Skip to content

Commit e059c93

Browse files
asgerfasgerf
committed
Go: mass enable diff-informed data flow
1 parent 772b972 commit e059c93

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+264
-1
lines changed

‎go/ql/lib/semmle/go/StringOps.qll

+6
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,12 @@ module StringOps {
231231
call.getTarget().hasQualifiedName("strings", "Replacer", ["Replace", "WriteString"])
232232
)
233233
}
234+
235+
predicate observeDiffInformedIncrementalMode() {
236+
// TODO(diff-informed): Manually verify if config can be diff-informed.
237+
// go/ql/lib/semmle/go/StringOps.qll:250: Flow call outside 'select' clause
238+
none()
239+
}
234240
}
235241

236242
/**

‎go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll

+8
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ module AllocationSizeOverflow {
1919
predicate isSink(DataFlow::Node nd) { nd = Builtin::len().getACall().getArgument(0) }
2020

2121
predicate isBarrier(DataFlow::Node nd) { nd instanceof Sanitizer }
22+
23+
predicate observeDiffInformedIncrementalMode() {
24+
// TODO(diff-informed): Manually verify if config can be diff-informed.
25+
// go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll:30: Flow call outside 'select' clause
26+
none()
27+
}
2228
}
2329

2430
/**
@@ -56,6 +62,8 @@ module AllocationSizeOverflow {
5662
succ = c
5763
)
5864
}
65+
66+
predicate observeDiffInformedIncrementalMode() { any() }
5967
}
6068

6169
/** Tracks taint flow to find allocation-size overflows. */

‎go/ql/lib/semmle/go/security/CleartextLogging.qll

+2
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ module CleartextLogging {
4646
// Also exclude protobuf field fetches, since they amount to single field reads.
4747
not any(Protobuf::GetMethod gm).taintStep(src, trg)
4848
}
49+
50+
predicate observeDiffInformedIncrementalMode() { any() }
4951
}
5052

5153
/**

‎go/ql/lib/semmle/go/security/CommandInjection.qll

+4
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ module CommandInjection {
2424
}
2525

2626
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
27+
28+
predicate observeDiffInformedIncrementalMode() { any() }
2729
}
2830

2931
/**
@@ -80,6 +82,8 @@ module CommandInjection {
8082
node instanceof Sanitizer or
8183
node = any(ArgumentArrayWithDoubleDash array).getASanitizedElement()
8284
}
85+
86+
predicate observeDiffInformedIncrementalMode() { any() }
8387
}
8488

8589
/**

‎go/ql/lib/semmle/go/security/ExternalAPIs.qll

+9
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,13 @@ private module UntrustedDataConfig implements DataFlow::ConfigSig {
186186
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
187187

188188
predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
189+
190+
predicate observeDiffInformedIncrementalMode() {
191+
// TODO(diff-informed): Manually verify if config can be diff-informed.
192+
// go/ql/lib/semmle/go/security/ExternalAPIs.qll:210: Flow call outside 'select' clause
193+
// go/ql/lib/semmle/go/security/ExternalAPIs.qll:213: Flow call outside 'select' clause
194+
none()
195+
}
189196
}
190197

191198
/**
@@ -197,6 +204,8 @@ private module UntrustedDataToUnknownExternalApiConfig implements DataFlow::Conf
197204
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
198205

199206
predicate isSink(DataFlow::Node sink) { sink instanceof UnknownExternalApiDataNode }
207+
208+
predicate observeDiffInformedIncrementalMode() { any() }
200209
}
201210

202211
/**

‎go/ql/lib/semmle/go/security/HardcodedCredentials.qll

+2
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ module HardcodedCredentials {
3030
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
3131

3232
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
33+
34+
predicate observeDiffInformedIncrementalMode() { any() }
3335
}
3436

3537
/** Tracks taint flow for reasoning about hardcoded credentials. */

‎go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll

+2
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,8 @@ private module ConversionWithoutBoundsCheckConfig implements DataFlow::StateConf
440440
state2 = node2.(FlowStateTransformer).transform(state1) and
441441
DataFlow::simpleLocalFlowStep(node1, node2, _)
442442
}
443+
444+
predicate observeDiffInformedIncrementalMode() { any() }
443445
}
444446

445447
/**

‎go/ql/lib/semmle/go/security/InsecureRandomness.qll

+2
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ module InsecureRandomness {
3939
n2.getType() instanceof IntegerType
4040
)
4141
}
42+
43+
predicate observeDiffInformedIncrementalMode() { any() }
4244
}
4345

4446
/**

‎go/ql/lib/semmle/go/security/LogInjection.qll

+7
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,13 @@ module LogInjection {
2121
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2222

2323
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof Sanitizer }
24+
25+
predicate observeDiffInformedIncrementalMode() {
26+
// TODO(diff-informed): Manually verify if config can be diff-informed.
27+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:122: Flow call outside 'select' clause
28+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:140: Flow call outside 'select' clause
29+
none()
30+
}
2431
}
2532

2633
/** Tracks taint flow for reasoning about log injection vulnerabilities. */

‎go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll

+8
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ module MissingJwtSignatureCheck {
2323
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
2424
any(AdditionalFlowStep s).step(nodeFrom, nodeTo)
2525
}
26+
27+
predicate observeDiffInformedIncrementalMode() { any() }
2628
}
2729

2830
/** Tracks taint flow for reasoning about JWT vulnerabilities. */
@@ -36,6 +38,12 @@ module MissingJwtSignatureCheck {
3638
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
3739
any(AdditionalFlowStep s).step(nodeFrom, nodeTo)
3840
}
41+
42+
predicate observeDiffInformedIncrementalMode() {
43+
// TODO(diff-informed): Manually verify if config can be diff-informed.
44+
// go/ql/lib/semmle/go/security/MissingJwtSignatureCheck.qll:18: Flow call outside 'select' clause
45+
none()
46+
}
3947
}
4048

4149
private module SafeParse = TaintTracking::Global<SafeParseConfig>;

‎go/ql/lib/semmle/go/security/OpenUrlRedirect.qll

+2
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ module OpenUrlRedirect {
5454
or
5555
hostnameSanitizingPrefixEdge(node, _)
5656
}
57+
58+
predicate observeDiffInformedIncrementalMode() { any() }
5759
}
5860

5961
/** Tracks taint flow from unvalidated, untrusted data to URL redirections. */

‎go/ql/lib/semmle/go/security/ReflectedXss.qll

+2
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ module ReflectedXss {
2222
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2323

2424
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
25+
26+
predicate observeDiffInformedIncrementalMode() { any() }
2527
}
2628

2729
/** Tracks taint flow from untrusted data to XSS attack vectors. */

‎go/ql/lib/semmle/go/security/RequestForgery.qll

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ module RequestForgery {
3131
w.writesField(v.getAUse(), f, pred) and succ = v.getAUse()
3232
)
3333
}
34+
35+
predicate observeDiffInformedIncrementalMode() { any() }
3436
}
3537

3638
/** Tracks taint flow from untrusted data to request forgery attack vectors. */

‎go/ql/lib/semmle/go/security/SafeUrlFlow.qll

+2
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ module SafeUrlFlow {
3636
or
3737
node instanceof SanitizerEdge
3838
}
39+
40+
predicate observeDiffInformedIncrementalMode() { any() }
3941
}
4042

4143
/** Tracks taint flow for reasoning about safe URLs. */

‎go/ql/lib/semmle/go/security/SqlInjection.qll

+2
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ module SqlInjection {
2323
}
2424

2525
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
26+
27+
predicate observeDiffInformedIncrementalMode() { any() }
2628
}
2729

2830
/** Tracks taint flow for reasoning about SQL-injection vulnerabilities. */

‎go/ql/lib/semmle/go/security/StoredCommand.qll

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ module StoredCommand {
2626
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjection::Sink }
2727

2828
predicate isBarrier(DataFlow::Node node) { node instanceof CommandInjection::Sanitizer }
29+
30+
predicate observeDiffInformedIncrementalMode() { any() }
2931
}
3032

3133
/** Tracks taint flow for reasoning about command-injection vulnerabilities. */

‎go/ql/lib/semmle/go/security/StoredXss.qll

+2
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ module StoredXss {
2222
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2323

2424
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
25+
26+
predicate observeDiffInformedIncrementalMode() { any() }
2527
}
2628

2729
/** Tracks taint flow for reasoning about XSS. */

‎go/ql/lib/semmle/go/security/StringBreak.qll

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ module StringBreak {
2626
predicate isBarrier(DataFlow::Node node, FlowState state) {
2727
state = node.(Sanitizer).getQuote()
2828
}
29+
30+
predicate observeDiffInformedIncrementalMode() { any() }
2931
}
3032

3133
/**

‎go/ql/lib/semmle/go/security/TaintedPath.qll

+2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ module TaintedPath {
1717
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
1818

1919
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
20+
21+
predicate observeDiffInformedIncrementalMode() { any() }
2022
}
2123

2224
/** Tracks taint flow for reasoning about path-traversal vulnerabilities. */

‎go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll

+10
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,16 @@ module UncontrolledAllocationSize {
2727
node2 = cn.getResult(0)
2828
)
2929
}
30+
31+
predicate observeDiffInformedIncrementalMode() {
32+
// TODO(diff-informed): Manually verify if config can be diff-informed.
33+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:114: Flow call outside 'select' clause
34+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:122: Flow call outside 'select' clause
35+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:122: Flow call outside 'select' clause
36+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:139: Flow call outside 'select' clause
37+
// shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll:140: Flow call outside 'select' clause
38+
none()
39+
}
3040
}
3141

3242
/** Tracks taint flow for reasoning about uncontrolled allocation size issues. */

‎go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll

+8
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,12 @@ module UnsafeUnzipSymlink {
2020
predicate isSink(DataFlow::Node sink) { sink instanceof EvalSymlinksSink }
2121

2222
predicate isBarrier(DataFlow::Node node) { node instanceof EvalSymlinksInvalidator }
23+
24+
predicate observeDiffInformedIncrementalMode() {
25+
// TODO(diff-informed): Manually verify if config can be diff-informed.
26+
// go/ql/lib/semmle/go/security/UnsafeUnzipSymlink.qll:35: Flow call outside 'select' clause
27+
none()
28+
}
2329
}
2430

2531
/**
@@ -44,6 +50,8 @@ module UnsafeUnzipSymlink {
4450
predicate isSink(DataFlow::Node sink) { sink instanceof SymlinkSink }
4551

4652
predicate isBarrier(DataFlow::Node node) { node instanceof SymlinkSanitizer }
53+
54+
predicate observeDiffInformedIncrementalMode() { any() }
4755
}
4856

4957
/**

‎go/ql/lib/semmle/go/security/XPathInjection.qll

+2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ module XPathInjection {
1919
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2020

2121
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
22+
23+
predicate observeDiffInformedIncrementalMode() { any() }
2224
}
2325

2426
/**

‎go/ql/lib/semmle/go/security/ZipSlip.qll

+2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ module ZipSlip {
1717
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
1818

1919
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
20+
21+
predicate observeDiffInformedIncrementalMode() { any() }
2022
}
2123

2224
/** Tracks taint flow for reasoning about zip-slip vulnerabilities. */

‎go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql

+2
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,8 @@ module UnhandledFileCloseConfig implements DataFlow::ConfigSig {
127127
predicate isSource(DataFlow::Node source) { isWritableFileHandle(source, _) }
128128

129129
predicate isSink(DataFlow::Node sink) { isCloseSink(sink, _) }
130+
131+
predicate observeDiffInformedIncrementalMode() { any() }
130132
}
131133

132134
/**

‎go/ql/src/Security/CWE-020/IncompleteHostnameRegexp.ql

+2
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,8 @@ module IncompleteHostNameRegexpConfig implements DataFlow::ConfigSig {
103103
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
104104
StringOps::Concatenation::taintStep(node1, node2)
105105
}
106+
107+
predicate observeDiffInformedIncrementalMode() { any() }
106108
}
107109

108110
module Flow = DataFlow::Global<IncompleteHostNameRegexpConfig>;

‎go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql

+2
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ module Config implements DataFlow::ConfigSig {
7272
predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
7373

7474
predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
75+
76+
predicate observeDiffInformedIncrementalMode() { any() }
7577
}
7678

7779
module Flow = DataFlow::Global<Config>;

‎go/ql/src/Security/CWE-020/SuspiciousCharacterInRegexp.ql

+2
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ module SuspiciousCharacterInRegexpConfig implements DataFlow::ConfigSig {
4040
predicate isSource(DataFlow::Node source) { isSourceString(source, _) }
4141

4242
predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
43+
44+
predicate observeDiffInformedIncrementalMode() { any() }
4345
}
4446

4547
/**

‎go/ql/src/Security/CWE-209/StackTraceExposure.ql

+2
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ module StackTraceExposureConfig implements DataFlow::ConfigSig {
6262
cgn.dominates(node.getBasicBlock())
6363
)
6464
}
65+
66+
predicate observeDiffInformedIncrementalMode() { any() }
6567
}
6668

6769
/**

‎go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql

+7
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,13 @@ module Config implements DataFlow::ConfigSig {
6868
}
6969

7070
predicate isSink(DataFlow::Node sink) { writeIsSink(sink, _) }
71+
72+
predicate observeDiffInformedIncrementalMode() {
73+
// TODO(diff-informed): Manually verify if config can be diff-informed.
74+
// go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql:90: Flow call outside 'select' clause
75+
// go/ql/src/Security/CWE-322/InsecureHostKeyCallback.ql:96: Flow call outside 'select' clause
76+
none()
77+
}
7178
}
7279

7380
/**

‎go/ql/src/Security/CWE-326/InsufficientKeySize.ql

+2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ module Config implements DataFlow::ConfigSig {
2525
predicate isBarrier(DataFlow::Node node) {
2626
node = DataFlow::BarrierGuard<comparisonBarrierGuard/3>::getABarrierNode()
2727
}
28+
29+
predicate observeDiffInformedIncrementalMode() { any() }
2830
}
2931

3032
/**

‎go/ql/src/Security/CWE-327/InsecureTLS.ql

+13
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,13 @@ module TlsVersionFlowConfig implements DataFlow::ConfigSig {
7171
predicate isSource(DataFlow::Node source) { intIsSource(source, _) }
7272

7373
predicate isSink(DataFlow::Node sink) { isSink(sink, _, _, _) }
74+
75+
predicate observeDiffInformedIncrementalMode() {
76+
// TODO(diff-informed): Manually verify if config can be diff-informed.
77+
// go/ql/src/Security/CWE-327/InsecureTLS.ql:87: Flow call outside 'select' clause
78+
// go/ql/src/Security/CWE-327/InsecureTLS.ql:128: Flow call outside 'select' clause
79+
none()
80+
}
7481
}
7582

7683
/**
@@ -201,6 +208,12 @@ module TlsInsecureCipherSuitesFlowConfig implements DataFlow::ConfigSig {
201208
* suites.
202209
*/
203210
predicate isBarrierOut(DataFlow::Node node) { isSink(node) }
211+
212+
predicate observeDiffInformedIncrementalMode() {
213+
// TODO(diff-informed): Manually verify if config can be diff-informed.
214+
// go/ql/src/Security/CWE-327/InsecureTLS.ql:221: Flow call outside 'select' clause
215+
none()
216+
}
204217
}
205218

206219
/**

0 commit comments

Comments
 (0)