Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,8 @@ private predicate localAdditionalForwardTaintStep(
pred2 = pred.(DataFlow::PostUpdateNode).getPreUpdateNode()
|
referenceStep(pred2, succ) or
DataFlowPrivate::readStep(pred2, _, succ) or
elementWriteStep(pred2, succ) or
fieldReadStep(pred2, succ) or
elementStep(pred2, succ) or
tupleStep(pred2, succ) or
stringConcatStep(pred2, succ) or
Expand Down
7 changes: 7 additions & 0 deletions go/ql/test/experimental/CWE-74/DsnInjectionLocal.expected
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,13 @@
| Dsn.go:29:29:29:33 | dbDSN | Dsn.go:26:11:26:17 | selection of Args | Dsn.go:29:29:29:33 | dbDSN | This query depends on a $@. | Dsn.go:26:11:26:17 | selection of Args | user-provided value |
| Dsn.go:68:29:68:33 | dbDSN | Dsn.go:63:19:63:25 | selection of Args | Dsn.go:68:29:68:33 | dbDSN | This query depends on a $@. | Dsn.go:63:19:63:25 | selection of Args | user-provided value |
edges
| Dsn.go:26:11:26:17 | selection of Args | Dsn.go:26:11:26:21 | slice element node | provenance | Src:MaD:1 |
| Dsn.go:26:11:26:17 | selection of Args | Dsn.go:28:102:28:109 | index expression | provenance | Src:MaD:1 |
| Dsn.go:26:11:26:21 | slice element node | Dsn.go:26:11:26:21 | slice expression [array] | provenance | |
| Dsn.go:26:11:26:21 | slice expression [array] | Dsn.go:28:102:28:106 | name2 [array] | provenance | |
| Dsn.go:28:11:28:110 | []type{args} [array] | Dsn.go:28:11:28:110 | call to Sprintf | provenance | MaD:2 |
| Dsn.go:28:11:28:110 | call to Sprintf | Dsn.go:29:29:29:33 | dbDSN | provenance | |
| Dsn.go:28:102:28:106 | name2 [array] | Dsn.go:28:102:28:109 | index expression | provenance | |
| Dsn.go:28:102:28:109 | index expression | Dsn.go:28:11:28:110 | []type{args} [array] | provenance | |
| Dsn.go:28:102:28:109 | index expression | Dsn.go:28:11:28:110 | call to Sprintf | provenance | FunctionModel |
| Dsn.go:63:9:63:11 | cfg [postupdate] [pointer] | Dsn.go:67:102:67:104 | cfg [pointer] | provenance | |
Expand All @@ -23,8 +27,11 @@ models
| 2 | Summary: fmt; ; false; Sprintf; ; ; Argument[1].ArrayElement; ReturnValue; taint; manual |
nodes
| Dsn.go:26:11:26:17 | selection of Args | semmle.label | selection of Args |
| Dsn.go:26:11:26:21 | slice element node | semmle.label | slice element node |
| Dsn.go:26:11:26:21 | slice expression [array] | semmle.label | slice expression [array] |
| Dsn.go:28:11:28:110 | []type{args} [array] | semmle.label | []type{args} [array] |
| Dsn.go:28:11:28:110 | call to Sprintf | semmle.label | call to Sprintf |
| Dsn.go:28:102:28:106 | name2 [array] | semmle.label | name2 [array] |
| Dsn.go:28:102:28:109 | index expression | semmle.label | index expression |
| Dsn.go:29:29:29:33 | dbDSN | semmle.label | dbDSN |
| Dsn.go:63:9:63:11 | cfg [postupdate] [pointer] | semmle.label | cfg [postupdate] [pointer] |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
| main.go:47:2:50:2 | next range element | main.go:47:2:50:2 | extract:0 range element |
| main.go:47:2:50:2 | next range element | main.go:47:2:50:2 | extract:1 range element |
| main.go:47:20:47:21 | xs | main.go:47:2:50:2 | extract:1 range element |
| main.go:57:4:57:5 | ch | main.go:57:2:57:5 | <-... |
| strings.go:9:24:9:24 | s | strings.go:9:8:9:38 | call to Replace |
| strings.go:9:32:9:34 | "_" | strings.go:9:8:9:38 | call to Replace |
| strings.go:10:27:10:27 | s | strings.go:10:8:10:42 | call to ReplaceAll |
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "container/heap"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "container/list"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "container/ring"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
"context"
oldcontext "golang.org/x/net/context"
"time"

oldcontext "golang.org/x/net/context"
)

func TaintStepTest_ContextWithCancel_B0I0O0(sourceCQL interface{}) interface{} {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "crypto"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "crypto/cipher"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "crypto/rsa"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "database/sql/driver"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "encoding/asn1"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "errors"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "expvar"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox, with manual additions for
// go 1.19's new Append[f, ln] functions.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "html"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "io"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "mime"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "path"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "path/filepath"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "regexp"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "sort"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import "strconv"
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.

package main

import (
Expand Down Expand Up @@ -84,6 +82,12 @@ func TaintStepTest_StringsJoin_B0I0O0(sourceCQL interface{}) interface{} {
return intoString957
}

func TaintStepTest_StringsJoin_B0I0O0_WholeSlice(sourceCQL interface{}) interface{} {
fromStrings := sourceCQL.([]string)
intoString := strings.Join(fromStrings, "")
return intoString
}

func TaintStepTest_StringsJoin_B0I1O0(sourceCQL interface{}) interface{} {
fromString520 := sourceCQL.(string)
intoString443 := strings.Join(nil, fromString520)
Expand Down
Loading
Loading