Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit afbbe64

Browse files
gagliardettogagliardetto
committed
Move strings module to stdlib, and add more taint-tracking classes to it.
1 parent e5da52b commit afbbe64

File tree

3 files changed

+726
-64
lines changed

3 files changed

+726
-64
lines changed

‎ql/src/semmle/go/frameworks/Stdlib.qll‎

Lines changed: 1 addition & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import semmle.go.frameworks.stdlib.CompressGzip
1313
import semmle.go.frameworks.stdlib.CompressLzw
1414
import semmle.go.frameworks.stdlib.CompressZlib
1515
import semmle.go.frameworks.stdlib.Strconv
16+
import semmle.go.frameworks.stdlib.Strings
1617

1718
/** A `String()` method. */
1819
class StringMethod extends TaintTracking::FunctionModel, Method {
@@ -537,70 +538,6 @@ module IntegerParser {
537538
}
538539
}
539540

540-
/** Provides models of commonly used functions in the `strings` package. */
541-
module Strings {
542-
/** The `Join` function. */
543-
class Join extends TaintTracking::FunctionModel {
544-
Join() { hasQualifiedName("strings", "Join") }
545-
546-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
547-
inp.isParameter([0 .. 1]) and outp.isResult()
548-
}
549-
}
550-
551-
/** The `Repeat` function. */
552-
class Repeat extends TaintTracking::FunctionModel {
553-
Repeat() { hasQualifiedName("strings", "Repeat") }
554-
555-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
556-
inp.isParameter(0) and outp.isResult()
557-
}
558-
}
559-
560-
/** The `Replace` or `ReplaceAll` function. */
561-
class Replacer extends TaintTracking::FunctionModel {
562-
Replacer() {
563-
hasQualifiedName("strings", "Replace") or hasQualifiedName("strings", "ReplaceAll")
564-
}
565-
566-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
567-
(inp.isParameter(0) or inp.isParameter(2)) and
568-
outp.isResult()
569-
}
570-
}
571-
572-
/** The `Split` function or one of its variants. */
573-
class Splitter extends TaintTracking::FunctionModel {
574-
Splitter() {
575-
exists(string split | split.matches("Split%") | hasQualifiedName("strings", split))
576-
}
577-
578-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
579-
inp.isParameter(0) and outp.isResult()
580-
}
581-
}
582-
583-
/** One of the case-converting functions in the `strings` package. */
584-
class CaseConverter extends TaintTracking::FunctionModel {
585-
CaseConverter() {
586-
exists(string conv | conv.matches("To%") | hasQualifiedName("strings", conv))
587-
}
588-
589-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
590-
inp.isParameter(getNumParameter() - 1) and outp.isResult()
591-
}
592-
}
593-
594-
/** The `Trim` function or one of its variants. */
595-
class Trimmer extends TaintTracking::FunctionModel {
596-
Trimmer() { exists(string split | split.matches("Trim%") | hasQualifiedName("strings", split)) }
597-
598-
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
599-
inp.isParameter(0) and outp.isResult()
600-
}
601-
}
602-
}
603-
604541
/** Provides models of commonly used functions in the `text/template` package. */
605542
module Template {
606543
private class TemplateEscape extends EscapeFunction::Range {

‎ql/src/semmle/go/frameworks/stdlib/Strings.qll‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `strings` package.
3+
*/
4+
5+
import go
6+
7+
/** Provides models of commonly used functions in the `strings` package. */
8+
module Strings {
9+
private class FunctionModels extends TaintTracking::FunctionModel {
10+
FunctionInput inp;
11+
FunctionOutput outp;
12+
13+
FunctionModels() {
14+
// signature: func Fields(s string) []string
15+
hasQualifiedName("strings", "Fields") and
16+
(inp.isParameter(0) and outp.isResult())
17+
or
18+
// signature: func FieldsFunc(s string, f func(rune) bool) []string
19+
hasQualifiedName("strings", "FieldsFunc") and
20+
(inp.isParameter(0) and outp.isResult())
21+
or
22+
// signature: func Join(elems []string, sep string) string
23+
hasQualifiedName("strings", "Join") and
24+
(inp.isParameter(_) and outp.isResult())
25+
or
26+
// signature: func Map(mapping func(rune) rune, s string) string
27+
hasQualifiedName("strings", "Map") and
28+
(inp.isParameter(1) and outp.isResult())
29+
or
30+
// signature: func NewReader(s string) *Reader
31+
hasQualifiedName("strings", "NewReader") and
32+
(inp.isParameter(0) and outp.isResult())
33+
or
34+
// signature: func NewReplacer(oldnew ...string) *Replacer
35+
hasQualifiedName("strings", "NewReplacer") and
36+
(inp.isParameter(_) and outp.isResult())
37+
or
38+
// signature: func Repeat(s string, count int) string
39+
hasQualifiedName("strings", "Repeat") and
40+
(inp.isParameter(0) and outp.isResult())
41+
or
42+
// signature: func Replace(s string, old string, new string, n int) string
43+
hasQualifiedName("strings", "Replace") and
44+
(inp.isParameter([0, 2]) and outp.isResult())
45+
or
46+
// signature: func ReplaceAll(s string, old string, new string) string
47+
hasQualifiedName("strings", "ReplaceAll") and
48+
(inp.isParameter([0, 2]) and outp.isResult())
49+
or
50+
// signature: func Split(s string, sep string) []string
51+
hasQualifiedName("strings", "Split") and
52+
(inp.isParameter(0) and outp.isResult())
53+
or
54+
// signature: func SplitAfter(s string, sep string) []string
55+
hasQualifiedName("strings", "SplitAfter") and
56+
(inp.isParameter(0) and outp.isResult())
57+
or
58+
// signature: func SplitAfterN(s string, sep string, n int) []string
59+
hasQualifiedName("strings", "SplitAfterN") and
60+
(inp.isParameter(0) and outp.isResult())
61+
or
62+
// signature: func SplitN(s string, sep string, n int) []string
63+
hasQualifiedName("strings", "SplitN") and
64+
(inp.isParameter(0) and outp.isResult())
65+
or
66+
// signature: func Title(s string) string
67+
hasQualifiedName("strings", "Title") and
68+
(inp.isParameter(0) and outp.isResult())
69+
or
70+
// signature: func ToLower(s string) string
71+
hasQualifiedName("strings", "ToLower") and
72+
(inp.isParameter(0) and outp.isResult())
73+
or
74+
// signature: func ToLowerSpecial(c unicode.SpecialCase, s string) string
75+
hasQualifiedName("strings", "ToLowerSpecial") and
76+
(inp.isParameter(1) and outp.isResult())
77+
or
78+
// signature: func ToTitle(s string) string
79+
hasQualifiedName("strings", "ToTitle") and
80+
(inp.isParameter(0) and outp.isResult())
81+
or
82+
// signature: func ToTitleSpecial(c unicode.SpecialCase, s string) string
83+
hasQualifiedName("strings", "ToTitleSpecial") and
84+
(inp.isParameter(1) and outp.isResult())
85+
or
86+
// signature: func ToUpper(s string) string
87+
hasQualifiedName("strings", "ToUpper") and
88+
(inp.isParameter(0) and outp.isResult())
89+
or
90+
// signature: func ToUpperSpecial(c unicode.SpecialCase, s string) string
91+
hasQualifiedName("strings", "ToUpperSpecial") and
92+
(inp.isParameter(1) and outp.isResult())
93+
or
94+
// signature: func ToValidUTF8(s string, replacement string) string
95+
hasQualifiedName("strings", "ToValidUTF8") and
96+
(inp.isParameter(_) and outp.isResult())
97+
or
98+
// signature: func Trim(s string, cutset string) string
99+
hasQualifiedName("strings", "Trim") and
100+
(inp.isParameter(0) and outp.isResult())
101+
or
102+
// signature: func TrimFunc(s string, f func(rune) bool) string
103+
hasQualifiedName("strings", "TrimFunc") and
104+
(inp.isParameter(0) and outp.isResult())
105+
or
106+
// signature: func TrimLeft(s string, cutset string) string
107+
hasQualifiedName("strings", "TrimLeft") and
108+
(inp.isParameter(0) and outp.isResult())
109+
or
110+
// signature: func TrimLeftFunc(s string, f func(rune) bool) string
111+
hasQualifiedName("strings", "TrimLeftFunc") and
112+
(inp.isParameter(0) and outp.isResult())
113+
or
114+
// signature: func TrimPrefix(s string, prefix string) string
115+
hasQualifiedName("strings", "TrimPrefix") and
116+
(inp.isParameter(0) and outp.isResult())
117+
or
118+
// signature: func TrimRight(s string, cutset string) string
119+
hasQualifiedName("strings", "TrimRight") and
120+
(inp.isParameter(0) and outp.isResult())
121+
or
122+
// signature: func TrimRightFunc(s string, f func(rune) bool) string
123+
hasQualifiedName("strings", "TrimRightFunc") and
124+
(inp.isParameter(0) and outp.isResult())
125+
or
126+
// signature: func TrimSpace(s string) string
127+
hasQualifiedName("strings", "TrimSpace") and
128+
(inp.isParameter(0) and outp.isResult())
129+
or
130+
// signature: func TrimSuffix(s string, suffix string) string
131+
hasQualifiedName("strings", "TrimSuffix") and
132+
(inp.isParameter(0) and outp.isResult())
133+
}
134+
135+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
136+
input = inp and output = outp
137+
}
138+
}
139+
140+
private class MethodModels extends TaintTracking::FunctionModel, Method {
141+
FunctionInput inp;
142+
FunctionOutput outp;
143+
144+
MethodModels() {
145+
// signature: func (*Builder).String() string
146+
this.hasQualifiedName("strings", "Builder", "String") and
147+
(inp.isReceiver() and outp.isResult())
148+
or
149+
// signature: func (*Builder).Write(p []byte) (int, error)
150+
this.hasQualifiedName("strings", "Builder", "Write") and
151+
(inp.isParameter(0) and outp.isReceiver())
152+
or
153+
// signature: func (*Builder).WriteByte(c byte) error
154+
this.hasQualifiedName("strings", "Builder", "WriteByte") and
155+
(inp.isParameter(0) and outp.isReceiver())
156+
or
157+
// signature: func (*Builder).WriteString(s string) (int, error)
158+
this.hasQualifiedName("strings", "Builder", "WriteString") and
159+
(inp.isParameter(0) and outp.isReceiver())
160+
or
161+
// signature: func (*Reader).Read(b []byte) (n int, err error)
162+
this.hasQualifiedName("strings", "Reader", "Read") and
163+
(inp.isReceiver() and outp.isParameter(0))
164+
or
165+
// signature: func (*Reader).ReadAt(b []byte, off int64) (n int, err error)
166+
this.hasQualifiedName("strings", "Reader", "ReadAt") and
167+
(inp.isReceiver() and outp.isParameter(0))
168+
or
169+
// signature: func (*Reader).ReadByte() (byte, error)
170+
this.hasQualifiedName("strings", "Reader", "ReadByte") and
171+
(inp.isReceiver() and outp.isResult(0))
172+
or
173+
// signature: func (*Reader).ReadRune() (ch rune, size int, err error)
174+
this.hasQualifiedName("strings", "Reader", "ReadRune") and
175+
(inp.isReceiver() and outp.isResult(0))
176+
or
177+
// signature: func (*Reader).Reset(s string)
178+
this.hasQualifiedName("strings", "Reader", "Reset") and
179+
(inp.isParameter(0) and outp.isReceiver())
180+
or
181+
// signature: func (*Reader).WriteTo(w io.Writer) (n int64, err error)
182+
this.hasQualifiedName("strings", "Reader", "WriteTo") and
183+
(inp.isReceiver() and outp.isParameter(0))
184+
or
185+
// signature: func (*Replacer).Replace(s string) string
186+
this.hasQualifiedName("strings", "Replacer", "Replace") and
187+
(inp.isParameter(0) and outp.isResult())
188+
or
189+
// signature: func (*Replacer).WriteString(w io.Writer, s string) (n int, err error)
190+
this.hasQualifiedName("strings", "Replacer", "WriteString") and
191+
(inp.isParameter(1) and outp.isParameter(0))
192+
}
193+
194+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
195+
input = inp and output = outp
196+
}
197+
}
198+
}

0 commit comments

Comments
 (0)