Skip to content

Commit 620ae33

Browse files
owen-mcowen-mc
committed
Make SafeUrlFlow test more comprehensive (failing)
1 parent 8a21a4f commit 620ae33

File tree

2 files changed

+32
-27
lines changed

2 files changed

+32
-27
lines changed

‎go/ql/test/library-tests/semmle/go/security/SafeUrlFlow/SafeUrlFlow.expected‎

Lines changed: 30 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,19 @@
1616
| SafeUrlFlow.go:70:39:70:54 | call to String | SafeUrlFlow.go:54:13:54:19 | selection of URL | SafeUrlFlow.go:70:39:70:54 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:54:13:54:19 | selection of URL | here |
1717
| SafeUrlFlow.go:74:70:74:85 | call to String | SafeUrlFlow.go:54:13:54:19 | selection of URL | SafeUrlFlow.go:74:70:74:85 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:54:13:54:19 | selection of URL | here |
1818
| SafeUrlFlow.go:78:40:78:55 | call to String | SafeUrlFlow.go:54:13:54:19 | selection of URL | SafeUrlFlow.go:78:40:78:55 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:54:13:54:19 | selection of URL | here |
19-
| SafeUrlFlow.go:89:24:89:41 | call to String | SafeUrlFlow.go:84:14:84:21 | selection of Host | SafeUrlFlow.go:89:24:89:41 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:84:14:84:21 | selection of Host | here |
20-
| SafeUrlFlow.go:109:11:109:23 | reconstructed | SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:109:11:109:23 | reconstructed | A safe URL flows here from $@. | SafeUrlFlow.go:100:13:100:19 | selection of URL | here |
21-
| SafeUrlFlow.go:112:24:112:50 | ...+... | SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:112:24:112:50 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:100:13:100:19 | selection of URL | here |
22-
| SafeUrlFlow.go:113:29:113:58 | ...+... | SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:113:29:113:58 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:100:13:100:19 | selection of URL | here |
23-
| SafeUrlFlow.go:114:12:114:42 | ...+... | SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:114:12:114:42 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:100:13:100:19 | selection of URL | here |
24-
| SafeUrlFlow.go:115:12:115:25 | safeOpaquePart | SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:115:12:115:25 | safeOpaquePart | A safe URL flows here from $@. | SafeUrlFlow.go:100:13:100:19 | selection of URL | here |
19+
| SafeUrlFlow.go:92:11:92:28 | call to String | SafeUrlFlow.go:84:14:84:21 | selection of Host | SafeUrlFlow.go:92:11:92:28 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:84:14:84:21 | selection of Host | here |
20+
| SafeUrlFlow.go:105:11:105:23 | reconstructed | SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:105:11:105:23 | reconstructed | A safe URL flows here from $@. | SafeUrlFlow.go:96:13:96:19 | selection of URL | here |
21+
| SafeUrlFlow.go:108:24:108:50 | ...+... | SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:108:24:108:50 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:96:13:96:19 | selection of URL | here |
22+
| SafeUrlFlow.go:109:29:109:58 | ...+... | SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:109:29:109:58 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:96:13:96:19 | selection of URL | here |
23+
| SafeUrlFlow.go:110:12:110:42 | ...+... | SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:110:12:110:42 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:96:13:96:19 | selection of URL | here |
24+
| SafeUrlFlow.go:111:12:111:25 | safeOpaquePart | SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:111:12:111:25 | safeOpaquePart | A safe URL flows here from $@. | SafeUrlFlow.go:96:13:96:19 | selection of URL | here |
2525
edges
2626
| SafeUrlFlow.go:10:14:10:21 | selection of Host | SafeUrlFlow.go:11:24:11:50 | ...+... | provenance | Sink:MaD:1 |
2727
| SafeUrlFlow.go:10:14:10:21 | selection of Host | SafeUrlFlow.go:17:19:17:26 | safeHost | provenance | |
2828
| SafeUrlFlow.go:13:13:13:19 | selection of URL | SafeUrlFlow.go:14:29:14:35 | safeURL | provenance | Src:MaD:2 |
2929
| SafeUrlFlow.go:14:29:14:35 | safeURL | SafeUrlFlow.go:14:29:14:44 | call to String | provenance | MaD:3 |
30+
| SafeUrlFlow.go:17:2:17:10 | targetURL | SafeUrlFlow.go:18:11:18:19 | targetURL | provenance | |
31+
| SafeUrlFlow.go:17:19:17:26 | safeHost | SafeUrlFlow.go:17:2:17:10 | targetURL | provenance | Config |
3032
| SafeUrlFlow.go:17:19:17:26 | safeHost | SafeUrlFlow.go:18:11:18:19 | targetURL | provenance | Config |
3133
| SafeUrlFlow.go:18:11:18:19 | targetURL | SafeUrlFlow.go:18:11:18:28 | call to String | provenance | MaD:3 |
3234
| SafeUrlFlow.go:37:13:37:19 | selection of URL | SafeUrlFlow.go:45:24:45:61 | ...+... | provenance | Src:MaD:2 Sink:MaD:1 |
@@ -55,13 +57,15 @@ edges
5557
| SafeUrlFlow.go:74:70:74:76 | safeURL | SafeUrlFlow.go:74:70:74:85 | call to String | provenance | MaD:3 |
5658
| SafeUrlFlow.go:78:40:78:46 | safeURL | SafeUrlFlow.go:78:40:78:55 | call to String | provenance | MaD:3 |
5759
| SafeUrlFlow.go:84:14:84:21 | selection of Host | SafeUrlFlow.go:87:19:87:26 | safeHost | provenance | |
58-
| SafeUrlFlow.go:87:19:87:26 | safeHost | SafeUrlFlow.go:89:24:89:32 | targetURL | provenance | Config |
59-
| SafeUrlFlow.go:89:24:89:32 | targetURL | SafeUrlFlow.go:89:24:89:41 | call to String | provenance | MaD:3 Sink:MaD:1 |
60-
| SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:109:11:109:23 | reconstructed | provenance | Src:MaD:2 |
61-
| SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:112:24:112:50 | ...+... | provenance | Src:MaD:2 Sink:MaD:1 |
62-
| SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:113:29:113:58 | ...+... | provenance | Src:MaD:2 |
63-
| SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:114:12:114:42 | ...+... | provenance | Src:MaD:2 |
64-
| SafeUrlFlow.go:100:13:100:19 | selection of URL | SafeUrlFlow.go:115:12:115:25 | safeOpaquePart | provenance | Src:MaD:2 |
60+
| SafeUrlFlow.go:87:19:87:26 | safeHost | SafeUrlFlow.go:91:2:91:10 | targetURL | provenance | Config |
61+
| SafeUrlFlow.go:87:19:87:26 | safeHost | SafeUrlFlow.go:92:11:92:19 | targetURL | provenance | Config |
62+
| SafeUrlFlow.go:91:2:91:10 | targetURL | SafeUrlFlow.go:92:11:92:19 | targetURL | provenance | |
63+
| SafeUrlFlow.go:92:11:92:19 | targetURL | SafeUrlFlow.go:92:11:92:28 | call to String | provenance | MaD:3 |
64+
| SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:105:11:105:23 | reconstructed | provenance | Src:MaD:2 |
65+
| SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:108:24:108:50 | ...+... | provenance | Src:MaD:2 Sink:MaD:1 |
66+
| SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:109:29:109:58 | ...+... | provenance | Src:MaD:2 |
67+
| SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:110:12:110:42 | ...+... | provenance | Src:MaD:2 |
68+
| SafeUrlFlow.go:96:13:96:19 | selection of URL | SafeUrlFlow.go:111:12:111:25 | safeOpaquePart | provenance | Src:MaD:2 |
6569
models
6670
| 1 | Sink: net/http; ; false; Redirect; ; ; Argument[2]; url-redirection[0]; manual |
6771
| 2 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
@@ -72,6 +76,7 @@ nodes
7276
| SafeUrlFlow.go:13:13:13:19 | selection of URL | semmle.label | selection of URL |
7377
| SafeUrlFlow.go:14:29:14:35 | safeURL | semmle.label | safeURL |
7478
| SafeUrlFlow.go:14:29:14:44 | call to String | semmle.label | call to String |
79+
| SafeUrlFlow.go:17:2:17:10 | targetURL | semmle.label | targetURL |
7580
| SafeUrlFlow.go:17:19:17:26 | safeHost | semmle.label | safeHost |
7681
| SafeUrlFlow.go:18:11:18:19 | targetURL | semmle.label | targetURL |
7782
| SafeUrlFlow.go:18:11:18:28 | call to String | semmle.label | call to String |
@@ -104,12 +109,16 @@ nodes
104109
| SafeUrlFlow.go:78:40:78:55 | call to String | semmle.label | call to String |
105110
| SafeUrlFlow.go:84:14:84:21 | selection of Host | semmle.label | selection of Host |
106111
| SafeUrlFlow.go:87:19:87:26 | safeHost | semmle.label | safeHost |
107-
| SafeUrlFlow.go:89:24:89:32 | targetURL | semmle.label | targetURL |
108-
| SafeUrlFlow.go:89:24:89:41 | call to String | semmle.label | call to String |
109-
| SafeUrlFlow.go:100:13:100:19 | selection of URL | semmle.label | selection of URL |
110-
| SafeUrlFlow.go:109:11:109:23 | reconstructed | semmle.label | reconstructed |
111-
| SafeUrlFlow.go:112:24:112:50 | ...+... | semmle.label | ...+... |
112-
| SafeUrlFlow.go:113:29:113:58 | ...+... | semmle.label | ...+... |
113-
| SafeUrlFlow.go:114:12:114:42 | ...+... | semmle.label | ...+... |
114-
| SafeUrlFlow.go:115:12:115:25 | safeOpaquePart | semmle.label | safeOpaquePart |
112+
| SafeUrlFlow.go:91:2:91:10 | targetURL | semmle.label | targetURL |
113+
| SafeUrlFlow.go:92:11:92:19 | targetURL | semmle.label | targetURL |
114+
| SafeUrlFlow.go:92:11:92:28 | call to String | semmle.label | call to String |
115+
| SafeUrlFlow.go:96:13:96:19 | selection of URL | semmle.label | selection of URL |
116+
| SafeUrlFlow.go:105:11:105:23 | reconstructed | semmle.label | reconstructed |
117+
| SafeUrlFlow.go:108:24:108:50 | ...+... | semmle.label | ...+... |
118+
| SafeUrlFlow.go:109:29:109:58 | ...+... | semmle.label | ...+... |
119+
| SafeUrlFlow.go:110:12:110:42 | ...+... | semmle.label | ...+... |
120+
| SafeUrlFlow.go:111:12:111:25 | safeOpaquePart | semmle.label | safeOpaquePart |
115121
subpaths
122+
testFailures
123+
| SafeUrlFlow.go:89:62:89:71 | comment | Missing result: Alert |
124+
| SafeUrlFlow.go:92:11:92:28 | call to String | Unexpected result: Alert |

‎go/ql/test/library-tests/semmle/go/security/SafeUrlFlow/SafeUrlFlow.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,9 @@ func testHostFieldAssignmentFlow(w http.ResponseWriter, req *http.Request) {
8787
targetURL.Host = safeHost // URL is safe if Host is safe
8888

8989
http.Redirect(w, req, targetURL.String(), http.StatusFound) // $ Alert
90-
}
91-
92-
func testHostFieldOverwritten(w http.ResponseWriter, req *http.Request) {
93-
safeURL := req.URL
9490

95-
safeURL.Host = "something.else.com" // safeURL is not guaranteed to be safe now that Host is overwritten
96-
http.Get(safeURL.String()) // not guaranteed to be safe
91+
targetURL.Host = "something.else.com" // targetURL is not guaranteed to be safe now that Host is overwritten
92+
http.Get(targetURL.String())
9793
}
9894

9995
func testFieldAccess(w http.ResponseWriter, req *http.Request) {

0 commit comments

Comments
 (0)