Skip to content

Commit ef833de

Browse files
owen-mcowen-mc
committed
Convert GithubComGinGonicGinContextSource to MaD
1 parent 06a2a40 commit ef833de

File tree

3 files changed

+36
-31
lines changed

3 files changed

+36
-31
lines changed

‎go/ql/lib/ext/github.com.gin-gonic.gin.model.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,35 @@ extensions:
55
data:
66
- ["github.com/gin-gonic/gin", "Params", True, "ByName", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
77
- ["github.com/gin-gonic/gin", "Params", True, "Get", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
8+
- addsTo:
9+
pack: codeql/go-all
10+
extensible: sourceModel
11+
data:
12+
- ["github.com/gin-gonic/gin", "Context", True, "FullPath", "", "", "ReturnValue", "remote", "manual"]
13+
- ["github.com/gin-gonic/gin", "Context", True, "GetHeader", "", "", "ReturnValue", "remote", "manual"]
14+
- ["github.com/gin-gonic/gin", "Context", True, "QueryArray", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .ArrayElement
15+
- ["github.com/gin-gonic/gin", "Context", True, "Query", "", "", "ReturnValue", "remote", "manual"]
16+
- ["github.com/gin-gonic/gin", "Context", True, "PostFormArray", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .ArrayElement
17+
- ["github.com/gin-gonic/gin", "Context", True, "PostForm", "", "", "ReturnValue", "remote", "manual"]
18+
- ["github.com/gin-gonic/gin", "Context", True, "Param", "", "", "ReturnValue", "remote", "manual"]
19+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringSlice", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .ArrayElement
20+
- ["github.com/gin-gonic/gin", "Context", True, "GetString", "", "", "ReturnValue", "remote", "manual"]
21+
- ["github.com/gin-gonic/gin", "Context", True, "GetRawData", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: should be .ArrayElement
22+
- ["github.com/gin-gonic/gin", "Context", True, "ClientIP", "", "", "ReturnValue", "remote", "manual"]
23+
- ["github.com/gin-gonic/gin", "Context", True, "ContentType", "", "", "ReturnValue", "remote", "manual"]
24+
- ["github.com/gin-gonic/gin", "Context", True, "Cookie", "", "", "ReturnValue[0]", "remote", "manual"]
25+
- ["github.com/gin-gonic/gin", "Context", True, "GetQueryArray", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: should be .ArrayElement
26+
- ["github.com/gin-gonic/gin", "Context", True, "GetQuery", "", "", "ReturnValue[0]", "remote", "manual"]
27+
- ["github.com/gin-gonic/gin", "Context", True, "GetPostFormArray", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: should be .ArrayElement
28+
- ["github.com/gin-gonic/gin", "Context", True, "GetPostForm", "", "", "ReturnValue[0]", "remote", "manual"]
29+
- ["github.com/gin-gonic/gin", "Context", True, "DefaultPostForm", "", "", "ReturnValue", "remote", "manual"]
30+
- ["github.com/gin-gonic/gin", "Context", True, "DefaultQuery", "", "", "ReturnValue", "remote", "manual"]
31+
- ["github.com/gin-gonic/gin", "Context", True, "GetPostFormMap", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: should be .MapValue (and .MapKey?)
32+
- ["github.com/gin-gonic/gin", "Context", True, "GetQueryMap", "", "", "ReturnValue[0]", "remote", "manual"] # TODO: should be .MapValue (and .MapKey?)
33+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringMap", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .MapValue (and .MapKey?)
34+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringMapString", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .MapValue (and .MapKey?)
35+
- ["github.com/gin-gonic/gin", "Context", True, "GetStringMapStringSlice", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .MapValue.ArrayElement (and .MapKey?)
36+
- ["github.com/gin-gonic/gin", "Context", True, "PostFormMap", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .MapValue (and .MapKey?)
37+
- ["github.com/gin-gonic/gin", "Context", True, "QueryMap", "", "", "ReturnValue", "remote", "manual"] # TODO: should be .MapValue (and .MapKey?)
38+
- ["github.com/gin-gonic/gin", "Context", True, "Accepted", "", "", "", "remote", "manual"]
39+
- ["github.com/gin-gonic/gin", "Context", True, "Params", "", "", "", "remote", "manual"]

‎go/ql/lib/semmle/go/frameworks/Gin.qll‎

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -9,33 +9,6 @@ private module Gin {
99
/** Gets the package name `github.com/gin-gonic/gin`. */
1010
string packagePath() { result = package("github.com/gin-gonic/gin", "") }
1111

12-
/**
13-
* Data from a `Context` struct, considered as a source of remote flow.
14-
*/
15-
private class GithubComGinGonicGinContextSource extends RemoteFlowSource::Range {
16-
GithubComGinGonicGinContextSource() {
17-
// Method calls:
18-
exists(DataFlow::MethodCallNode call, string methodName |
19-
call.getTarget().hasQualifiedName(packagePath(), "Context", methodName) and
20-
methodName in [
21-
"FullPath", "GetHeader", "QueryArray", "Query", "PostFormArray", "PostForm", "Param",
22-
"GetStringSlice", "GetString", "GetRawData", "ClientIP", "ContentType", "Cookie",
23-
"GetQueryArray", "GetQuery", "GetPostFormArray", "GetPostForm", "DefaultPostForm",
24-
"DefaultQuery", "GetPostFormMap", "GetQueryMap", "GetStringMap", "GetStringMapString",
25-
"GetStringMapStringSlice", "PostFormMap", "QueryMap"
26-
]
27-
|
28-
this = call.getResult(0)
29-
)
30-
or
31-
// Field reads:
32-
exists(DataFlow::Field fld |
33-
fld.hasQualifiedName(packagePath(), "Context", ["Accepted", "Params"]) and
34-
this = fld.getARead()
35-
)
36-
}
37-
}
38-
3912
/**
4013
* A call to a method on `Context` struct that unmarshals data into a target.
4114
*/

‎go/ql/test/library-tests/semmle/go/frameworks/Gin/TaintedPath.expected‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
edges
2-
| Gin.go:24:15:24:33 | call to Query | Gin.go:25:10:25:17 | filepath | provenance | |
3-
| Gin.go:24:15:24:33 | call to Query | Gin.go:26:39:26:46 | filepath | provenance | |
4-
| Gin.go:24:15:24:33 | call to Query | Gin.go:27:20:27:27 | filepath | provenance | |
5-
| Gin.go:24:15:24:33 | call to Query | Gin.go:29:32:29:39 | filepath | provenance | |
2+
| Gin.go:24:15:24:33 | call to Query | Gin.go:25:10:25:17 | filepath | provenance | Src:MaD:342 |
3+
| Gin.go:24:15:24:33 | call to Query | Gin.go:26:39:26:46 | filepath | provenance | Src:MaD:342 |
4+
| Gin.go:24:15:24:33 | call to Query | Gin.go:27:20:27:27 | filepath | provenance | Src:MaD:342 |
5+
| Gin.go:24:15:24:33 | call to Query | Gin.go:29:32:29:39 | filepath | provenance | Src:MaD:342 |
66
nodes
77
| Gin.go:24:15:24:33 | call to Query | semmle.label | call to Query |
88
| Gin.go:25:10:25:17 | filepath | semmle.label | filepath |

0 commit comments

Comments
 (0)