Skip to content

Commit d240951

Browse files
owen-mcowen-mc
authored
Merge pull request #17157 from owen-mc/go/mad/change-provenance-for-package-grouping
Go: Change provenance for MaD models that use package grouping
2 parents ffd811a + f0d1740 commit d240951

File tree

8 files changed

+59
-165
lines changed

8 files changed

+59
-165
lines changed

‎go/ql/lib/semmle/go/dataflow/ExternalFlow.qll‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,8 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
183183
string package, string type, boolean subtypes, string name, string signature, string ext,
184184
string output, string kind, string provenance
185185
|
186-
sourceModel(package, type, subtypes, name, signature, ext, output, kind, provenance, madId) and
186+
FlowExtensions::sourceModel(package, type, subtypes, name, signature, ext, output, kind,
187+
provenance, madId) and
187188
model =
188189
"Source: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +
189190
ext + "; " + output + "; " + kind + "; " + provenance
@@ -193,7 +194,8 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
193194
string package, string type, boolean subtypes, string name, string signature, string ext,
194195
string input, string kind, string provenance
195196
|
196-
sinkModel(package, type, subtypes, name, signature, ext, input, kind, provenance, madId) and
197+
FlowExtensions::sinkModel(package, type, subtypes, name, signature, ext, input, kind,
198+
provenance, madId) and
197199
model =
198200
"Sink: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +
199201
ext + "; " + input + "; " + kind + "; " + provenance
@@ -203,8 +205,8 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
203205
string package, string type, boolean subtypes, string name, string signature, string ext,
204206
string input, string output, string kind, string provenance
205207
|
206-
summaryModel(package, type, subtypes, name, signature, ext, input, output, kind, provenance,
207-
madId) and
208+
FlowExtensions::summaryModel(package, type, subtypes, name, signature, ext, input, output, kind,
209+
provenance, madId) and
208210
model =
209211
"Summary: " + package + "; " + type + "; " + subtypes + "; " + name + "; " + signature + "; " +
210212
ext + "; " + input + "; " + output + "; " + kind + "; " + provenance

‎go/ql/test/library-tests/semmle/go/frameworks/Beego/ReflectedXss.expected‎

Lines changed: 39 additions & 117 deletions
Large diffs are not rendered by default.

‎go/ql/test/library-tests/semmle/go/frameworks/Beego/TaintedPath.expected‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,8 @@ edges
1717
| test.go:340:15:340:26 | call to Data | test.go:344:23:344:31 | untrusted | provenance | Src:MaD:2 |
1818
models
1919
| 1 | Summary: encoding/json; ; false; Unmarshal; ; ; Argument[0]; Argument[1]; taint; manual |
20-
| 2 | Source: github.com/astaxie/beego/context; BeegoInput; true; Data; ; ; ReturnValue[0]; remote; manual |
21-
| 2 | Source: github.com/beego/beego/context; BeegoInput; true; Data; ; ; ReturnValue[0]; remote; manual |
22-
| 2 | Source: github.com/beego/beego/server/web/context; BeegoInput; true; Data; ; ; ReturnValue[0]; remote; manual |
23-
| 3 | Source: github.com/astaxie/beego/context; BeegoInput; true; RequestBody; ; ; ; remote; manual |
24-
| 3 | Source: github.com/beego/beego/context; BeegoInput; true; RequestBody; ; ; ; remote; manual |
25-
| 3 | Source: github.com/beego/beego/server/web/context; BeegoInput; true; RequestBody; ; ; ; remote; manual |
20+
| 2 | Source: group:beego-context; BeegoInput; true; Data; ; ; ReturnValue[0]; remote; manual |
21+
| 3 | Source: group:beego-context; BeegoInput; true; RequestBody; ; ; ; remote; manual |
2622
nodes
2723
| test.go:215:15:215:26 | call to Data | semmle.label | call to Data |
2824
| test.go:216:18:216:26 | untrusted | semmle.label | untrusted |

‎go/ql/test/library-tests/semmle/go/frameworks/Revel/OpenRedirect.expected‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ edges
77
| EndToEnd.go:94:20:94:27 | selection of Params | EndToEnd.go:94:20:94:32 | selection of Form | provenance | Src:MaD:1 Config |
88
| EndToEnd.go:94:20:94:32 | selection of Form | EndToEnd.go:94:20:94:49 | call to Get | provenance | Config |
99
models
10-
| 1 | Source: github.com/revel/revel; Controller; true; Params; ; ; ; remote; manual |
11-
| 1 | Source: github.com/robfig/revel; Controller; true; Params; ; ; ; remote; manual |
10+
| 1 | Source: group:revel; Controller; true; Params; ; ; ; remote; manual |
1211
nodes
1312
| EndToEnd.go:94:20:94:27 | implicit dereference | semmle.label | implicit dereference |
1413
| EndToEnd.go:94:20:94:27 | selection of Params | semmle.label | selection of Params |

‎go/ql/test/library-tests/semmle/go/frameworks/Revel/ReflectedXss.expected‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@ edges
1515
| examples/booking/app/init.go:36:44:36:48 | selection of URL | examples/booking/app/init.go:36:44:36:53 | selection of Path | provenance | Src:MaD:3 |
1616
| examples/booking/app/init.go:40:49:40:53 | selection of URL | examples/booking/app/init.go:40:49:40:58 | selection of Path | provenance | Src:MaD:3 |
1717
models
18-
| 1 | Source: github.com/revel/revel; Controller; true; Params; ; ; ; remote; manual |
19-
| 1 | Source: github.com/robfig/revel; Controller; true; Params; ; ; ; remote; manual |
18+
| 1 | Source: group:revel; Controller; true; Params; ; ; ; remote; manual |
2019
| 2 | Summary: io; StringWriter; true; WriteString; ; ; Argument[0]; Argument[receiver]; taint; manual |
2120
| 3 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
2221
| 4 | Summary: net/url; Values; true; Get; ; ; Argument[receiver]; ReturnValue; taint; manual |

‎go/ql/test/library-tests/semmle/go/frameworks/Revel/TaintedPath.expected‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ edges
77
| EndToEnd.go:64:26:64:33 | selection of Params | EndToEnd.go:64:26:64:38 | selection of Form | provenance | Src:MaD:1 |
88
| EndToEnd.go:64:26:64:38 | selection of Form | EndToEnd.go:64:26:64:55 | call to Get | provenance | MaD:2 |
99
models
10-
| 1 | Source: github.com/revel/revel; Controller; true; Params; ; ; ; remote; manual |
11-
| 1 | Source: github.com/robfig/revel; Controller; true; Params; ; ; ; remote; manual |
10+
| 1 | Source: group:revel; Controller; true; Params; ; ; ; remote; manual |
1211
| 2 | Summary: net/url; Values; true; Get; ; ; Argument[receiver]; ReturnValue; taint; manual |
1312
nodes
1413
| EndToEnd.go:58:18:58:25 | selection of Params | semmle.label | selection of Params |

‎go/ql/test/query-tests/Security/CWE-347/MissingJwtSignatureCheck.expected‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,8 @@ edges
1515
| golang-jwt-v5.go:29:25:29:35 | signedToken | golang-jwt-v5.go:32:29:32:39 | definition of signedToken | provenance | |
1616
| golang-jwt-v5.go:32:29:32:39 | definition of signedToken | golang-jwt-v5.go:34:58:34:68 | signedToken | provenance | Sink:MaD:3 |
1717
models
18-
| 1 | Sink: github.com/go-jose/go-jose/jwt; JSONWebToken; true; UnsafeClaimsWithoutVerification; ; ; Argument[receiver]; jwt; manual |
19-
| 1 | Sink: github.com/square/go-jose/jwt; JSONWebToken; true; UnsafeClaimsWithoutVerification; ; ; Argument[receiver]; jwt; manual |
20-
| 1 | Sink: gopkg.in/go-jose/go-jose/jwt; JSONWebToken; true; UnsafeClaimsWithoutVerification; ; ; Argument[receiver]; jwt; manual |
21-
| 1 | Sink: gopkg.in/square/go-jose/jwt; JSONWebToken; true; UnsafeClaimsWithoutVerification; ; ; Argument[receiver]; jwt; manual |
22-
| 2 | Summary: github.com/go-jose/go-jose/jwt; ; true; ParseSigned; ; ; Argument[0]; ReturnValue[0]; taint; manual |
23-
| 2 | Summary: github.com/square/go-jose/jwt; ; true; ParseSigned; ; ; Argument[0]; ReturnValue[0]; taint; manual |
24-
| 2 | Summary: gopkg.in/go-jose/go-jose/jwt; ; true; ParseSigned; ; ; Argument[0]; ReturnValue[0]; taint; manual |
25-
| 2 | Summary: gopkg.in/square/go-jose/jwt; ; true; ParseSigned; ; ; Argument[0]; ReturnValue[0]; taint; manual |
18+
| 1 | Sink: group:go-jose/jwt; JSONWebToken; true; UnsafeClaimsWithoutVerification; ; ; Argument[receiver]; jwt; manual |
19+
| 2 | Summary: group:go-jose/jwt; ; true; ParseSigned; ; ; Argument[0]; ReturnValue[0]; taint; manual |
2620
| 3 | Sink: github.com/golang-jwt/jwt; Parser; true; ParseUnverified; ; ; Argument[0]; jwt; manual |
2721
| 4 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
2822
| 5 | Summary: net/url; URL; true; Query; ; ; Argument[receiver]; ReturnValue; taint; manual |

‎go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected‎

Lines changed: 7 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -124,33 +124,16 @@ models
124124
| 21 | Sink: github.com/ChrisTrenkamp/goxpath; ; true; MustParse; ; ; Argument[0]; xpath-injection; manual |
125125
| 22 | Sink: github.com/ChrisTrenkamp/goxpath; ; true; Parse; ; ; Argument[0]; xpath-injection; manual |
126126
| 23 | Sink: github.com/ChrisTrenkamp/goxpath; ; true; ParseExec; ; ; Argument[0]; xpath-injection; manual |
127-
| 24 | Sink: github.com/crankycoder/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
128-
| 24 | Sink: github.com/go-xmlpath/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
129-
| 24 | Sink: github.com/going/toolkit/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
130-
| 24 | Sink: github.com/masterzen/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
131-
| 24 | Sink: gopkg.in/go-xmlpath/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
132-
| 24 | Sink: gopkg.in/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
133-
| 24 | Sink: launchpad.net/xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
134-
| 25 | Sink: github.com/crankycoder/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
135-
| 25 | Sink: github.com/go-xmlpath/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
136-
| 25 | Sink: github.com/going/toolkit/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
137-
| 25 | Sink: github.com/masterzen/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
138-
| 25 | Sink: gopkg.in/go-xmlpath/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
139-
| 25 | Sink: gopkg.in/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
140-
| 25 | Sink: launchpad.net/xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
127+
| 24 | Sink: group:xmlpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
128+
| 25 | Sink: group:xmlpath; ; true; MustCompile; ; ; Argument[0]; xpath-injection; manual |
141129
| 26 | Sink: github.com/lestrrat-go/libxml2/parser; Parser; true; Parse; ; ; Argument[0]; xpath-injection; manual |
142130
| 27 | Sink: github.com/lestrrat-go/libxml2/parser; Parser; true; ParseReader; ; ; Argument[0]; xpath-injection; manual |
143131
| 28 | Sink: github.com/lestrrat-go/libxml2/parser; Parser; true; ParseString; ; ; Argument[0]; xpath-injection; manual |
144-
| 29 | Sink: github.com/jbowtie/gokogiri/xml; Node; true; Search; ; ; Argument[0]; xpath-injection; manual |
145-
| 29 | Sink: github.com/moovweb/gokogiri/xml; Node; true; Search; ; ; Argument[0]; xpath-injection; manual |
146-
| 30 | Sink: github.com/jbowtie/gokogiri/xml; Node; true; SearchWithVariables; ; ; Argument[0]; xpath-injection; manual |
147-
| 30 | Sink: github.com/moovweb/gokogiri/xml; Node; true; SearchWithVariables; ; ; Argument[0]; xpath-injection; manual |
148-
| 31 | Sink: github.com/jbowtie/gokogiri/xml; Node; true; EvalXPath; ; ; Argument[0]; xpath-injection; manual |
149-
| 31 | Sink: github.com/moovweb/gokogiri/xml; Node; true; EvalXPath; ; ; Argument[0]; xpath-injection; manual |
150-
| 32 | Sink: github.com/jbowtie/gokogiri/xml; Node; true; EvalXPathAsBoolean; ; ; Argument[0]; xpath-injection; manual |
151-
| 32 | Sink: github.com/moovweb/gokogiri/xml; Node; true; EvalXPathAsBoolean; ; ; Argument[0]; xpath-injection; manual |
152-
| 33 | Sink: github.com/jbowtie/gokogiri/xpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
153-
| 33 | Sink: github.com/moovweb/gokogiri/xpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
132+
| 29 | Sink: group:gokogiri/xml; Node; true; Search; ; ; Argument[0]; xpath-injection; manual |
133+
| 30 | Sink: group:gokogiri/xml; Node; true; SearchWithVariables; ; ; Argument[0]; xpath-injection; manual |
134+
| 31 | Sink: group:gokogiri/xml; Node; true; EvalXPath; ; ; Argument[0]; xpath-injection; manual |
135+
| 32 | Sink: group:gokogiri/xml; Node; true; EvalXPathAsBoolean; ; ; Argument[0]; xpath-injection; manual |
136+
| 33 | Sink: group:gokogiri/xpath; ; true; Compile; ; ; Argument[0]; xpath-injection; manual |
154137
| 34 | Sink: github.com/santhosh-tekuri/xpathparser; ; true; Parse; ; ; Argument[0]; xpath-injection; manual |
155138
| 35 | Sink: github.com/santhosh-tekuri/xpathparser; ; true; MustParse; ; ; Argument[0]; xpath-injection; manual |
156139
| 36 | Source: net/http; Request; true; Form; ; ; ; remote; manual |

0 commit comments

Comments
 (0)