Skip to content

Commit 110a398

Browse files
gagliardettosmowton
authored andcommitted
Regenerate codeql: Refactor HTTP::HeaderWrite
1 parent 5578afa commit 110a398

File tree

1 file changed

+29
-19
lines changed

1 file changed

+29
-19
lines changed

ql/src/experimental/frameworks/CleverGo.qll

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -390,37 +390,47 @@ private module CleverGo {
390390
}
391391

392392
/**
393-
* Models HTTP header writer models for package: clevergo.tech/clevergo@v0.5.2
393+
* Models HTTP header writers.
394+
* The write is done with a call where you can set both the key and the value of the header.
394395
*/
395396
private class HeaderWrite extends HTTP::HeaderWrite::Range, DataFlow::CallNode {
396-
string receiverName;
397-
string methodName;
397+
DataFlow::Node receiverNode;
398398
DataFlow::Node headerNameNode;
399399
DataFlow::Node headerValueNode;
400400

401401
HeaderWrite() {
402-
(
403-
// Type methods:
404-
this =
405-
any(Method m | m.hasQualifiedName(packagePath(), receiverName, methodName)).getACall() and
406-
(
407-
// Receiver type: Context
408-
receiverName = "Context" and
409-
(
410-
// signature: func (*Context).SetHeader(key string, value string)
411-
methodName = "SetHeader" and
412-
headerNameNode = this.getArgument(0) and
413-
headerValueNode = this.getArgument(1)
414-
)
415-
)
416-
)
402+
setsHeaderDynamicKeyValue(_, _, this, headerNameNode, headerValueNode, receiverNode)
417403
}
418404

419405
override DataFlow::Node getName() { result = headerNameNode }
420406

421407
override DataFlow::Node getValue() { result = headerValueNode }
422408

423-
override HTTP::ResponseWriter getResponseWriter() { none() }
409+
override HTTP::ResponseWriter getResponseWriter() { result.getANode() = receiverNode }
410+
}
411+
412+
// Holds for a call that sets a header with a key-value combination.
413+
private predicate setsHeaderDynamicKeyValue(
414+
string package, string receiverName, DataFlow::CallNode headerSetterCall,
415+
DataFlow::Node headerNameNode, DataFlow::Node headerValueNode, DataFlow::Node receiverNode
416+
) {
417+
exists(string methodName, Method met |
418+
met.hasQualifiedName(package, receiverName, methodName) and
419+
headerSetterCall = met.getACall() and
420+
receiverNode = headerSetterCall.getReceiver()
421+
|
422+
package = packagePath() and
423+
(
424+
// Receiver type: Context
425+
receiverName = "Context" and
426+
(
427+
// signature: func (*Context).SetHeader(key string, value string)
428+
methodName = "SetHeader" and
429+
headerNameNode = headerSetterCall.getArgument(0) and
430+
headerValueNode = headerSetterCall.getArgument(1)
431+
)
432+
)
433+
)
424434
}
425435

426436
/**

0 commit comments

Comments
 (0)