Skip to content

Go: Add models-as-data content for pointer content #13454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 20, 2023
Merged

Go: Add models-as-data content for pointer content #13454

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a01169e
add "Dereference" content for PointerContent
owen-mc Jun 14, 2023
732b14e
Update pretty printing predicates
owen-mc Jun 20, 2023
04ff89e
Update access path documentation
owen-mc Jun 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,8 @@
* in the given range. The range is inclusive at both ends.
* - "ReturnValue": Selects the return value of a call to the selected element.
*
* For summaries, `input` and `output` may be prefixed by one of the following,
* separated by the "of" keyword:
* For summaries, `input` and `output` may be suffixed by any number of the
* following, separated by ".":
* - "Element": Selects an element in a collection.
* - "Field[f]": Selects the contents of field `f`.
* - "Property[p]": Selects the contents of property `p`.
Expand Down
14 changes: 14 additions & 0 deletions go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,18 @@
* return value. The return values are zero-indexed
* - "ReturnValue[n1..n2]": Similar to "ReturnValue[n]" but selects any
* return value in the given range. The range is inclusive at both ends.
*
* For summaries, `input` and `output` may be suffixed by any number of the
* following, separated by ".":
* - "Field[pkg.className.fieldname]": Selects the contents of the field `f`
* which satisfies `f.hasQualifiedName(pkg, className, fieldname)`.
* - "SyntheticField[f]": Selects the contents of the synthetic field `f`.
* - "ArrayElement": Selects an element in an array or slice.
* - "Element": Selects an element in a collection.
* - "MapKey": Selects a key in a map.
* - "MapValue": Selects a value in a map.
* - "Dereference": Selects the value referenced by a pointer.
*
* 8. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
Expand Down Expand Up @@ -342,6 +354,8 @@ predicate parseContent(string component, DataFlow::Content content) {
component = "MapKey" and content instanceof DataFlow::MapKeyContent
or
component = "MapValue" and content instanceof DataFlow::MapValueContent
or
component = "Dereference" and content instanceof DataFlow::PointerContent
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider updating the header comment in this file for input/output that it is now possible to use "Dereference" as a part of an access path.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Access paths weren't mentioned. I've copied what C# says about it and updated it to newer syntax without "of". I've taken the liberty of updating the C# one as well.

}

cached
Expand Down
2 changes: 2 additions & 0 deletions go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImplSpecific.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,8 @@ private string getContentSpecific(Content c) {
c instanceof MapKeyContent and result = "MapKey"
or
c instanceof MapValueContent and result = "MapValue"
or
c instanceof PointerContent and result = "Dereference"
}

/** Gets the textual representation of the content in the format used for flow summaries. */
Expand Down
4 changes: 2 additions & 2 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalFlow/completetest.ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ extensions:
- ["github.com/nonexistent/test", "", False, "GetMapKey", "", "", "Argument[0].MapKey", "ReturnValue", "value", "manual"]
- ["github.com/nonexistent/test", "", False, "SetElement", "", "", "Argument[0]", "ReturnValue.Element", "value", "manual"]
- ["github.com/nonexistent/test", "C", False, "Get", "", "", "Argument[-1].Field[github.com/nonexistent/test.C.F]", "ReturnValue", "value", "manual"]
- ["github.com/nonexistent/test", "C", False, "GetThroughPointer", "", "", "Argument[-1].Field[github.com/nonexistent/test.C.F]", "ReturnValue", "value", "manual"]
- ["github.com/nonexistent/test", "C", False, "GetThroughPointer", "", "", "Argument[-1].Dereference.Field[github.com/nonexistent/test.C.F]", "ReturnValue", "value", "manual"]
- ["github.com/nonexistent/test", "C", False, "Set", "", "", "Argument[0]", "Argument[-1].Field[github.com/nonexistent/test.C.F]", "value", "manual"]
- ["github.com/nonexistent/test", "C", False, "SetThroughPointer", "", "", "Argument[0]", "Argument[-1].Field[github.com/nonexistent/test.C.F]", "value", "manual"]
- ["github.com/nonexistent/test", "C", False, "SetThroughPointer", "", "", "Argument[0]", "Argument[-1].Dereference.Field[github.com/nonexistent/test.C.F]", "value", "manual"]

- addsTo:
pack: codeql/go-all
Expand Down
4 changes: 2 additions & 2 deletions go/ql/test/library-tests/semmle/go/dataflow/ExternalFlow/test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,10 +143,10 @@ func simpleflow() {

cp1 := &test.C{""}
cp1.SetThroughPointer(a.Src1().(string))
b.Sink1(cp1.F) // $ MISSING: hasTaintFlow="selection of F"
b.Sink1(cp1.F) // $ hasTaintFlow="selection of F"

cp2 := &test.C{a.Src1().(string)}
b.Sink1(cp2.GetThroughPointer()) // $ MISSING: hasTaintFlow="call to GetThroughPointer"
b.Sink1(cp2.GetThroughPointer()) // $ hasTaintFlow="call to GetThroughPointer"

cp3 := &test.C{""}
cp3.SetThroughPointer(a.Src1().(string))
Expand Down