTLS.go:355:25:355:36 | cipherSuites | provenance | |
7371
| UnsafeTLS.go:353:19:353:52 | call to append [array] | UnsafeTLS.go:353:26:353:37 | cipherSuites [array] | provenance | |
7472
| UnsafeTLS.go:353:26:353:37 | cipherSuites | UnsafeTLS.go:353:19:353:52 | call to append | provenance | MaD:2 |
75-
| UnsafeTLS.go:353:26:353:37 | cipherSuites | UnsafeTLS.go:353:19:353:52 | call to append | provenance | MaD:1 |
76-
| UnsafeTLS.go:353:26:353:37 | cipherSuites | UnsafeTLS.go:353:19:353:52 | call to append [array] | provenance | MaD:1 |
7773
| UnsafeTLS.go:353:26:353:37 | cipherSuites [array] | UnsafeTLS.go:353:19:353:52 | call to append | provenance | MaD:1 |
7874
| UnsafeTLS.go:353:26:353:37 | cipherSuites [array] | UnsafeTLS.go:353:19:353:52 | call to append [array] | provenance | MaD:1 |
7975
| UnsafeTLS.go:353:40:353:51 | selection of ID | UnsafeTLS.go:353:19:353:52 | []type{args} [array] | provenance | |

‎go/ql/test/query-tests/Security/CWE-338/InsecureRandomness/InsecureRandomness.expected‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,13 @@
66
| sample.go:43:17:43:39 | call to Intn | sample.go:43:17:43:39 | call to Intn | sample.go:43:17:43:39 | call to Intn | A password-related function depends on a $@ generated with a cryptographically weak RNG. | sample.go:43:17:43:39 | call to Intn | random number |
77
| sample.go:58:32:58:43 | type conversion | sample.go:55:17:55:42 | call to Intn | sample.go:58:32:58:43 | type conversion | This cryptographic algorithm depends on a $@ generated with a cryptographically weak RNG. | sample.go:55:17:55:42 | call to Intn | random number |
88
edges
9-
| sample.go:15:10:15:64 | call to Sum256 | sample.go:16:9:16:15 | slice element node | provenance | |
109
| sample.go:15:10:15:64 | call to Sum256 | sample.go:16:9:16:15 | slice expression | provenance | |
1110
| sample.go:15:24:15:63 | type conversion | sample.go:15:10:15:64 | call to Sum256 | provenance | FunctionModel |
1211
| sample.go:15:31:15:62 | []type{args} [array] | sample.go:15:31:15:62 | call to Sprintf | provenance | MaD:1 |
1312
| sample.go:15:31:15:62 | call to Sprintf | sample.go:15:24:15:63 | type conversion | provenance | |
1413
| sample.go:15:49:15:61 | call to Uint32 | sample.go:15:31:15:62 | []type{args} [array] | provenance | |
1514
| sample.go:15:49:15:61 | call to Uint32 | sample.go:15:31:15:62 | call to Sprintf | provenance | FunctionModel |
16-
| sample.go:16:9:16:15 | slice element node | sample.go:16:9:16:15 | slice expression [array] | provenance | |
1715
| sample.go:16:9:16:15 | slice expression | sample.go:26:25:26:30 | call to Guid | provenance | |
18-
| sample.go:16:9:16:15 | slice expression [array] | sample.go:26:25:26:30 | call to Guid | provenance | |
1916
| sample.go:33:2:33:6 | definition of nonce | sample.go:37:25:37:29 | nonce | provenance | |
2017
| sample.go:33:2:33:6 | definition of nonce | sample.go:37:32:37:36 | nonce | provenance | |
2118
| sample.go:34:12:34:40 | call to New | sample.go:35:14:35:19 | random | provenance | |
@@ -34,9 +31,7 @@ nodes
3431
| sample.go:15:31:15:62 | []type{args} [array] | semmle.label | []type{args} [array] |
3532
| sample.go:15:31:15:62 | call to Sprintf | semmle.label | call to Sprintf |
3633
| sample.go:15:49:15:61 | call to Uint32 | semmle.label | call to Uint32 |
37-
| sample.go:16:9:16:15 | slice element node | semmle.label | slice element node |
3834
| sample.go:16:9:16:15 | slice expression | semmle.label | slice expression |
39-
| sample.go:16:9:16:15 | slice expression [array] | semmle.label | slice expression [array] |
4035
| sample.go:26:25:26:30 | call to Guid | semmle.label | call to Guid |
4136
| sample.go:33:2:33:6 | definition of nonce | semmle.label | definition of nonce |
4237
| sample.go:34:12:34:40 | call to New | semmle.label | call to New |

0 commit comments

Comments
 (0)