Skip to content

Commit f21439a

Browse files
owen-mcowen-mc
authored
Merge pull request #18034 from owen-mc/go/mad/package-level-variables
Go: Allow package-level variables in models-as-data models
2 parents 5a18f1f + dd87b1a commit f21439a

File tree

18 files changed

+48
-12
lines changed

18 files changed

+48
-12
lines changed

‎go/ql/lib/ext/os.model.yml

+1
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ extensions:
5353
- ["os", "", False, "Open", "", "", "ReturnValue[0]", "file", "manual"]
5454
- ["os", "", False, "OpenFile", "", "", "ReturnValue[0]", "file", "manual"]
5555
- ["os", "", False, "ReadFile", "", "", "ReturnValue[0]", "file", "manual"]
56+
- ["os", "", False, "Stdin", "", "", "", "stdin", "manual"]
5657
- ["os", "", False, "UserCacheDir", "", "", "ReturnValue[0]", "environment", "manual"]
5758
- ["os", "", False, "UserConfigDir", "", "", "ReturnValue[0]", "environment", "manual"]
5859
- ["os", "", False, "UserHomeDir", "", "", "ReturnValue[0]", "environment", "manual"]

‎go/ql/lib/semmle/go/dataflow/ExternalFlow.qll

+3-2
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@
3838
* first 6 columns, and the `output` column specifies how data leaves the
3939
* element selected by the first 6 columns. An `input` can be either "",
4040
* "Argument[n]", or "Argument[n1..n2]":
41-
* - "": Selects a write to the selected element in case this is a field.
41+
* - "": Selects a write to the selected element in case this is a field or
42+
* package-level variable.
4243
* - "Argument[n]": Selects an argument in a call to the selected element.
4344
* The arguments are zero-indexed, and `receiver` specifies the receiver.
4445
* - "Argument[n1..n2]": Similar to "Argument[n]" but selects any argument
@@ -47,7 +48,7 @@
4748
* An `output` can be either "", "Argument[n]", "Argument[n1..n2]", "Parameter",
4849
* "Parameter[n]", "Parameter[n1..n2]", , "ReturnValue", "ReturnValue[n]", or
4950
* "ReturnValue[n1..n2]":
50-
* - "": Selects a read of a selected field.
51+
* - "": Selects a read of a selected field or package-level variable.
5152
* - "Argument[n]": Selects the post-update value of an argument in a call to the
5253
* selected element. That is, the value of the argument after the call returns.
5354
* The arguments are zero-indexed, and `receiver` specifies the receiver.

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll

+18
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,13 @@ module SourceSinkInterpretationInput implements
399399
c = "" and
400400
pragma[only_bind_into](e) = getElementWithQualifier(frn.getField(), frn.getBase())
401401
)
402+
or
403+
// A package-scope (or universe-scope) variable
404+
exists(Variable v | not v instanceof Field |
405+
c = "" and
406+
n.(DataFlow::ReadNode).reads(v) and
407+
pragma[only_bind_into](e).asEntity() = v
408+
)
402409
)
403410
}
404411

@@ -420,6 +427,17 @@ module SourceSinkInterpretationInput implements
420427
fw.writesField(base, f, node.asNode()) and
421428
pragma[only_bind_into](e) = getElementWithQualifier(f, base)
422429
)
430+
or
431+
// A package-scope (or universe-scope) variable
432+
exists(Node n, SourceOrSinkElement e, DataFlow::Write w, Variable v |
433+
n = node.asNode() and
434+
e = mid.asElement() and
435+
not v instanceof Field
436+
|
437+
c = "" and
438+
w.writes(v, n) and
439+
pragma[only_bind_into](e).asEntity() = v
440+
)
423441
}
424442
}
425443

‎go/ql/lib/semmle/go/frameworks/stdlib/Os.qll

-8
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,4 @@ module Os {
4343
input = inp and output = outp
4444
}
4545
}
46-
47-
private class Stdin extends SourceNode {
48-
Stdin() {
49-
exists(Variable osStdin | osStdin.hasQualifiedName("os", "Stdin") | this = osStdin.getARead())
50-
}
51-
52-
override string getThreatModel() { result = "stdin" }
53-
}
5446
}

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/completetest.ext.yml

+2
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,12 @@ extensions:
3535
pack: codeql/go-all
3636
extensible: sourceModel
3737
data:
38+
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
3839
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
3940
- addsTo:
4041
pack: codeql/go-all
4142
extensible: sinkModel
4243
data:
44+
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
4345
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
4446
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/sinks.expected

+1
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,4 @@ invalidModelRow
4343
| test.go:199:17:199:20 | arg1 | qltest |
4444
| test.go:199:23:199:26 | arg2 | qltest |
4545
| test.go:199:29:199:32 | arg3 | qltest |
46+
| test.go:202:22:202:25 | temp | qltest |

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/sinks.ext.yml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ extensions:
33
pack: codeql/go-all
44
extensible: sinkModel
55
data:
6+
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
67
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
78
- ["github.com/nonexistent/test", "B", False, "SinkMethod", "", "", "Argument[receiver]", "qltest", "manual"]
89
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/srcs.expected

+1
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ invalidModelRow
2121
| test.go:183:17:183:24 | call to Src1 | qltest |
2222
| test.go:187:24:187:31 | call to Src1 | qltest |
2323
| test.go:191:24:191:31 | call to Src1 | qltest |
24+
| test.go:201:10:201:28 | selection of SourceVariable | qltest |

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/srcs.ext.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ extensions:
33
pack: codeql/go-all
44
extensible: sourceModel
55
data:
6+
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
67
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
78
- ["github.com/nonexistent/test", "A", False, "Src2", "", "", "ReturnValue", "qltest", "manual"]
89
- ["github.com/nonexistent/test", "A", True, "Src2", "", "", "ReturnValue", "qltest-w-subtypes", "manual"]
910
- ["github.com/nonexistent/test", "A", False, "SrcArg", "", "", "Argument[0]", "qltest-arg", "manual"]
1011
- ["github.com/nonexistent/test", "A", False, "Src3", "", "", "ReturnValue[0]", "qltest", "manual"]
11-
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]
12+
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/test.go

+3
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,9 @@ func simpleflow() {
197197
arg3 := src
198198
arg4 := src
199199
b.SinkManyArgs(arg1, arg2, arg3, arg4) // $ hasTaintFlow="arg1" hasTaintFlow="arg2" hasTaintFlow="arg3"
200+
201+
temp := test.SourceVariable
202+
test.SinkVariable = temp // $ hasTaintFlow="temp"
200203
}
201204

202205
type mapstringstringtype map[string]string

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalTaintFlow/vendor/github.com/nonexistent/test/stub.go

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/completetest.ext.yml

+2
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,12 @@ extensions:
3535
pack: codeql/go-all
3636
extensible: sourceModel
3737
data:
38+
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
3839
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
3940
- addsTo:
4041
pack: codeql/go-all
4142
extensible: sinkModel
4243
data:
44+
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
4345
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
4446
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/sinks.expected

+1
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,4 @@ invalidModelRow
4949
| test.go:205:10:205:26 | call to min | qltest |
5050
| test.go:206:10:206:26 | call to min | qltest |
5151
| test.go:207:10:207:26 | call to min | qltest |
52+
| test.go:210:22:210:25 | temp | qltest |

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/sinks.ext.yml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ extensions:
33
pack: codeql/go-all
44
extensible: sinkModel
55
data:
6+
- ["github.com/nonexistent/test", "", False, "SinkVariable", "", "", "", "qltest", "manual"]
67
- ["github.com/nonexistent/test", "B", False, "Sink1", "", "", "Argument[0]", "qltest", "manual"]
78
- ["github.com/nonexistent/test", "B", False, "SinkMethod", "", "", "Argument[receiver]", "qltest", "manual"]
89
- ["github.com/nonexistent/test", "B", False, "SinkManyArgs", "", "", "Argument[0..2]", "qltest", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/srcs.expected

+1
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ invalidModelRow
2121
| test.go:183:17:183:24 | call to Src1 | qltest |
2222
| test.go:187:24:187:31 | call to Src1 | qltest |
2323
| test.go:191:24:191:31 | call to Src1 | qltest |
24+
| test.go:209:10:209:28 | selection of SourceVariable | qltest |

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/srcs.ext.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ extensions:
33
pack: codeql/go-all
44
extensible: sourceModel
55
data:
6+
- ["github.com/nonexistent/test", "", False, "SourceVariable", "", "", "", "qltest", "manual"]
67
- ["github.com/nonexistent/test", "A", False, "Src1", "", "", "ReturnValue", "qltest", "manual"]
78
- ["github.com/nonexistent/test", "A", False, "Src2", "", "", "ReturnValue", "qltest", "manual"]
89
- ["github.com/nonexistent/test", "A", True, "Src2", "", "", "ReturnValue", "qltest-w-subtypes", "manual"]
910
- ["github.com/nonexistent/test", "A", False, "SrcArg", "", "", "Argument[0]", "qltest-arg", "manual"]
1011
- ["github.com/nonexistent/test", "A", False, "Src3", "", "", "ReturnValue[0]", "qltest", "manual"]
11-
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]
12+
- ["github.com/nonexistent/test", "A", True, "Src3", "", "", "ReturnValue[1]", "qltest-w-subtypes", "manual"]

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/test.go

+3
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ func simpleflow() {
205205
b.Sink1(min(srcInt, 0, 1)) // $ hasValueFlow="call to min"
206206
b.Sink1(min(0, srcInt, 1)) // $ hasValueFlow="call to min"
207207
b.Sink1(min(0, 1, srcInt)) // $ hasValueFlow="call to min"
208+
209+
temp := test.SourceVariable
210+
test.SinkVariable = temp // $ hasValueFlow="temp"
208211
}
209212

210213
type mapstringstringtype map[string]string

‎go/ql/test/library-tests/semmle/go/dataflow/ExternalValueFlow/vendor/github.com/nonexistent/test/stub.go

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)