Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Go: Allow package-level variables in models-as-data models #18034

Merged
merged 2 commits into from
Nov 19, 2024
Merged

Go: Allow package-level variables in models-as-data models #18034

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf824ca
Allow package-level variables in MaD
owen-mc Nov 19, 2024
dd87b1a
Convert `os.stdin` model to MaD
owen-mc Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go/ql/lib/ext/os.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ extensions:
- ["os", "", False, "Open", "", "", "ReturnValue[0]", "file", "manual"]
- ["os", "", False, "OpenFile", "", "", "ReturnValue[0]", "file", "manual"]
- ["os", "", False, "ReadFile", "", "", "ReturnValue[0]", "file", "manual"]
- ["os", "", False, "Stdin", "", "", "", "stdin", "manual"]
- ["os", "", False, "UserCacheDir", "", "", "ReturnValue[0]", "environment", "manual"]
- ["os", "", False, "UserConfigDir", "", "", "ReturnValue[0]", "environment", "manual"]
- ["os", "", False, "UserHomeDir", "", "", "ReturnValue[0]", "environment", "manual"]
5 changes: 3 additions & 2 deletions go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@
* first 6 columns, and the `output` column specifies how data leaves the
* element selected by the first 6 columns. An `input` can be either "",
* "Argument[n]", or "Argument[n1..n2]":
* - "": Selects a write to the selected element in case this is a field.
* - "": Selects a write to the selected element in case this is a field or
* package-level variable.
* - "Argument[n]": Selects an argument in a call to the selected element.
* The arguments are zero-indexed, and `receiver` specifies the receiver.
* - "Argument[n1..n2]": Similar to "Argument[n]" but selects any argument
Expand All @@ -47,7 +48,7 @@
* An `output` can be either "", "Argument[n]", "Argument[n1..n2]", "Parameter",
* "Parameter[n]", "Parameter[n1..n2]", , "ReturnValue", "ReturnValue[n]", or
* "ReturnValue[n1..n2]":
* - "": Selects a read of a selected field.
* - "": Selects a read of a selected field or package-level variable.
* - "Argument[n]": Selects the post-update value of an argument in a call to the
* selected element. That is, the value of the argument after the call returns.
* The arguments are zero-indexed, and `receiver` specifies the receiver.
Expand Down
18 changes: 18 additions & 0 deletions go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,6 +399,13 @@ module SourceSinkInterpretationInput implements
c = "" and
pragma[only_bind_into](e) = getElementWithQualifier(frn.getField(), frn.getBase())
)
or
// A package-scope (or universe-scope) variable
exists(Variable v | not v instanceof Field |
c = "" and
n.(DataFlow::ReadNode).reads(v) and
pragma[only_bind_into](e).asEntity() = v
)
)
}

Expand All @@ -420,6 +427,17 @@ module SourceSinkInterpretationInput implements
fw.writesField(base, f, node.asNode()) and
pragma[only_bind_into](e) = getElementWithQualifier(f, base)
)
or
// A package-scope (or universe-scope) variable
exists(Node n, SourceOrSinkElement e, DataFlow::Write w, Variable v |
n = node.asNode() and
e = mid.asElement() and
not v instanceof Field
|
c = "" and
w.writes(v, n) and
pragma[only_bind_into](e).asEntity() = v
)
}
}

Expand Down
8 changes: 0 additions & 8 deletions go/ql/lib/semmle/go/frameworks/stdlib/Os.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,12 +43,4 @@ module Os {
input = inp and output = outp
}
}

private class Stdin extends SourceNode {
Stdin() {
exists(Variable osStdin | osStdin.hasQualifiedName("os", "Stdin") | this = osStdin.getARead())
}

override string getThreatModel() { result = "stdin" }
}
}
2 changes: 2 additions & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/completetest.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,12 @@ extensions:
pack: codeql/go-all
extensible: sourceModel
data:
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
- addsTo:
pack: codeql/go-all
extensible: sinkModel
data:
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]
1 change: 1 addition & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/sinks.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,4 @@ invalidModelRow
| test.go:199:17:199:20 | arg1 | qltest |
| test.go:199:23:199:26 | arg2 | qltest |
| test.go:199:29:199:32 | arg3 | qltest |
| test.go:202:22:202:25 | temp | qltest |
1 change: 1 addition & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/sinks.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ extensions:
pack: codeql/go-all
extensible: sinkModel
data:
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "SinkMethod", "", "", "Argument[receiver]", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]
1 change: 1 addition & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/srcs.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,4 @@ invalidModelRow
| test.go:183:17:183:24 | call to Src1 | qltest |
| test.go:187:24:187:31 | call to Src1 | qltest |
| test.go:191:24:191:31 | call to Src1 | qltest |
| test.go:201:10:201:28 | selection of SourceVariable | qltest |
3 changes: 2 additions & 1 deletion go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/srcs.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@ extensions:
pack: codeql/go-all
extensible: sourceModel
data:
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src2", "", "", "ReturnValue", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", True, "Src2", "", "", "ReturnValue", "qltest-w-subtypes", "manual"]
- ["github.com/nonexistent/test", "A", False, "SrcArg", "", "", "Argument[0]", "qltest-arg", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src3", "", "", "ReturnValue[0]", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]
3 changes: 3 additions & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,9 @@ func simpleflow() {
arg3 := src
arg4 := src
b.SinkManyArgs(arg1, arg2, arg3, arg4) // $ hasTaintFlow="arg1" hasTaintFlow="arg2" hasTaintFlow="arg3"

temp := test.SourceVariable
test.SinkVariable = temp // $ hasTaintFlow="temp"
}

type mapstringstringtype map[string]string
Expand Down
3 changes: 3 additions & 0 deletions ...ary-tests/semmle/go/dataflow/ExternalTaintFlow/vendor/github.com/nonexistent/test/stub.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/completetest.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,12 @@ extensions:
pack: codeql/go-all
extensible: sourceModel
data:
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
- addsTo:
pack: codeql/go-all
extensible: sinkModel
data:
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]
1 change: 1 addition & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/sinks.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,3 +49,4 @@ invalidModelRow
| test.go:205:10:205:26 | call to min | qltest |
| test.go:206:10:206:26 | call to min | qltest |
| test.go:207:10:207:26 | call to min | qltest |
| test.go:210:22:210:25 | temp | qltest |
1 change: 1 addition & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/sinks.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ extensions:
pack: codeql/go-all
extensible: sinkModel
data:
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "SinkMethod", "", "", "Argument[receiver]", "qltest", "manual"]
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]
1 change: 1 addition & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/srcs.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,4 @@ invalidModelRow
| test.go:183:17:183:24 | call to Src1 | qltest |
| test.go:187:24:187:31 | call to Src1 | qltest |
| test.go:191:24:191:31 | call to Src1 | qltest |
| test.go:209:10:209:28 | selection of SourceVariable | qltest |
3 changes: 2 additions & 1 deletion go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/srcs.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@ extensions:
pack: codeql/go-all
extensible: sourceModel
data:
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src2", "", "", "ReturnValue", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", True, "Src2", "", "", "ReturnValue", "qltest-w-subtypes", "manual"]
- ["github.com/nonexistent/test", "A", False, "SrcArg", "", "", "Argument[0]", "qltest-arg", "manual"]
- ["github.com/nonexistent/test", "A", False, "Src3", "", "", "ReturnValue[0]", "qltest", "manual"]
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]
3 changes: 3 additions & 0 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,9 @@ func simpleflow() {
b.Sink1(min(srcInt, 0, 1)) // $ hasValueFlow="call to min"
b.Sink1(min(0, srcInt, 1)) // $ hasValueFlow="call to min"
b.Sink1(min(0, 1, srcInt)) // $ hasValueFlow="call to min"

temp := test.SourceVariable
test.SinkVariable = temp // $ hasValueFlow="temp"
}

type mapstringstringtype map[string]string
Expand Down
3 changes: 3 additions & 0 deletions ...ary-tests/semmle/go/dataflow/ExternalValueFlow/vendor/github.com/nonexistent/test/stub.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.