-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
2 changed files
with
32 additions
and
4 deletions.
There are no files selected for viewing
11 changes: 7 additions & 4 deletions
11
go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/TaintedPath.expected
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,13 @@ | ||
| #select | ||
| | MuxClean.go:14:29:14:74 | call to Join | MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:29:14:74 | call to Join | This path depends on a $@. | MuxClean.go:13:22:13:32 | call to Vars | user-provided value | | ||
| edges | ||
| | MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:58:14:73 | not_tainted_path | provenance | Src:MaD:524 | | ||
| | MuxClean.go:14:58:14:73 | not_tainted_path | MuxClean.go:14:29:14:74 | call to Join | provenance | FunctionModel Sink:MaD:854 | | ||
| | MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:58:14:73 | not_tainted_path | provenance | Src:MaD:2 | | ||
| | MuxClean.go:14:58:14:73 | not_tainted_path | MuxClean.go:14:29:14:74 | call to Join | provenance | FunctionModel Sink:MaD:1 | | ||
| models | ||
| | 1 | Sink: io/ioutil; ; false; ReadFile; ; ; Argument[0]; path-injection; manual | | ||
| | 2 | Source: github.com/gorilla/mux; ; true; Vars; ; ; ReturnValue; remote; manual | | ||
| nodes | ||
| | MuxClean.go:13:22:13:32 | call to Vars | semmle.label | call to Vars | | ||
| | MuxClean.go:14:29:14:74 | call to Join | semmle.label | call to Join | | ||
| | MuxClean.go:14:58:14:73 | not_tainted_path | semmle.label | not_tainted_path | | ||
| subpaths | ||
| #select | ||
| | MuxClean.go:14:29:14:74 | call to Join | MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:29:14:74 | call to Join | This path depends on a $@. | MuxClean.go:13:22:13:32 | call to Vars | user-provided value | |
25 changes: 25 additions & 0 deletions
25
go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| #select | ||
| | TaintedPath.go:17:29:17:40 | tainted_path | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:17:29:17:40 | tainted_path | This path depends on a $@. | TaintedPath.go:14:18:14:22 | selection of URL | user-provided value | | ||
| | TaintedPath.go:21:28:21:69 | call to Join | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:21:28:21:69 | call to Join | This path depends on a $@. | TaintedPath.go:14:18:14:22 | selection of URL | user-provided value | | ||
| | TaintedPath.go:68:28:68:57 | call to Clean | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:68:28:68:57 | call to Clean | This path depends on a $@. | TaintedPath.go:14:18:14:22 | selection of URL | user-provided value | | ||
| edges | ||
| | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:14:18:14:30 | call to Query | provenance | Src:MaD:2 MaD:3 | | ||
| | TaintedPath.go:14:18:14:30 | call to Query | TaintedPath.go:17:29:17:40 | tainted_path | provenance | Sink:MaD:1 | | ||
| | TaintedPath.go:14:18:14:30 | call to Query | TaintedPath.go:21:57:21:68 | tainted_path | provenance | | | ||
| | TaintedPath.go:14:18:14:30 | call to Query | TaintedPath.go:68:39:68:56 | ...+... | provenance | | | ||
| | TaintedPath.go:21:57:21:68 | tainted_path | TaintedPath.go:21:28:21:69 | call to Join | provenance | FunctionModel Sink:MaD:1 | | ||
| | TaintedPath.go:68:39:68:56 | ...+... | TaintedPath.go:68:28:68:57 | call to Clean | provenance | MaD:4 Sink:MaD:1 | | ||
| models | ||
| | 1 | Sink: io/ioutil; ; false; ReadFile; ; ; Argument[0]; path-injection; manual | | ||
| | 2 | Source: net/http; Request; true; URL; ; ; ; remote; manual | | ||
| | 3 | Summary: net/url; URL; true; Query; ; ; Argument[receiver]; ReturnValue; taint; manual | | ||
| | 4 | Summary: path; ; false; Clean; ; ; Argument[0]; ReturnValue; taint; manual | | ||
| nodes | ||
| | TaintedPath.go:14:18:14:22 | selection of URL | semmle.label | selection of URL | | ||
| | TaintedPath.go:14:18:14:30 | call to Query | semmle.label | call to Query | | ||
| | TaintedPath.go:17:29:17:40 | tainted_path | semmle.label | tainted_path | | ||
| | TaintedPath.go:21:28:21:69 | call to Join | semmle.label | call to Join | | ||
| | TaintedPath.go:21:57:21:68 | tainted_path | semmle.label | tainted_path | | ||
| | TaintedPath.go:68:28:68:57 | call to Clean | semmle.label | call to Clean | | ||
| | TaintedPath.go:68:39:68:56 | ...+... | semmle.label | ...+... | | ||
| subpaths |