Skip to content

Commit 8d5bb21

Browse files
cklincklin
authored
Merge pull request #16642 from github/post-release-prep/codeql-cli-2.17.4
Post-release preparation for codeql-cli-2.17.4
2 parents 58fb027 + a191490 commit 8d5bb21

File tree

6 files changed

+66
-2
lines changed

6 files changed

+66
-2
lines changed

‎go/ql/lib/CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
* A bug has been fixed which meant that the query `go/incorrect-integer-conversion` did not consider type assertions and type switches which use a defined type whose underlying type is an integer type. This may lead to fewer false positive alerts.
1010
* A bug has been fixed which meant flow was not followed through some ranged for loops. This may lead to more alerts being found.
11-
* Converted the models for the built-in functions `append`, `copy`, `max` and `min` to value flow and Models-as-Data.
11+
* Added value flow models for the built-in functions `append`, `copy`, `max` and `min` using Models-as-Data. Removed the old-style models for `max` and `min`.
1212

1313
## 0.8.1
1414

‎go/ql/lib/change-notes/released/1.0.0.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@
88

99
* A bug has been fixed which meant that the query `go/incorrect-integer-conversion` did not consider type assertions and type switches which use a defined type whose underlying type is an integer type. This may lead to fewer false positive alerts.
1010
* A bug has been fixed which meant flow was not followed through some ranged for loops. This may lead to more alerts being found.
11-
* Converted the models for the built-in functions `append`, `copy`, `max` and `min` to value flow and Models-as-Data.
11+
* Added value flow models for the built-in functions `append`, `copy`, `max` and `min` using Models-as-Data. Removed the old-style models for `max` and `min`.

‎go/ql/lib/semmle/go/frameworks/Stdlib.qll‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,30 @@ import semmle.go.frameworks.stdlib.TextTabwriter
4444
import semmle.go.frameworks.stdlib.TextTemplate
4545
import semmle.go.frameworks.stdlib.Unsafe
4646

47+
/**
48+
* A model of the built-in `append` function, which propagates taint from its arguments to its
49+
* result.
50+
*/
51+
private class AppendFunction extends TaintTracking::FunctionModel {
52+
AppendFunction() { this = Builtin::append() }
53+
54+
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
55+
inp.isParameter(_) and outp.isResult()
56+
}
57+
}
58+
59+
/**
60+
* A model of the built-in `copy` function, which propagates taint from its second argument
61+
* to its first.
62+
*/
63+
private class CopyFunction extends TaintTracking::FunctionModel {
64+
CopyFunction() { this = Builtin::copy() }
65+
66+
override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
67+
inp.isParameter(1) and outp.isParameter(0)
68+
}
69+
}
70+
4771
/** Provides a class for modeling functions which convert strings into integers. */
4872
module IntegerParser {
4973
/**

‎go/ql/test/library-tests/semmle/go/dataflow/FlowSteps/LocalTaintStep.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,13 @@
33
| main.go:38:13:38:13 | 1 | main.go:38:7:38:20 | slice literal |
44
| main.go:38:16:38:16 | 2 | main.go:38:7:38:20 | slice literal |
55
| main.go:38:19:38:19 | 3 | main.go:38:7:38:20 | slice literal |
6+
| main.go:39:15:39:15 | s | main.go:39:8:39:25 | call to append |
7+
| main.go:39:18:39:18 | 4 | main.go:39:8:39:25 | call to append |
8+
| main.go:39:21:39:21 | 5 | main.go:39:8:39:25 | call to append |
9+
| main.go:39:24:39:24 | 6 | main.go:39:8:39:25 | call to append |
10+
| main.go:40:15:40:15 | s | main.go:40:8:40:23 | call to append |
11+
| main.go:40:18:40:19 | s1 | main.go:40:8:40:23 | call to append |
12+
| main.go:42:10:42:11 | s4 | main.go:38:2:38:2 | definition of s |
613
| main.go:47:20:47:21 | next key-value pair in range | main.go:47:2:50:2 | range statement[0] |
714
| main.go:47:20:47:21 | next key-value pair in range | main.go:47:2:50:2 | range statement[1] |
815
| main.go:47:20:47:21 | xs | main.go:47:2:50:2 | range statement[1] |

‎go/ql/test/query-tests/Security/CWE-078/CommandInjection.expected‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ edges
2626
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:14:23:14:33 | slice expression | provenance | |
2727
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:39:31:39:37 | tainted | provenance | |
2828
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:52:24:52:30 | tainted | provenance | |
29+
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:53:21:53:28 | arrayLit | provenance | |
2930
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:68:31:68:37 | tainted | provenance | |
3031
| SanitizingDoubleDash.go:9:13:9:27 | call to Query | SanitizingDoubleDash.go:80:23:80:29 | tainted | provenance | |
3132
| SanitizingDoubleDash.go:13:15:13:32 | array literal [array] | SanitizingDoubleDash.go:14:23:14:30 | arrayLit [array] | provenance | |
@@ -38,17 +39,23 @@ edges
3839
| SanitizingDoubleDash.go:39:14:39:44 | call to append | SanitizingDoubleDash.go:40:23:40:30 | arrayLit | provenance | |
3940
| SanitizingDoubleDash.go:39:14:39:44 | call to append [array] | SanitizingDoubleDash.go:40:23:40:30 | arrayLit | provenance | |
4041
| SanitizingDoubleDash.go:39:31:39:37 | tainted | SanitizingDoubleDash.go:39:14:39:44 | []type{args} [array] | provenance | |
42+
| SanitizingDoubleDash.go:39:31:39:37 | tainted | SanitizingDoubleDash.go:39:14:39:44 | call to append | provenance | FunctionModel |
4143
| SanitizingDoubleDash.go:52:15:52:31 | slice literal [array] | SanitizingDoubleDash.go:53:21:53:28 | arrayLit [array] | provenance | |
4244
| SanitizingDoubleDash.go:52:24:52:30 | tainted | SanitizingDoubleDash.go:52:15:52:31 | slice literal [array] | provenance | |
4345
| SanitizingDoubleDash.go:53:14:53:35 | call to append | SanitizingDoubleDash.go:54:23:54:30 | arrayLit | provenance | |
4446
| SanitizingDoubleDash.go:53:14:53:35 | call to append [array] | SanitizingDoubleDash.go:54:23:54:30 | arrayLit | provenance | |
47+
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit | SanitizingDoubleDash.go:53:14:53:35 | call to append | provenance | FunctionModel |
4548
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit [array] | SanitizingDoubleDash.go:53:14:53:35 | call to append | provenance | MaD:28 |
4649
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit [array] | SanitizingDoubleDash.go:53:14:53:35 | call to append [array] | provenance | MaD:28 |
50+
| SanitizingDoubleDash.go:68:14:68:38 | []type{args} [array] | SanitizingDoubleDash.go:68:14:68:38 | call to append | provenance | MaD:29 |
4751
| SanitizingDoubleDash.go:68:14:68:38 | []type{args} [array] | SanitizingDoubleDash.go:68:14:68:38 | call to append [array] | provenance | MaD:29 |
52+
| SanitizingDoubleDash.go:68:14:68:38 | call to append | SanitizingDoubleDash.go:69:21:69:28 | arrayLit | provenance | |
4853
| SanitizingDoubleDash.go:68:14:68:38 | call to append [array] | SanitizingDoubleDash.go:69:21:69:28 | arrayLit [array] | provenance | |
4954
| SanitizingDoubleDash.go:68:31:68:37 | tainted | SanitizingDoubleDash.go:68:14:68:38 | []type{args} [array] | provenance | |
55+
| SanitizingDoubleDash.go:68:31:68:37 | tainted | SanitizingDoubleDash.go:68:14:68:38 | call to append | provenance | FunctionModel |
5056
| SanitizingDoubleDash.go:69:14:69:35 | call to append | SanitizingDoubleDash.go:70:23:70:30 | arrayLit | provenance | |
5157
| SanitizingDoubleDash.go:69:14:69:35 | call to append [array] | SanitizingDoubleDash.go:70:23:70:30 | arrayLit | provenance | |
58+
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit | SanitizingDoubleDash.go:69:14:69:35 | call to append | provenance | FunctionModel |
5259
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit [array] | SanitizingDoubleDash.go:69:14:69:35 | call to append | provenance | MaD:28 |
5360
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit [array] | SanitizingDoubleDash.go:69:14:69:35 | call to append [array] | provenance | MaD:28 |
5461
| SanitizingDoubleDash.go:92:13:92:19 | selection of URL | SanitizingDoubleDash.go:92:13:92:27 | call to Query | provenance | MaD:735 |
@@ -62,6 +69,7 @@ edges
6269
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:117:31:117:37 | tainted | provenance | |
6370
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:123:31:123:37 | tainted | provenance | |
6471
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:128:24:128:30 | tainted | provenance | |
72+
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:129:21:129:28 | arrayLit | provenance | |
6573
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:136:31:136:37 | tainted | provenance | |
6674
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:142:31:142:37 | tainted | provenance | |
6775
| SanitizingDoubleDash.go:92:13:92:27 | call to Query | SanitizingDoubleDash.go:148:30:148:36 | tainted | provenance | |
@@ -83,32 +91,41 @@ edges
8391
| SanitizingDoubleDash.go:111:14:111:44 | call to append | SanitizingDoubleDash.go:112:24:112:31 | arrayLit | provenance | |
8492
| SanitizingDoubleDash.go:111:14:111:44 | call to append [array] | SanitizingDoubleDash.go:112:24:112:31 | arrayLit | provenance | |
8593
| SanitizingDoubleDash.go:111:37:111:43 | tainted | SanitizingDoubleDash.go:111:14:111:44 | []type{args} [array] | provenance | |
94+
| SanitizingDoubleDash.go:111:37:111:43 | tainted | SanitizingDoubleDash.go:111:14:111:44 | call to append | provenance | FunctionModel |
8695
| SanitizingDoubleDash.go:117:14:117:44 | []type{args} [array] | SanitizingDoubleDash.go:117:14:117:44 | call to append | provenance | MaD:29 |
8796
| SanitizingDoubleDash.go:117:14:117:44 | []type{args} [array] | SanitizingDoubleDash.go:117:14:117:44 | call to append [array] | provenance | MaD:29 |
8897
| SanitizingDoubleDash.go:117:14:117:44 | call to append | SanitizingDoubleDash.go:118:24:118:31 | arrayLit | provenance | |
8998
| SanitizingDoubleDash.go:117:14:117:44 | call to append [array] | SanitizingDoubleDash.go:118:24:118:31 | arrayLit | provenance | |
9099
| SanitizingDoubleDash.go:117:31:117:37 | tainted | SanitizingDoubleDash.go:117:14:117:44 | []type{args} [array] | provenance | |
100+
| SanitizingDoubleDash.go:117:31:117:37 | tainted | SanitizingDoubleDash.go:117:14:117:44 | call to append | provenance | FunctionModel |
91101
| SanitizingDoubleDash.go:123:14:123:38 | []type{args} [array] | SanitizingDoubleDash.go:123:14:123:38 | call to append | provenance | MaD:29 |
92102
| SanitizingDoubleDash.go:123:14:123:38 | []type{args} [array] | SanitizingDoubleDash.go:123:14:123:38 | call to append [array] | provenance | MaD:29 |
93103
| SanitizingDoubleDash.go:123:14:123:38 | call to append | SanitizingDoubleDash.go:124:24:124:31 | arrayLit | provenance | |
94104
| SanitizingDoubleDash.go:123:14:123:38 | call to append [array] | SanitizingDoubleDash.go:124:24:124:31 | arrayLit | provenance | |
95105
| SanitizingDoubleDash.go:123:31:123:37 | tainted | SanitizingDoubleDash.go:123:14:123:38 | []type{args} [array] | provenance | |
106+
| SanitizingDoubleDash.go:123:31:123:37 | tainted | SanitizingDoubleDash.go:123:14:123:38 | call to append | provenance | FunctionModel |
96107
| SanitizingDoubleDash.go:128:15:128:31 | slice literal [array] | SanitizingDoubleDash.go:129:21:129:28 | arrayLit [array] | provenance | |
97108
| SanitizingDoubleDash.go:128:24:128:30 | tainted | SanitizingDoubleDash.go:128:15:128:31 | slice literal [array] | provenance | |
98109
| SanitizingDoubleDash.go:129:14:129:35 | call to append | SanitizingDoubleDash.go:130:24:130:31 | arrayLit | provenance | |
99110
| SanitizingDoubleDash.go:129:14:129:35 | call to append [array] | SanitizingDoubleDash.go:130:24:130:31 | arrayLit | provenance | |
111+
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit | SanitizingDoubleDash.go:129:14:129:35 | call to append | provenance | FunctionModel |
100112
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit [array] | SanitizingDoubleDash.go:129:14:129:35 | call to append | provenance | MaD:28 |
101113
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit [array] | SanitizingDoubleDash.go:129:14:129:35 | call to append [array] | provenance | MaD:28 |
102114
| SanitizingDoubleDash.go:136:14:136:38 | []type{args} [array] | SanitizingDoubleDash.go:136:14:136:38 | call to append | provenance | MaD:29 |
103115
| SanitizingDoubleDash.go:136:14:136:38 | []type{args} [array] | SanitizingDoubleDash.go:136:14:136:38 | call to append [array] | provenance | MaD:29 |
104116
| SanitizingDoubleDash.go:136:14:136:38 | call to append | SanitizingDoubleDash.go:137:24:137:31 | arrayLit | provenance | |
105117
| SanitizingDoubleDash.go:136:14:136:38 | call to append [array] | SanitizingDoubleDash.go:137:24:137:31 | arrayLit | provenance | |
106118
| SanitizingDoubleDash.go:136:31:136:37 | tainted | SanitizingDoubleDash.go:136:14:136:38 | []type{args} [array] | provenance | |
119+
| SanitizingDoubleDash.go:136:31:136:37 | tainted | SanitizingDoubleDash.go:136:14:136:38 | call to append | provenance | FunctionModel |
120+
| SanitizingDoubleDash.go:142:14:142:38 | []type{args} [array] | SanitizingDoubleDash.go:142:14:142:38 | call to append | provenance | MaD:29 |
107121
| SanitizingDoubleDash.go:142:14:142:38 | []type{args} [array] | SanitizingDoubleDash.go:142:14:142:38 | call to append [array] | provenance | MaD:29 |
122+
| SanitizingDoubleDash.go:142:14:142:38 | call to append | SanitizingDoubleDash.go:143:21:143:28 | arrayLit | provenance | |
108123
| SanitizingDoubleDash.go:142:14:142:38 | call to append [array] | SanitizingDoubleDash.go:143:21:143:28 | arrayLit [array] | provenance | |
109124
| SanitizingDoubleDash.go:142:31:142:37 | tainted | SanitizingDoubleDash.go:142:14:142:38 | []type{args} [array] | provenance | |
125+
| SanitizingDoubleDash.go:142:31:142:37 | tainted | SanitizingDoubleDash.go:142:14:142:38 | call to append | provenance | FunctionModel |
110126
| SanitizingDoubleDash.go:143:14:143:35 | call to append | SanitizingDoubleDash.go:144:24:144:31 | arrayLit | provenance | |
111127
| SanitizingDoubleDash.go:143:14:143:35 | call to append [array] | SanitizingDoubleDash.go:144:24:144:31 | arrayLit | provenance | |
128+
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit | SanitizingDoubleDash.go:143:14:143:35 | call to append | provenance | FunctionModel |
112129
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit [array] | SanitizingDoubleDash.go:143:14:143:35 | call to append | provenance | MaD:28 |
113130
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit [array] | SanitizingDoubleDash.go:143:14:143:35 | call to append [array] | provenance | MaD:28 |
114131
nodes
@@ -155,13 +172,16 @@ nodes
155172
| SanitizingDoubleDash.go:52:24:52:30 | tainted | semmle.label | tainted |
156173
| SanitizingDoubleDash.go:53:14:53:35 | call to append | semmle.label | call to append |
157174
| SanitizingDoubleDash.go:53:14:53:35 | call to append [array] | semmle.label | call to append [array] |
175+
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit | semmle.label | arrayLit |
158176
| SanitizingDoubleDash.go:53:21:53:28 | arrayLit [array] | semmle.label | arrayLit [array] |
159177
| SanitizingDoubleDash.go:54:23:54:30 | arrayLit | semmle.label | arrayLit |
160178
| SanitizingDoubleDash.go:68:14:68:38 | []type{args} [array] | semmle.label | []type{args} [array] |
179+
| SanitizingDoubleDash.go:68:14:68:38 | call to append | semmle.label | call to append |
161180
| SanitizingDoubleDash.go:68:14:68:38 | call to append [array] | semmle.label | call to append [array] |
162181
| SanitizingDoubleDash.go:68:31:68:37 | tainted | semmle.label | tainted |
163182
| SanitizingDoubleDash.go:69:14:69:35 | call to append | semmle.label | call to append |
164183
| SanitizingDoubleDash.go:69:14:69:35 | call to append [array] | semmle.label | call to append [array] |
184+
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit | semmle.label | arrayLit |
165185
| SanitizingDoubleDash.go:69:21:69:28 | arrayLit [array] | semmle.label | arrayLit [array] |
166186
| SanitizingDoubleDash.go:70:23:70:30 | arrayLit | semmle.label | arrayLit |
167187
| SanitizingDoubleDash.go:80:23:80:29 | tainted | semmle.label | tainted |
@@ -201,6 +221,7 @@ nodes
201221
| SanitizingDoubleDash.go:128:24:128:30 | tainted | semmle.label | tainted |
202222
| SanitizingDoubleDash.go:129:14:129:35 | call to append | semmle.label | call to append |
203223
| SanitizingDoubleDash.go:129:14:129:35 | call to append [array] | semmle.label | call to append [array] |
224+
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit | semmle.label | arrayLit |
204225
| SanitizingDoubleDash.go:129:21:129:28 | arrayLit [array] | semmle.label | arrayLit [array] |
205226
| SanitizingDoubleDash.go:130:24:130:31 | arrayLit | semmle.label | arrayLit |
206227
| SanitizingDoubleDash.go:136:14:136:38 | []type{args} [array] | semmle.label | []type{args} [array] |
@@ -209,10 +230,12 @@ nodes
209230
| SanitizingDoubleDash.go:136:31:136:37 | tainted | semmle.label | tainted |
210231
| SanitizingDoubleDash.go:137:24:137:31 | arrayLit | semmle.label | arrayLit |
211232
| SanitizingDoubleDash.go:142:14:142:38 | []type{args} [array] | semmle.label | []type{args} [array] |
233+
| SanitizingDoubleDash.go:142:14:142:38 | call to append | semmle.label | call to append |
212234
| SanitizingDoubleDash.go:142:14:142:38 | call to append [array] | semmle.label | call to append [array] |
213235
| SanitizingDoubleDash.go:142:31:142:37 | tainted | semmle.label | tainted |
214236
| SanitizingDoubleDash.go:143:14:143:35 | call to append | semmle.label | call to append |
215237
| SanitizingDoubleDash.go:143:14:143:35 | call to append [array] | semmle.label | call to append [array] |
238+
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit | semmle.label | arrayLit |
216239
| SanitizingDoubleDash.go:143:21:143:28 | arrayLit [array] | semmle.label | arrayLit [array] |
217240
| SanitizingDoubleDash.go:144:24:144:31 | arrayLit | semmle.label | arrayLit |
218241
| SanitizingDoubleDash.go:148:30:148:36 | tainted | semmle.label | tainted |

0 commit comments

Comments
 (0)