Skip to content

Commit 7adfa6b

Browse files
egregius313egregius313
authored
Merge pull request #16709 from egregius313/egregius313/go/df/threat-models/refactor-queries
Go: Refactor queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`
2 parents 8997f2c + 5bbd003 commit 7adfa6b

24 files changed

+69
-65
lines changed

‎go/ql/lib/change-notes/2024-06-08-refactor-go-queries-to-use-threatmodelflowsource.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* DataFlow queries which previously used `RemoteFlowSource` to define their sources have been modified to instead use `ThreatModelFlowSource`. This means these queries will now respect threat model configurations. The default threat model configuration is equivalent to `RemoteFlowSource`, so there should be no change in results for users using the default.

‎go/ql/lib/semmle/go/security/CommandInjectionCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,12 @@ module CommandInjection {
3131
abstract class Sanitizer extends DataFlow::Node { }
3232

3333
/**
34-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
34+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
3535
*/
36-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
36+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
3737

3838
/** A source of untrusted data, considered as a taint source for command injection. */
39-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource { }
39+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
4040

4141
/** A command name, considered as a taint sink for command injection. */
4242
class CommandNameAsSink extends Sink {

‎go/ql/lib/semmle/go/security/ExternalAPIs.qll‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -182,48 +182,48 @@ class UnknownExternalApiDataNode extends ExternalApiDataNode {
182182
/**
183183
* DEPRECATED: Use `UntrustedDataToExternalApiFlow` instead.
184184
*
185-
* A configuration for tracking flow from `RemoteFlowSource`s to `ExternalApiDataNode`s.
185+
* A configuration for tracking flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s.
186186
*/
187187
deprecated class UntrustedDataToExternalApiConfig extends TaintTracking::Configuration {
188188
UntrustedDataToExternalApiConfig() { this = "UntrustedDataToExternalAPIConfig" }
189189

190-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
190+
override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
191191

192192
override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
193193
}
194194

195195
private module UntrustedDataConfig implements DataFlow::ConfigSig {
196-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
196+
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
197197

198198
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
199199
}
200200

201201
/**
202-
* Tracks data flow from `RemoteFlowSource`s to `ExternalApiDataNode`s.
202+
* Tracks data flow from `ThreatModelFlowSource`s to `ExternalApiDataNode`s.
203203
*/
204204
module UntrustedDataToExternalApiFlow = DataFlow::Global<UntrustedDataConfig>;
205205

206206
/**
207207
* DEPRECATED: Use `UntrustedDataToUnknownExternalApiFlow` instead.
208208
*
209-
* A configuration for tracking flow from `RemoteFlowSource`s to `UnknownExternalApiDataNode`s.
209+
* A configuration for tracking flow from `ThreatModelFlowSource`s to `UnknownExternalApiDataNode`s.
210210
*/
211211
deprecated class UntrustedDataToUnknownExternalApiConfig extends TaintTracking::Configuration {
212212
UntrustedDataToUnknownExternalApiConfig() { this = "UntrustedDataToUnknownExternalAPIConfig" }
213213

214-
override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
214+
override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
215215

216216
override predicate isSink(DataFlow::Node sink) { sink instanceof UnknownExternalApiDataNode }
217217
}
218218

219219
private module UntrustedDataToUnknownExternalApiConfig implements DataFlow::ConfigSig {
220-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
220+
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelFlowSource }
221221

222222
predicate isSink(DataFlow::Node sink) { sink instanceof UnknownExternalApiDataNode }
223223
}
224224

225225
/**
226-
* Tracks data flow from `RemoteFlowSource`s to `UnknownExternalApiDataNode`s.
226+
* Tracks data flow from `ThreatModelFlowSource`s to `UnknownExternalApiDataNode`s.
227227
*/
228228
module UntrustedDataToUnknownExternalApiFlow =
229229
DataFlow::Global<UntrustedDataToUnknownExternalApiConfig>;

‎go/ql/lib/semmle/go/security/LogInjectionCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,12 @@ module LogInjection {
2626
abstract class Sanitizer extends DataFlow::Node { }
2727

2828
/**
29-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
29+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
3030
*/
31-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
31+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
3232

3333
/** A source of untrusted data, considered as a taint source for log injection. */
34-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource { }
34+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
3535

3636
/** An argument to a logging mechanism. */
3737
class LoggerSink extends Sink {

‎go/ql/lib/semmle/go/security/MissingJwtSignatureCheckCustomizations.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ module MissingJwtSignatureCheck {
4949
}
5050
}
5151

52-
private class DefaultSource extends Source instanceof RemoteFlowSource { }
52+
private class DefaultSource extends Source instanceof ThreatModelFlowSource { }
5353

5454
private class DefaultSink extends Sink {
5555
DefaultSink() { sinkNode(this, "jwt") }

‎go/ql/lib/semmle/go/security/OpenUrlRedirectCustomizations.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,15 @@ module OpenUrlRedirect {
4343
}
4444

4545
/**
46-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
46+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
4747
*/
48-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
48+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
4949

5050
/**
5151
* A source of third-party user input, considered as a flow source for URL redirects.
5252
*/
53-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource {
54-
RemoteFlowAsSource() {
53+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource {
54+
ThreatModelFlowAsSource() {
5555
// exclude some fields and methods of URLs that are generally not attacker-controllable for
5656
// open redirect exploits
5757
not this instanceof Http::Redirect::UnexploitableSource

‎go/ql/lib/semmle/go/security/ReflectedXssCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,14 @@ module ReflectedXss {
3535
}
3636

3737
/**
38-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
38+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
3939
*/
40-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
40+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
4141

4242
/**
4343
* A third-party controllable input, considered as a flow source for reflected XSS.
4444
*/
45-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource { }
45+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
4646

4747
/** An arbitrary XSS sink, considered as a flow sink for stored XSS. */
4848
private class AnySink extends Sink instanceof SharedXss::Sink { }

‎go/ql/lib/semmle/go/security/RequestForgeryCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,14 @@ module RequestForgery {
3333
abstract class SanitizerEdge extends DataFlow::Node { }
3434

3535
/**
36-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
36+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
3737
*/
38-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
38+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
3939

4040
/**
4141
* A third-party controllable input, considered as a flow source for request forgery.
4242
*/
43-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource { }
43+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
4444

4545
/**
4646
* The URL of an HTTP request, viewed as a sink for request forgery.

‎go/ql/lib/semmle/go/security/SqlInjectionCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,12 @@ module SqlInjection {
2626
abstract class Sanitizer extends DataFlow::Node { }
2727

2828
/**
29-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
29+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
3030
*/
31-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
31+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
3232

3333
/** A source of untrusted data, considered as a taint source for SQL injection. */
34-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource { }
34+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
3535

3636
/** An SQL string, considered as a taint sink for SQL injection. */
3737
class SqlQueryAsSink extends Sink instanceof SQL::QueryString { }

‎go/ql/lib/semmle/go/security/TaintedPathCustomizations.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,12 @@ module TaintedPath {
4545
}
4646

4747
/**
48-
* DEPRECATED: Use `RemoteFlowSource` or `Source` instead.
48+
* DEPRECATED: Use `ThreatModelFlowSource` or `Source` instead.
4949
*/
50-
deprecated class UntrustedFlowAsSource = RemoteFlowAsSource;
50+
deprecated class UntrustedFlowAsSource = ThreatModelFlowAsSource;
5151

5252
/** A source of untrusted data, considered as a taint source for path traversal. */
53-
private class RemoteFlowAsSource extends Source instanceof RemoteFlowSource { }
53+
private class ThreatModelFlowAsSource extends Source instanceof ThreatModelFlowSource { }
5454

5555
/** A path expression, considered as a taint sink for path traversal. */
5656
class PathAsSink extends Sink {

0 commit comments

Comments
 (0)