diff --git a/cpp/ql/lib/change-notes/2026-09-08-boost-asio-ip-resolve.md b/cpp/ql/lib/change-notes/2026-09-08-boost-asio-ip-resolve.md new file mode 100644 index 000000000000..9276eed8ed83 --- /dev/null +++ b/cpp/ql/lib/change-notes/2026-09-08-boost-asio-ip-resolve.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Added taint flow models for the `boost::asio::ip::basic_resolver::resolve` function. \ No newline at end of file diff --git a/cpp/ql/lib/ext/Boost.Asio.model.yml b/cpp/ql/lib/ext/Boost.Asio.model.yml index f6ba957d2596..eb6728af4124 100644 --- a/cpp/ql/lib/ext/Boost.Asio.model.yml +++ b/cpp/ql/lib/ext/Boost.Asio.model.yml @@ -23,3 +23,19 @@ extensions: extensible: summaryModel data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance - ["boost::asio", "", False, "buffer", "", "", "Argument[*0]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const string &,const string &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const string &,const string &,error_code &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const string &,const string &,flags)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const string &,const string &,flags,error_code &)", "", "Argument[*0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(string_view,string_view)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(string_view,string_view,error_code &)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(string_view,string_view,flags)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(string_view,string_view,flags,error_code &)", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,const string &,const string &)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,const string &,const string &,error_code &)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,const string &,const string &,flags)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,const string &,const string &,flags,error_code &)", "", "Argument[*1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,string_view,string_view)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,string_view,string_view,error_code &)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,string_view,string_view,flags)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"] + - ["boost::asio::ip", "basic_resolver", False, "resolve", "(const InternetProtocol &,string_view,string_view,flags,error_code &)", "", "Argument[1..2]", "ReturnValue", "taint", "manual"] \ No newline at end of file diff --git a/cpp/ql/test/library-tests/dataflow/external-models/asio_streams.cpp b/cpp/ql/test/library-tests/dataflow/external-models/asio_streams.cpp index 401091122b8e..76b2a07fc858 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/asio_streams.cpp +++ b/cpp/ql/test/library-tests/dataflow/external-models/asio_streams.cpp @@ -18,6 +18,11 @@ namespace std { }; typedef basic_string string; + + class string_view { + public: + string_view(const char* s); + }; }; namespace boost { @@ -29,14 +34,50 @@ namespace boost { }; namespace asio { - template - class basic_stream_socket /*: public basic_socket*/ { - }; + class any_io_executor { }; + + class socket_base { }; + + template + class basic_socket : public socket_base { }; + + template + class basic_stream_socket : public basic_socket { }; namespace ip { + class resolver_base { + public: + enum flags { passive = 1 }; + }; + + template + class basic_resolver { + public: + class results_type { + }; + + results_type resolve(const std::string &host, const std::string &service); + results_type resolve(const std::string &host, const std::string &service, boost::system::error_code &ec); + results_type resolve(const std::string &host, const std::string &service, resolver_base::flags resolve_flags); + results_type resolve(const std::string &host, const std::string &service, resolver_base::flags resolve_flags, boost::system::error_code &ec); + results_type resolve(std::string_view host, std::string_view service); + results_type resolve(std::string_view host, std::string_view service, boost::system::error_code &ec); + results_type resolve(std::string_view host, std::string_view service, resolver_base::flags resolve_flags); + results_type resolve(std::string_view host, std::string_view service, resolver_base::flags resolve_flags, boost::system::error_code &ec); + results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service); + results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service, boost::system::error_code &ec); + results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service, resolver_base::flags resolve_flags); + results_type resolve(const InternetProtocol &protocol, const std::string &host, const std::string &service, resolver_base::flags resolve_flags, boost::system::error_code &ec); + results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service); + results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service, boost::system::error_code &ec); + results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service, resolver_base::flags resolve_flags); + results_type resolve(const InternetProtocol &protocol, std::string_view host, std::string_view service, resolver_base::flags resolve_flags, boost::system::error_code &ec); + }; + class tcp { public: typedef basic_stream_socket socket; + typedef basic_resolver resolver; }; }; @@ -76,6 +117,7 @@ void sink(char *); void sink(std::string); void sink(boost::asio::streambuf); void sink(boost::asio::mutable_buffer); +void sink(boost::asio::ip::tcp::resolver::results_type); char *getenv(const char *name); int send(int, const void*, int, int); @@ -105,3 +147,65 @@ void test(boost::asio::ip::tcp::socket &socket) { // ... } } + +void test_resolve_host() { + boost::asio::ip::tcp::resolver resolver; + boost::asio::ip::tcp protocol; + boost::asio::ip::resolver_base::flags flags = boost::asio::ip::resolver_base::passive; + boost::system::error_code error; + std::string host(source()); + std::string service(""); + std::string_view host_view(source()); + std::string_view service_view(""); + + sink(resolver.resolve(host, service)); // $ ir + sink(resolver.resolve(host, service, error)); // $ ir + sink(resolver.resolve(host, service, flags)); // $ ir + sink(resolver.resolve(host, service, flags, error)); // $ ir + + sink(resolver.resolve(host_view, service_view)); // $ ir + sink(resolver.resolve(host_view, service_view, error)); // $ ir + sink(resolver.resolve(host_view, service_view, flags)); // $ ir + sink(resolver.resolve(host_view, service_view, flags, error)); // $ ir + + sink(resolver.resolve(protocol, host, service)); // $ ir + sink(resolver.resolve(protocol, host, service, error)); // $ ir + sink(resolver.resolve(protocol, host, service, flags)); // $ ir + sink(resolver.resolve(protocol, host, service, flags, error)); // $ ir + + sink(resolver.resolve(protocol, host_view, service_view)); // $ ir + sink(resolver.resolve(protocol, host_view, service_view, error)); // $ ir + sink(resolver.resolve(protocol, host_view, service_view, flags)); // $ ir + sink(resolver.resolve(protocol, host_view, service_view, flags, error)); // $ ir +} + +void test_resolve_service() { + boost::asio::ip::tcp::resolver resolver; + boost::asio::ip::tcp protocol; + boost::asio::ip::resolver_base::flags flags = boost::asio::ip::resolver_base::passive; + boost::system::error_code error; + std::string host(""); + std::string service(source()); + std::string_view host_view(""); + std::string_view service_view(source()); + + sink(resolver.resolve(host, service)); // $ ir + sink(resolver.resolve(host, service, error)); // $ ir + sink(resolver.resolve(host, service, flags)); // $ ir + sink(resolver.resolve(host, service, flags, error)); // $ ir + + sink(resolver.resolve(host_view, service_view)); // $ ir + sink(resolver.resolve(host_view, service_view, error)); // $ ir + sink(resolver.resolve(host_view, service_view, flags)); // $ ir + sink(resolver.resolve(host_view, service_view, flags, error)); // $ ir + + sink(resolver.resolve(protocol, host, service)); // $ ir + sink(resolver.resolve(protocol, host, service, error)); // $ ir + sink(resolver.resolve(protocol, host, service, flags)); // $ ir + sink(resolver.resolve(protocol, host, service, flags, error)); // $ ir + + sink(resolver.resolve(protocol, host_view, service_view)); // $ ir + sink(resolver.resolve(protocol, host_view, service_view, error)); // $ ir + sink(resolver.resolve(protocol, host_view, service_view, flags)); // $ ir + sink(resolver.resolve(protocol, host_view, service_view, flags, error)); // $ ir +} diff --git a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected index 65817b549a90..ee6d7539cc0a 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected @@ -102,16 +102,96 @@ models | 101 | Summary: BloombergLP::bdlbb; BlobUtil; true; copy; (Blob *,int,const char *,int); ; Argument[*2]; Argument[*0]; taint; manual | | 102 | Summary: BloombergLP::bdlbb; BlobUtil; true; copy; (char *,const Blob &,int,int); ; Argument[*1]; Argument[*0]; taint; manual | | 103 | Summary: BloombergLP::bdlbb; BlobUtil; true; getContiguousRangeOrCopy; ; ; Argument[*1]; ReturnValue[*]; taint; manual | -| 104 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual | +| 104 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,const string &,const string &); ; Argument[*1..2]; ReturnValue; taint; manual | +| 105 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,const string &,const string &,error_code &); ; Argument[*1..2]; ReturnValue; taint; manual | +| 106 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,const string &,const string &,flags); ; Argument[*1..2]; ReturnValue; taint; manual | +| 107 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,const string &,const string &,flags,error_code &); ; Argument[*1..2]; ReturnValue; taint; manual | +| 108 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,string_view,string_view); ; Argument[1..2]; ReturnValue; taint; manual | +| 109 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,string_view,string_view,error_code &); ; Argument[1..2]; ReturnValue; taint; manual | +| 110 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,string_view,string_view,flags); ; Argument[1..2]; ReturnValue; taint; manual | +| 111 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const InternetProtocol &,string_view,string_view,flags,error_code &); ; Argument[1..2]; ReturnValue; taint; manual | +| 112 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const string &,const string &); ; Argument[*0..1]; ReturnValue; taint; manual | +| 113 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const string &,const string &,error_code &); ; Argument[*0..1]; ReturnValue; taint; manual | +| 114 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const string &,const string &,flags); ; Argument[*0..1]; ReturnValue; taint; manual | +| 115 | Summary: boost::asio::ip; basic_resolver; false; resolve; (const string &,const string &,flags,error_code &); ; Argument[*0..1]; ReturnValue; taint; manual | +| 116 | Summary: boost::asio::ip; basic_resolver; false; resolve; (string_view,string_view); ; Argument[0..1]; ReturnValue; taint; manual | +| 117 | Summary: boost::asio::ip; basic_resolver; false; resolve; (string_view,string_view,error_code &); ; Argument[0..1]; ReturnValue; taint; manual | +| 118 | Summary: boost::asio::ip; basic_resolver; false; resolve; (string_view,string_view,flags); ; Argument[0..1]; ReturnValue; taint; manual | +| 119 | Summary: boost::asio::ip; basic_resolver; false; resolve; (string_view,string_view,flags,error_code &); ; Argument[0..1]; ReturnValue; taint; manual | +| 120 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual | edges -| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:56 | -| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | recv_buffer | provenance | Src:MaD:56 Sink:MaD:4 | -| asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:98:7:98:14 | send_str | provenance | TaintFunction | -| asio_streams.cpp:97:37:97:44 | call to source | asio_streams.cpp:100:64:100:71 | *send_str | provenance | TaintFunction | -| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | | -| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:101:7:101:17 | send_buffer | provenance | | -| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | send_buffer | provenance | Sink:MaD:4 | -| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:104 | +| asio_streams.cpp:129:34:129:44 | read_until output argument | asio_streams.cpp:133:7:133:17 | recv_buffer | provenance | Src:MaD:56 | +| asio_streams.cpp:129:34:129:44 | read_until output argument | asio_streams.cpp:135:29:135:39 | recv_buffer | provenance | Src:MaD:56 Sink:MaD:4 | +| asio_streams.cpp:139:37:139:44 | call to source | asio_streams.cpp:140:7:140:14 | send_str | provenance | TaintFunction | +| asio_streams.cpp:139:37:139:44 | call to source | asio_streams.cpp:142:64:142:71 | *send_str | provenance | TaintFunction | +| asio_streams.cpp:142:44:142:62 | call to buffer | asio_streams.cpp:142:44:142:62 | call to buffer | provenance | | +| asio_streams.cpp:142:44:142:62 | call to buffer | asio_streams.cpp:143:7:143:17 | send_buffer | provenance | | +| asio_streams.cpp:142:44:142:62 | call to buffer | asio_streams.cpp:145:29:145:39 | send_buffer | provenance | Sink:MaD:4 | +| asio_streams.cpp:142:64:142:71 | *send_str | asio_streams.cpp:142:44:142:62 | call to buffer | provenance | MaD:120 | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:161:24:161:27 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:162:24:162:27 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:163:24:163:27 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:164:24:164:27 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:171:34:171:37 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:172:34:172:37 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:173:34:173:37 | *host | provenance | TaintFunction | +| asio_streams.cpp:156:19:156:26 | call to source | asio_streams.cpp:174:34:174:37 | *host | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:166:24:166:32 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:167:24:167:32 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:168:24:168:32 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:169:24:169:32 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:176:34:176:42 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:177:34:177:42 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:178:34:178:42 | host_view | provenance | TaintFunction | +| asio_streams.cpp:158:29:158:36 | call to source | asio_streams.cpp:179:34:179:42 | host_view | provenance | TaintFunction | +| asio_streams.cpp:161:24:161:27 | *host | asio_streams.cpp:161:16:161:22 | call to resolve | provenance | MaD:112 | +| asio_streams.cpp:162:24:162:27 | *host | asio_streams.cpp:162:16:162:22 | call to resolve | provenance | MaD:113 | +| asio_streams.cpp:163:24:163:27 | *host | asio_streams.cpp:163:16:163:22 | call to resolve | provenance | MaD:114 | +| asio_streams.cpp:164:24:164:27 | *host | asio_streams.cpp:164:16:164:22 | call to resolve | provenance | MaD:115 | +| asio_streams.cpp:166:24:166:32 | host_view | asio_streams.cpp:166:16:166:22 | call to resolve | provenance | MaD:116 | +| asio_streams.cpp:167:24:167:32 | host_view | asio_streams.cpp:167:16:167:22 | call to resolve | provenance | MaD:117 | +| asio_streams.cpp:168:24:168:32 | host_view | asio_streams.cpp:168:16:168:22 | call to resolve | provenance | MaD:118 | +| asio_streams.cpp:169:24:169:32 | host_view | asio_streams.cpp:169:16:169:22 | call to resolve | provenance | MaD:119 | +| asio_streams.cpp:171:34:171:37 | *host | asio_streams.cpp:171:16:171:22 | call to resolve | provenance | MaD:104 | +| asio_streams.cpp:172:34:172:37 | *host | asio_streams.cpp:172:16:172:22 | call to resolve | provenance | MaD:105 | +| asio_streams.cpp:173:34:173:37 | *host | asio_streams.cpp:173:16:173:22 | call to resolve | provenance | MaD:106 | +| asio_streams.cpp:174:34:174:37 | *host | asio_streams.cpp:174:16:174:22 | call to resolve | provenance | MaD:107 | +| asio_streams.cpp:176:34:176:42 | host_view | asio_streams.cpp:176:16:176:22 | call to resolve | provenance | MaD:108 | +| asio_streams.cpp:177:34:177:42 | host_view | asio_streams.cpp:177:16:177:22 | call to resolve | provenance | MaD:109 | +| asio_streams.cpp:178:34:178:42 | host_view | asio_streams.cpp:178:16:178:22 | call to resolve | provenance | MaD:110 | +| asio_streams.cpp:179:34:179:42 | host_view | asio_streams.cpp:179:16:179:22 | call to resolve | provenance | MaD:111 | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:192:30:192:36 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:193:30:193:36 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:194:30:194:36 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:195:30:195:36 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:202:40:202:46 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:203:40:203:46 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:204:40:204:46 | *service | provenance | TaintFunction | +| asio_streams.cpp:188:22:188:29 | call to source | asio_streams.cpp:205:40:205:46 | *service | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:197:35:197:46 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:198:35:198:46 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:199:35:199:46 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:200:35:200:46 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:207:45:207:56 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:208:45:208:56 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:209:45:209:56 | service_view | provenance | TaintFunction | +| asio_streams.cpp:190:32:190:39 | call to source | asio_streams.cpp:210:45:210:56 | service_view | provenance | TaintFunction | +| asio_streams.cpp:192:30:192:36 | *service | asio_streams.cpp:192:16:192:22 | call to resolve | provenance | MaD:112 | +| asio_streams.cpp:193:30:193:36 | *service | asio_streams.cpp:193:16:193:22 | call to resolve | provenance | MaD:113 | +| asio_streams.cpp:194:30:194:36 | *service | asio_streams.cpp:194:16:194:22 | call to resolve | provenance | MaD:114 | +| asio_streams.cpp:195:30:195:36 | *service | asio_streams.cpp:195:16:195:22 | call to resolve | provenance | MaD:115 | +| asio_streams.cpp:197:35:197:46 | service_view | asio_streams.cpp:197:16:197:22 | call to resolve | provenance | MaD:116 | +| asio_streams.cpp:198:35:198:46 | service_view | asio_streams.cpp:198:16:198:22 | call to resolve | provenance | MaD:117 | +| asio_streams.cpp:199:35:199:46 | service_view | asio_streams.cpp:199:16:199:22 | call to resolve | provenance | MaD:118 | +| asio_streams.cpp:200:35:200:46 | service_view | asio_streams.cpp:200:16:200:22 | call to resolve | provenance | MaD:119 | +| asio_streams.cpp:202:40:202:46 | *service | asio_streams.cpp:202:16:202:22 | call to resolve | provenance | MaD:104 | +| asio_streams.cpp:203:40:203:46 | *service | asio_streams.cpp:203:16:203:22 | call to resolve | provenance | MaD:105 | +| asio_streams.cpp:204:40:204:46 | *service | asio_streams.cpp:204:16:204:22 | call to resolve | provenance | MaD:106 | +| asio_streams.cpp:205:40:205:46 | *service | asio_streams.cpp:205:16:205:22 | call to resolve | provenance | MaD:107 | +| asio_streams.cpp:207:45:207:56 | service_view | asio_streams.cpp:207:16:207:22 | call to resolve | provenance | MaD:108 | +| asio_streams.cpp:208:45:208:56 | service_view | asio_streams.cpp:208:16:208:22 | call to resolve | provenance | MaD:109 | +| asio_streams.cpp:209:45:209:56 | service_view | asio_streams.cpp:209:16:209:22 | call to resolve | provenance | MaD:110 | +| asio_streams.cpp:210:45:210:56 | service_view | asio_streams.cpp:210:16:210:22 | call to resolve | provenance | MaD:111 | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:257:5:257:8 | *resp | provenance | | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:262:5:262:8 | *resp | provenance | | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:266:38:266:41 | *resp | provenance | | @@ -526,16 +606,84 @@ edges | windows.cpp:1172:21:1172:24 | *guid | windows.cpp:1172:27:1172:29 | StringFromGUID2 output argument | provenance | MaD:76 | | windows.cpp:1172:27:1172:29 | StringFromGUID2 output argument | windows.cpp:1174:10:1174:13 | * ... | provenance | | nodes -| asio_streams.cpp:87:34:87:44 | read_until output argument | semmle.label | read_until output argument | -| asio_streams.cpp:91:7:91:17 | recv_buffer | semmle.label | recv_buffer | -| asio_streams.cpp:93:29:93:39 | recv_buffer | semmle.label | recv_buffer | -| asio_streams.cpp:97:37:97:44 | call to source | semmle.label | call to source | -| asio_streams.cpp:98:7:98:14 | send_str | semmle.label | send_str | -| asio_streams.cpp:100:44:100:62 | call to buffer | semmle.label | call to buffer | -| asio_streams.cpp:100:44:100:62 | call to buffer | semmle.label | call to buffer | -| asio_streams.cpp:100:64:100:71 | *send_str | semmle.label | *send_str | -| asio_streams.cpp:101:7:101:17 | send_buffer | semmle.label | send_buffer | -| asio_streams.cpp:103:29:103:39 | send_buffer | semmle.label | send_buffer | +| asio_streams.cpp:129:34:129:44 | read_until output argument | semmle.label | read_until output argument | +| asio_streams.cpp:133:7:133:17 | recv_buffer | semmle.label | recv_buffer | +| asio_streams.cpp:135:29:135:39 | recv_buffer | semmle.label | recv_buffer | +| asio_streams.cpp:139:37:139:44 | call to source | semmle.label | call to source | +| asio_streams.cpp:140:7:140:14 | send_str | semmle.label | send_str | +| asio_streams.cpp:142:44:142:62 | call to buffer | semmle.label | call to buffer | +| asio_streams.cpp:142:44:142:62 | call to buffer | semmle.label | call to buffer | +| asio_streams.cpp:142:64:142:71 | *send_str | semmle.label | *send_str | +| asio_streams.cpp:143:7:143:17 | send_buffer | semmle.label | send_buffer | +| asio_streams.cpp:145:29:145:39 | send_buffer | semmle.label | send_buffer | +| asio_streams.cpp:156:19:156:26 | call to source | semmle.label | call to source | +| asio_streams.cpp:158:29:158:36 | call to source | semmle.label | call to source | +| asio_streams.cpp:161:16:161:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:161:24:161:27 | *host | semmle.label | *host | +| asio_streams.cpp:162:16:162:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:162:24:162:27 | *host | semmle.label | *host | +| asio_streams.cpp:163:16:163:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:163:24:163:27 | *host | semmle.label | *host | +| asio_streams.cpp:164:16:164:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:164:24:164:27 | *host | semmle.label | *host | +| asio_streams.cpp:166:16:166:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:166:24:166:32 | host_view | semmle.label | host_view | +| asio_streams.cpp:167:16:167:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:167:24:167:32 | host_view | semmle.label | host_view | +| asio_streams.cpp:168:16:168:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:168:24:168:32 | host_view | semmle.label | host_view | +| asio_streams.cpp:169:16:169:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:169:24:169:32 | host_view | semmle.label | host_view | +| asio_streams.cpp:171:16:171:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:171:34:171:37 | *host | semmle.label | *host | +| asio_streams.cpp:172:16:172:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:172:34:172:37 | *host | semmle.label | *host | +| asio_streams.cpp:173:16:173:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:173:34:173:37 | *host | semmle.label | *host | +| asio_streams.cpp:174:16:174:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:174:34:174:37 | *host | semmle.label | *host | +| asio_streams.cpp:176:16:176:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:176:34:176:42 | host_view | semmle.label | host_view | +| asio_streams.cpp:177:16:177:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:177:34:177:42 | host_view | semmle.label | host_view | +| asio_streams.cpp:178:16:178:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:178:34:178:42 | host_view | semmle.label | host_view | +| asio_streams.cpp:179:16:179:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:179:34:179:42 | host_view | semmle.label | host_view | +| asio_streams.cpp:188:22:188:29 | call to source | semmle.label | call to source | +| asio_streams.cpp:190:32:190:39 | call to source | semmle.label | call to source | +| asio_streams.cpp:192:16:192:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:192:30:192:36 | *service | semmle.label | *service | +| asio_streams.cpp:193:16:193:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:193:30:193:36 | *service | semmle.label | *service | +| asio_streams.cpp:194:16:194:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:194:30:194:36 | *service | semmle.label | *service | +| asio_streams.cpp:195:16:195:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:195:30:195:36 | *service | semmle.label | *service | +| asio_streams.cpp:197:16:197:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:197:35:197:46 | service_view | semmle.label | service_view | +| asio_streams.cpp:198:16:198:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:198:35:198:46 | service_view | semmle.label | service_view | +| asio_streams.cpp:199:16:199:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:199:35:199:46 | service_view | semmle.label | service_view | +| asio_streams.cpp:200:16:200:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:200:35:200:46 | service_view | semmle.label | service_view | +| asio_streams.cpp:202:16:202:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:202:40:202:46 | *service | semmle.label | *service | +| asio_streams.cpp:203:16:203:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:203:40:203:46 | *service | semmle.label | *service | +| asio_streams.cpp:204:16:204:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:204:40:204:46 | *service | semmle.label | *service | +| asio_streams.cpp:205:16:205:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:205:40:205:46 | *service | semmle.label | *service | +| asio_streams.cpp:207:16:207:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:207:45:207:56 | service_view | semmle.label | service_view | +| asio_streams.cpp:208:16:208:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:208:45:208:56 | service_view | semmle.label | service_view | +| asio_streams.cpp:209:16:209:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:209:45:209:56 | service_view | semmle.label | service_view | +| asio_streams.cpp:210:16:210:22 | call to resolve | semmle.label | call to resolve | +| asio_streams.cpp:210:45:210:56 | service_view | semmle.label | service_view | | azure.cpp:253:48:253:60 | *call to GetBodyStream | semmle.label | *call to GetBodyStream | | azure.cpp:253:48:253:60 | call to GetBodyStream | semmle.label | call to GetBodyStream | | azure.cpp:257:5:257:8 | *resp | semmle.label | *resp | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected b/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected index 5851e825013d..f3423b983053 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/sinks.expected @@ -1,5 +1,5 @@ -| asio_streams.cpp:93:29:93:39 | recv_buffer | remote-sink | -| asio_streams.cpp:103:29:103:39 | send_buffer | remote-sink | +| asio_streams.cpp:135:29:135:39 | recv_buffer | remote-sink | +| asio_streams.cpp:145:29:145:39 | send_buffer | remote-sink | | test.cpp:12:10:12:10 | 0 | test-sink | | test.cpp:14:10:14:10 | x | test-sink | | test.cpp:18:10:18:10 | y | test-sink | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/sources.expected b/cpp/ql/test/library-tests/dataflow/external-models/sources.expected index b30f1e88b99a..6f1b889e2bb8 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/sources.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/sources.expected @@ -1,4 +1,4 @@ -| asio_streams.cpp:87:34:87:44 | read_until output argument | remote | +| asio_streams.cpp:129:34:129:44 | read_until output argument | remote | | azure.cpp:253:48:253:60 | call to GetBodyStream | remote | | azure.cpp:273:52:273:61 | call to GetHeaders | remote | | azure.cpp:277:38:277:44 | call to GetBody | remote | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/steps.expected b/cpp/ql/test/library-tests/dataflow/external-models/steps.expected index 42d2c0183c34..04d300ecbc81 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/steps.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/steps.expected @@ -1,4 +1,68 @@ -| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | +| asio_streams.cpp:142:64:142:71 | *send_str | asio_streams.cpp:142:44:142:62 | call to buffer | +| asio_streams.cpp:161:24:161:27 | *host | asio_streams.cpp:161:16:161:22 | call to resolve | +| asio_streams.cpp:161:30:161:36 | *service | asio_streams.cpp:161:16:161:22 | call to resolve | +| asio_streams.cpp:162:24:162:27 | *host | asio_streams.cpp:162:16:162:22 | call to resolve | +| asio_streams.cpp:162:30:162:36 | *service | asio_streams.cpp:162:16:162:22 | call to resolve | +| asio_streams.cpp:163:24:163:27 | *host | asio_streams.cpp:163:16:163:22 | call to resolve | +| asio_streams.cpp:163:30:163:36 | *service | asio_streams.cpp:163:16:163:22 | call to resolve | +| asio_streams.cpp:164:24:164:27 | *host | asio_streams.cpp:164:16:164:22 | call to resolve | +| asio_streams.cpp:164:30:164:36 | *service | asio_streams.cpp:164:16:164:22 | call to resolve | +| asio_streams.cpp:166:24:166:32 | host_view | asio_streams.cpp:166:16:166:22 | call to resolve | +| asio_streams.cpp:166:35:166:46 | service_view | asio_streams.cpp:166:16:166:22 | call to resolve | +| asio_streams.cpp:167:24:167:32 | host_view | asio_streams.cpp:167:16:167:22 | call to resolve | +| asio_streams.cpp:167:35:167:46 | service_view | asio_streams.cpp:167:16:167:22 | call to resolve | +| asio_streams.cpp:168:24:168:32 | host_view | asio_streams.cpp:168:16:168:22 | call to resolve | +| asio_streams.cpp:168:35:168:46 | service_view | asio_streams.cpp:168:16:168:22 | call to resolve | +| asio_streams.cpp:169:24:169:32 | host_view | asio_streams.cpp:169:16:169:22 | call to resolve | +| asio_streams.cpp:169:35:169:46 | service_view | asio_streams.cpp:169:16:169:22 | call to resolve | +| asio_streams.cpp:171:34:171:37 | *host | asio_streams.cpp:171:16:171:22 | call to resolve | +| asio_streams.cpp:171:40:171:46 | *service | asio_streams.cpp:171:16:171:22 | call to resolve | +| asio_streams.cpp:172:34:172:37 | *host | asio_streams.cpp:172:16:172:22 | call to resolve | +| asio_streams.cpp:172:40:172:46 | *service | asio_streams.cpp:172:16:172:22 | call to resolve | +| asio_streams.cpp:173:34:173:37 | *host | asio_streams.cpp:173:16:173:22 | call to resolve | +| asio_streams.cpp:173:40:173:46 | *service | asio_streams.cpp:173:16:173:22 | call to resolve | +| asio_streams.cpp:174:34:174:37 | *host | asio_streams.cpp:174:16:174:22 | call to resolve | +| asio_streams.cpp:174:40:174:46 | *service | asio_streams.cpp:174:16:174:22 | call to resolve | +| asio_streams.cpp:176:34:176:42 | host_view | asio_streams.cpp:176:16:176:22 | call to resolve | +| asio_streams.cpp:176:45:176:56 | service_view | asio_streams.cpp:176:16:176:22 | call to resolve | +| asio_streams.cpp:177:34:177:42 | host_view | asio_streams.cpp:177:16:177:22 | call to resolve | +| asio_streams.cpp:177:45:177:56 | service_view | asio_streams.cpp:177:16:177:22 | call to resolve | +| asio_streams.cpp:178:34:178:42 | host_view | asio_streams.cpp:178:16:178:22 | call to resolve | +| asio_streams.cpp:178:45:178:56 | service_view | asio_streams.cpp:178:16:178:22 | call to resolve | +| asio_streams.cpp:179:34:179:42 | host_view | asio_streams.cpp:179:16:179:22 | call to resolve | +| asio_streams.cpp:179:45:179:56 | service_view | asio_streams.cpp:179:16:179:22 | call to resolve | +| asio_streams.cpp:192:24:192:27 | *host | asio_streams.cpp:192:16:192:22 | call to resolve | +| asio_streams.cpp:192:30:192:36 | *service | asio_streams.cpp:192:16:192:22 | call to resolve | +| asio_streams.cpp:193:24:193:27 | *host | asio_streams.cpp:193:16:193:22 | call to resolve | +| asio_streams.cpp:193:30:193:36 | *service | asio_streams.cpp:193:16:193:22 | call to resolve | +| asio_streams.cpp:194:24:194:27 | *host | asio_streams.cpp:194:16:194:22 | call to resolve | +| asio_streams.cpp:194:30:194:36 | *service | asio_streams.cpp:194:16:194:22 | call to resolve | +| asio_streams.cpp:195:24:195:27 | *host | asio_streams.cpp:195:16:195:22 | call to resolve | +| asio_streams.cpp:195:30:195:36 | *service | asio_streams.cpp:195:16:195:22 | call to resolve | +| asio_streams.cpp:197:24:197:32 | host_view | asio_streams.cpp:197:16:197:22 | call to resolve | +| asio_streams.cpp:197:35:197:46 | service_view | asio_streams.cpp:197:16:197:22 | call to resolve | +| asio_streams.cpp:198:24:198:32 | host_view | asio_streams.cpp:198:16:198:22 | call to resolve | +| asio_streams.cpp:198:35:198:46 | service_view | asio_streams.cpp:198:16:198:22 | call to resolve | +| asio_streams.cpp:199:24:199:32 | host_view | asio_streams.cpp:199:16:199:22 | call to resolve | +| asio_streams.cpp:199:35:199:46 | service_view | asio_streams.cpp:199:16:199:22 | call to resolve | +| asio_streams.cpp:200:24:200:32 | host_view | asio_streams.cpp:200:16:200:22 | call to resolve | +| asio_streams.cpp:200:35:200:46 | service_view | asio_streams.cpp:200:16:200:22 | call to resolve | +| asio_streams.cpp:202:34:202:37 | *host | asio_streams.cpp:202:16:202:22 | call to resolve | +| asio_streams.cpp:202:40:202:46 | *service | asio_streams.cpp:202:16:202:22 | call to resolve | +| asio_streams.cpp:203:34:203:37 | *host | asio_streams.cpp:203:16:203:22 | call to resolve | +| asio_streams.cpp:203:40:203:46 | *service | asio_streams.cpp:203:16:203:22 | call to resolve | +| asio_streams.cpp:204:34:204:37 | *host | asio_streams.cpp:204:16:204:22 | call to resolve | +| asio_streams.cpp:204:40:204:46 | *service | asio_streams.cpp:204:16:204:22 | call to resolve | +| asio_streams.cpp:205:34:205:37 | *host | asio_streams.cpp:205:16:205:22 | call to resolve | +| asio_streams.cpp:205:40:205:46 | *service | asio_streams.cpp:205:16:205:22 | call to resolve | +| asio_streams.cpp:207:34:207:42 | host_view | asio_streams.cpp:207:16:207:22 | call to resolve | +| asio_streams.cpp:207:45:207:56 | service_view | asio_streams.cpp:207:16:207:22 | call to resolve | +| asio_streams.cpp:208:34:208:42 | host_view | asio_streams.cpp:208:16:208:22 | call to resolve | +| asio_streams.cpp:208:45:208:56 | service_view | asio_streams.cpp:208:16:208:22 | call to resolve | +| asio_streams.cpp:209:34:209:42 | host_view | asio_streams.cpp:209:16:209:22 | call to resolve | +| asio_streams.cpp:209:45:209:56 | service_view | asio_streams.cpp:209:16:209:22 | call to resolve | +| asio_streams.cpp:210:34:210:42 | host_view | asio_streams.cpp:210:16:210:22 | call to resolve | +| asio_streams.cpp:210:45:210:56 | service_view | asio_streams.cpp:210:16:210:22 | call to resolve | | azure.cpp:252:79:252:98 | call to string | azure.cpp:252:62:252:99 | call to Url | | azure.cpp:257:5:257:8 | *resp | azure.cpp:257:16:257:21 | Read output argument | | azure.cpp:262:5:262:8 | *resp | azure.cpp:262:23:262:28 | ReadToCount output argument | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected index 1fbe5da66459..694427213c86 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected @@ -3350,6 +3350,14 @@ | Dubious signature "(const IPAddressRange *,unsigned char **)" in summary model. | | Dubious signature "(const ISSUER_SIGN_TOOL *,unsigned char **)" in summary model. | | Dubious signature "(const ISSUING_DIST_POINT *,unsigned char **)" in summary model. | +| Dubious signature "(const InternetProtocol &,const string &,const string &)" in summary model. | +| Dubious signature "(const InternetProtocol &,const string &,const string &,error_code &)" in summary model. | +| Dubious signature "(const InternetProtocol &,const string &,const string &,flags)" in summary model. | +| Dubious signature "(const InternetProtocol &,const string &,const string &,flags,error_code &)" in summary model. | +| Dubious signature "(const InternetProtocol &,string_view,string_view)" in summary model. | +| Dubious signature "(const InternetProtocol &,string_view,string_view,error_code &)" in summary model. | +| Dubious signature "(const InternetProtocol &,string_view,string_view,flags)" in summary model. | +| Dubious signature "(const InternetProtocol &,string_view,string_view,flags,error_code &)" in summary model. | | Dubious signature "(const MATRIX *,const VECTOR *,VECTOR *)" in summary model. | | Dubious signature "(const MD5_params *)" in summary model. | | Dubious signature "(const ML_DSA_KEY *)" in summary model. | @@ -4153,6 +4161,10 @@ | Dubious signature "(const stack_st_X509_EXTENSION *,int,int)" in summary model. | | Dubious signature "(const stack_st_X509_NAME *)" in summary model. | | Dubious signature "(const stat *)" in summary model. | +| Dubious signature "(const string &,const string &)" in summary model. | +| Dubious signature "(const string &,const string &,error_code &)" in summary model. | +| Dubious signature "(const string &,const string &,flags)" in summary model. | +| Dubious signature "(const string &,const string &,flags,error_code &)" in summary model. | | Dubious signature "(const td_thragent_t *,lwpid_t,td_thrhandle_t *)" in summary model. | | Dubious signature "(const td_thragent_t *,ps_prochandle **)" in summary model. | | Dubious signature "(const td_thragent_t *,pthread_t,td_thrhandle_t *)" in summary model. | @@ -5180,6 +5192,8 @@ | Dubious signature "(string_buf *,uint32_t *)" in summary model. | | Dubious signature "(string_buf *,unsigned char *)" in summary model. | | Dubious signature "(string_buf *,unsigned char **,size_t *)" in summary model. | +| Dubious signature "(string_view,string_view,error_code &)" in summary model. | +| Dubious signature "(string_view,string_view,flags,error_code &)" in summary model. | | Dubious signature "(stringtable *,const char *)" in summary model. | | Dubious signature "(stringtable *,stringtable_finalized *)" in summary model. | | Dubious signature "(support_descriptors *,const char *,FILE *)" in summary model. | diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected index 2da7e83cca37..65a5391a3ed0 100644 --- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected +++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected @@ -15040,6 +15040,38 @@ getSignatureParameterName | (const ISSUER_SIGN_TOOL *,unsigned char **) | | i2d_ISSUER_SIGN_TOOL | 1 | unsigned char ** | | (const ISSUING_DIST_POINT *,unsigned char **) | | i2d_ISSUING_DIST_POINT | 0 | const ISSUING_DIST_POINT * | | (const ISSUING_DIST_POINT *,unsigned char **) | | i2d_ISSUING_DIST_POINT | 1 | unsigned char ** | +| (const InternetProtocol &,const string &,const string &) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,const string &,const string &) | basic_resolver | resolve | 1 | const string & | +| (const InternetProtocol &,const string &,const string &) | basic_resolver | resolve | 2 | const string & | +| (const InternetProtocol &,const string &,const string &,error_code &) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,const string &,const string &,error_code &) | basic_resolver | resolve | 1 | const string & | +| (const InternetProtocol &,const string &,const string &,error_code &) | basic_resolver | resolve | 2 | const string & | +| (const InternetProtocol &,const string &,const string &,error_code &) | basic_resolver | resolve | 3 | error_code & | +| (const InternetProtocol &,const string &,const string &,flags) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,const string &,const string &,flags) | basic_resolver | resolve | 1 | const string & | +| (const InternetProtocol &,const string &,const string &,flags) | basic_resolver | resolve | 2 | const string & | +| (const InternetProtocol &,const string &,const string &,flags) | basic_resolver | resolve | 3 | flags | +| (const InternetProtocol &,const string &,const string &,flags,error_code &) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,const string &,const string &,flags,error_code &) | basic_resolver | resolve | 1 | const string & | +| (const InternetProtocol &,const string &,const string &,flags,error_code &) | basic_resolver | resolve | 2 | const string & | +| (const InternetProtocol &,const string &,const string &,flags,error_code &) | basic_resolver | resolve | 3 | flags | +| (const InternetProtocol &,const string &,const string &,flags,error_code &) | basic_resolver | resolve | 4 | error_code & | +| (const InternetProtocol &,string_view,string_view) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,string_view,string_view) | basic_resolver | resolve | 1 | string_view | +| (const InternetProtocol &,string_view,string_view) | basic_resolver | resolve | 2 | string_view | +| (const InternetProtocol &,string_view,string_view,error_code &) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,string_view,string_view,error_code &) | basic_resolver | resolve | 1 | string_view | +| (const InternetProtocol &,string_view,string_view,error_code &) | basic_resolver | resolve | 2 | string_view | +| (const InternetProtocol &,string_view,string_view,error_code &) | basic_resolver | resolve | 3 | error_code & | +| (const InternetProtocol &,string_view,string_view,flags) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,string_view,string_view,flags) | basic_resolver | resolve | 1 | string_view | +| (const InternetProtocol &,string_view,string_view,flags) | basic_resolver | resolve | 2 | string_view | +| (const InternetProtocol &,string_view,string_view,flags) | basic_resolver | resolve | 3 | flags | +| (const InternetProtocol &,string_view,string_view,flags,error_code &) | basic_resolver | resolve | 0 | const class:0 & | +| (const InternetProtocol &,string_view,string_view,flags,error_code &) | basic_resolver | resolve | 1 | string_view | +| (const InternetProtocol &,string_view,string_view,flags,error_code &) | basic_resolver | resolve | 2 | string_view | +| (const InternetProtocol &,string_view,string_view,flags,error_code &) | basic_resolver | resolve | 3 | flags | +| (const InternetProtocol &,string_view,string_view,flags,error_code &) | basic_resolver | resolve | 4 | error_code & | | (const MATRIX *,const VECTOR *,VECTOR *) | | ossl_ml_dsa_matrix_mult_vector | 0 | const MATRIX * | | (const MATRIX *,const VECTOR *,VECTOR *) | | ossl_ml_dsa_matrix_mult_vector | 1 | const VECTOR * | | (const MATRIX *,const VECTOR *,VECTOR *) | | ossl_ml_dsa_matrix_mult_vector | 2 | VECTOR * | @@ -18552,6 +18584,18 @@ getSignatureParameterName | (const stat *) | | get_stat_ctime_ns | 0 | const stat * | | (const stat *) | | get_stat_mtime | 0 | const stat * | | (const stat *) | | get_stat_mtime_ns | 0 | const stat * | +| (const string &,const string &) | basic_resolver | resolve | 0 | const string & | +| (const string &,const string &) | basic_resolver | resolve | 1 | const string & | +| (const string &,const string &,error_code &) | basic_resolver | resolve | 0 | const string & | +| (const string &,const string &,error_code &) | basic_resolver | resolve | 1 | const string & | +| (const string &,const string &,error_code &) | basic_resolver | resolve | 2 | error_code & | +| (const string &,const string &,flags) | basic_resolver | resolve | 0 | const string & | +| (const string &,const string &,flags) | basic_resolver | resolve | 1 | const string & | +| (const string &,const string &,flags) | basic_resolver | resolve | 2 | flags | +| (const string &,const string &,flags,error_code &) | basic_resolver | resolve | 0 | const string & | +| (const string &,const string &,flags,error_code &) | basic_resolver | resolve | 1 | const string & | +| (const string &,const string &,flags,error_code &) | basic_resolver | resolve | 2 | flags | +| (const string &,const string &,flags,error_code &) | basic_resolver | resolve | 3 | error_code & | | (const td_thragent_t *,lwpid_t,td_thrhandle_t *) | | __td_ta_lookup_th_unique | 0 | const td_thragent_t * | | (const td_thragent_t *,lwpid_t,td_thrhandle_t *) | | __td_ta_lookup_th_unique | 1 | lwpid_t | | (const td_thragent_t *,lwpid_t,td_thrhandle_t *) | | __td_ta_lookup_th_unique | 2 | td_thrhandle_t * | @@ -24702,6 +24746,18 @@ getSignatureParameterName | (string_buf *,unsigned char **,size_t *) | | _libssh2_get_string | 0 | string_buf * | | (string_buf *,unsigned char **,size_t *) | | _libssh2_get_string | 1 | unsigned char ** | | (string_buf *,unsigned char **,size_t *) | | _libssh2_get_string | 2 | size_t * | +| (string_view,string_view) | basic_resolver | resolve | 0 | string_view | +| (string_view,string_view) | basic_resolver | resolve | 1 | string_view | +| (string_view,string_view,error_code &) | basic_resolver | resolve | 0 | string_view | +| (string_view,string_view,error_code &) | basic_resolver | resolve | 1 | string_view | +| (string_view,string_view,error_code &) | basic_resolver | resolve | 2 | error_code & | +| (string_view,string_view,flags) | basic_resolver | resolve | 0 | string_view | +| (string_view,string_view,flags) | basic_resolver | resolve | 1 | string_view | +| (string_view,string_view,flags) | basic_resolver | resolve | 2 | flags | +| (string_view,string_view,flags,error_code &) | basic_resolver | resolve | 0 | string_view | +| (string_view,string_view,flags,error_code &) | basic_resolver | resolve | 1 | string_view | +| (string_view,string_view,flags,error_code &) | basic_resolver | resolve | 2 | flags | +| (string_view,string_view,flags,error_code &) | basic_resolver | resolve | 3 | error_code & | | (stringtable *,const char *) | | stringtable_add | 0 | stringtable * | | (stringtable *,const char *) | | stringtable_add | 1 | const char * | | (stringtable *,stringtable_finalized *) | | stringtable_finalize | 0 | stringtable * | diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.27.0.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.27.0.rst new file mode 100644 index 000000000000..43dd62546243 --- /dev/null +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.27.0.rst @@ -0,0 +1,152 @@ +.. _codeql-cli-2.27.0: + +========================== +CodeQL 2.27.0 (2026-09-09) +========================== + +.. contents:: Contents + :depth: 2 + :local: + :backlinks: none + +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__. + +Security Coverage +----------------- + +CodeQL 2.27.0 runs a total of 498 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE). 1 security query has been added with this release. + +CodeQL CLI +---------- + +Deprecations +~~~~~~~~~~~~ + +* Language support for Java 9 and 10 has been deprecated and will be removed in January 2027. Java 7 and 8 will continue to be supported. +* The generic multi-platform :code:`codeql.zip` CLI distribution is deprecated and will be removed in a future release. Download the per-platform + :code:`codeql-PLATFORM.zip` for your platform instead. The CLI now emits a warning when it is run from an all-platforms distribution; set + :code:`CODEQL_ALLOW_ALL_PLATFORMS_DIST=true` to suppress it. + +New Features +~~~~~~~~~~~~ + +* CodeQL now supports native Linux arm64 (:code:`linux-arm64`) as a first-class platform. The per-platform CLI (:code:`codeql-linux-arm64.zip`) and CodeQL bundle + (:code:`codeql-bundle-linux-arm64.tar.gz` and :code:`codeql-bundle-linux-arm64.tar.zst`) + are available as release assets. Arm64 binaries are provided as a per-platform download only, and are not included in the combined :code:`codeql.zip`, + :code:`codeql-bundle.tar.gz`, or :code:`codeql-bundle.tar.zst`. +* CodeQL can now take advantage of an organization's private registry configurations in Code Scanning Default Setup to authenticate to container registries or the GitHub API when trying to fetch custom queries or packs. + This allows custom queries or packs to be accessed from private locations in Code Scanning Default Setup as long as suitable "Git Source" or "Docker Registry" private registry configurations are set up for the organization. + +Query Packs +----------- + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* The :code:`cpp/leap-year/unsafe-array-for-days-of-the-year` query ("Unsafe array for days of the year") no longer reports an alert on the :code:`__PRETTY_FUNCTION__` variable (and related variables) when the enclosing function has a signature that is exactly 364 characters. + +C# +"" + +* The :code:`cs/linq/missed-where` query no longer flags :code:`foreach` loops where the matching branch terminates the method, iterator, or loop instead of continuing with filtered loop work. + +JavaScript/TypeScript +""""""""""""""""""""" + +* HTML files are now included in file-coverage stats, and will start showing up on the status page for CodeQL under "Scanned Files". + +Rust +"""" + +* The :code:`rust/hard-coded-cryptographic-value` query has been adjusted to produce fewer results in certain situations where many results were being produced with very similar source locations. +* The :code:`rust/unused-variable` query no longer reports variables in functions containing the standard :code:`todo!()` or :code:`unimplemented!()` macros. + +New Queries +~~~~~~~~~~~ + +Rust +"""" + +* Added a new query, :code:`rust/command-line-injection`, to detect uncontrolled command lines. + +Language Libraries +------------------ + +Bug Fixes +~~~~~~~~~ + +Python +"""""" + +* Fixed a bug where a Python file could be silently dropped from the analysis (with a spurious "A parse error occurred" diagnostic) when it contained a string literal, comment, or identifier with a character such as the U+FE0F emoji variation selector, a U+200D zero width joiner, or a combining accent. +* Fixed the extraction of PEP 758 :code:`except A, B:` clauses by the default (non-tree-sitter) Python parser. Previously the second exception type was extracted as a Python 2 style alias binding, so it was recorded as a :code:`Store` rather than a use. This caused false positives from queries that reason about whether a name is used, such as :code:`py/unused-import`. When extracting Python 2 (:code:`--lang=2`), :code:`except A, e:` continues to bind :code:`e` as an alias, since that is what the syntax means in that version. + +Breaking Changes +~~~~~~~~~~~~~~~~ + +Ruby +"""" + +* The Ruby control flow graph implementation has been completely replaced. This affects a number of queries slightly. The CFG now includes additional nodes to more accurately represent certain constructs. This also means that any existing code that implicitly relies on very specific details about the CFG may need to be updated. The CFG no longer uses splitting, which means that AST nodes now have a unique CFG node representation. In particular, + :code:`ControlFlowNode.getAstNode` has changed its meaning. The AST-to-CFG mapping remains one-to-many, but now for a different reason. It used to be because of splitting, but now it's because of additional "helper" CFG nodes. To get the + (now canonical) CFG node for a given AST node, use + :code:`Stmt.getControlFlowNode()` instead. + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* Added the PostgreSQL libpq (asynchronous) query-execution functions :code:`PQexec`, :code:`PQexecParams`, :code:`PQprepare`, :code:`PQsendQuery`, :code:`PQsendQueryParams`, :code:`PQsendPrepare` as :code:`sql-injection` sinks. +* Initializers of compiler-generated variables are now recognized as compiler-generated. A new predicate :code:`isCompilerGenerated` on :code:`Initializer` has been added to reflect this. + +C# +"" + +* In :code:`build-mode: none`, project and solution restoration is now always attempted using the feeds available. +* C# analysis with build mode :code:`none` now lists unreachable explicitly configured NuGet feeds in both the extraction warning and the tool status page note. This makes it easier to identify feeds that may cause dependencies to be missing from the analysis. +* Improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, including application parts, endpoint mappings, inherited actions, and controller and action exclusions. Service-injected action parameters are no longer modeled as remote input. + +Java/Kotlin +""""""""""" + +* Added modeling for the Micronaut framework, including HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks. + +GitHub Actions +"""""""""""""" + +* Checks on author association fields read from the event payload (e.g. :code:`github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as :code:`github.event.pull_request.author_association != 'NONE'` on a workflow triggered by :code:`issues` events was treated as a protective check even though :code:`github.event.pull_request` is not populated for :code:`issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the :code:`ControlCheck` class. + +Rust +"""" + +* Canonical paths for Rust trait items now use the format :code:`::item` instead of + :code:`crate::Trait::item`. Custom data extension models that reference trait items must be updated to use the new format. + +New Features +~~~~~~~~~~~~ + +C/C++ +""""" + +* Sources and sinks defined using models-as-data now support access paths with fields. For example, the path :code:`ReturnValue.Field[S::f]` makes the field :code:`S::f` a flow source when it is returned by a call. + +C# +"" + +* Added taint modeling for OData action parameter binding (:code:`Microsoft.AspNet.OData`\ /\ :code:`Microsoft.AspNetCore.OData`). Values cast, :code:`as`\ -converted, or type-tested out of :code:`ODataActionParameters`, and entities tracked by :code:`Delta` (via :code:`GetInstance`, :code:`Patch`, :code:`Put`, :code:`CopyChangedValues`, and :code:`CopyUnchangedValues`), now taint the members of the target type. + +Java/Kotlin +""""""""""" + +* Factories returned by the Apache Commons Secure XML (:code:`org.apache.commons.xml.secure`) hardening library's :code:`SecureDocumentBuilderFactory`, :code:`SecureSAXParserFactory`, :code:`SecureXMLInputFactory`, :code:`SecureTransformerFactory` and :code:`SecureSchemaFactory` classes are now recognized as safely configured by the XXE query. +* A new extensible class :code:`SafeXmlFactorySource` was added to :code:`semmle.code.java.security.XmlParsers` for modeling sources of pre-hardened JAXP factories. + +GitHub Actions +"""""""""""""" + +* GitHub Actions databases now extract :code:`actions.lock` files. The new :code:`ActionsLock` class provides access to their YAML abstract syntax trees. diff --git a/docs/codeql/codeql-overview/codeql-changelog/index.rst b/docs/codeql/codeql-overview/codeql-changelog/index.rst index 0267c6ef8ef5..5b85a3b05e44 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/index.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst @@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here
- +

CodeQL documentation

CodeQL enables you to query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same.

diff --git a/go/ql/lib/change-notes/2026-09-09-go-1.27-models.md b/go/ql/lib/change-notes/2026-09-09-go-1.27-models.md new file mode 100644 index 000000000000..94c1b4469b73 --- /dev/null +++ b/go/ql/lib/change-notes/2026-09-09-go-1.27-models.md @@ -0,0 +1,7 @@ +--- +category: minorAnalysis +--- +* Added or improved data flow models for the following Go standard-library APIs introduced or updated in Go 1.27: + * `bytes.CutLast`, `database/sql.ConvertAssign`, `database/sql/driver.RowsColumnScanner.ScanColumn`, `net/url.URL.Clone`, `net/url.Values.Clone` and `strings.CutLast`. + * The new `encoding/json/jsontext` package. +* Added more data flow models for the `strings` package: `strings.Clone`, `Cut`, `CutPrefix`, `CutSuffix`, `Fields`, `FieldsFunc`, and `Join`; `strings.Builder.String`, `Builder.WriteByte`, and `Builder.WriteRune`; `strings.Reader.ReadByte` and `Reader.ReadRune`; and `strings.Replacer.Replace` and `Replacer.WriteString`. diff --git a/go/ql/lib/ext/bytes.model.yml b/go/ql/lib/ext/bytes.model.yml index b55749f828bf..9f5ad37176a7 100644 --- a/go/ql/lib/ext/bytes.model.yml +++ b/go/ql/lib/ext/bytes.model.yml @@ -5,6 +5,7 @@ extensions: data: - ["bytes", "", False, "Clone", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["bytes", "", False, "Cut", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"] + - ["bytes", "", False, "CutLast", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"] - ["bytes", "", False, "CutPrefix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] - ["bytes", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] - ["bytes", "", False, "Fields", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] diff --git a/go/ql/lib/ext/database.sql.driver.model.yml b/go/ql/lib/ext/database.sql.driver.model.yml index 0f33a6e14b8c..2c5770e26194 100644 --- a/go/ql/lib/ext/database.sql.driver.model.yml +++ b/go/ql/lib/ext/database.sql.driver.model.yml @@ -24,5 +24,6 @@ extensions: - ["database/sql/driver", "Conn", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] - ["database/sql/driver", "ConnPrepareContext", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"] - ["database/sql/driver", "Rows", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"] + - ["database/sql/driver", "RowsColumnScanner", True, "ScanColumn", "", "", "Argument[receiver]", "Argument[2]", "taint", "manual"] - ["database/sql/driver", "ValueConverter", True, "ConvertValue", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] - ["database/sql/driver", "Valuer", True, "Value", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] diff --git a/go/ql/lib/ext/database.sql.model.yml b/go/ql/lib/ext/database.sql.model.yml index 8d67dd921423..3f37c2a6eab4 100644 --- a/go/ql/lib/ext/database.sql.model.yml +++ b/go/ql/lib/ext/database.sql.model.yml @@ -49,6 +49,7 @@ extensions: pack: codeql/go-all extensible: summaryModel data: + - ["database/sql", "", False, "ConvertAssign", "", "", "Argument[2]", "Argument[1]", "taint", "manual"] - ["database/sql", "", False, "Named", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] - ["database/sql", "Conn", True, "PrepareContext", "", "", "Argument[1]", "ReturnValue[0]", "taint", "manual"] - ["database/sql", "DB", True, "Prepare", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] diff --git a/go/ql/lib/ext/encoding.json.jsontext.model.yml b/go/ql/lib/ext/encoding.json.jsontext.model.yml new file mode 100644 index 000000000000..d04afceaefe2 --- /dev/null +++ b/go/ql/lib/ext/encoding.json.jsontext.model.yml @@ -0,0 +1,36 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["encoding/json/jsontext", "", False, "AppendFloat", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "AppendFormat", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "AppendQuote", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "AppendUnquote", "", "", "Argument[0..1]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "NewDecoder", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "Float", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "Float32", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "Int", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "String", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "", False, "Uint", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Decoder", True, "ReadToken", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Decoder", True, "ReadValue", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Decoder", True, "Reset", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] + - ["encoding/json/jsontext", "Decoder", True, "UnreadBuffer", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Encoder", True, "Reset", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Encoder", True, "WriteToken", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] + - ["encoding/json/jsontext", "Encoder", True, "WriteValue", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] + - ["encoding/json/jsontext", "Pointer", True, "AppendToken", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Pointer", True, "AppendToken", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Pointer", True, "LastToken", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Pointer", True, "Parent", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Token", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Token", True, "Float", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Token", True, "Float32", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Token", True, "Int", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Token", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Token", True, "Uint", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Value", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Value", True, "MarshalJSON", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["encoding/json/jsontext", "Value", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["encoding/json/jsontext", "Value", True, "UnmarshalJSON", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] diff --git a/go/ql/lib/ext/net.url.model.yml b/go/ql/lib/ext/net.url.model.yml index 0b48aa2352c2..ca4cf2c170f2 100644 --- a/go/ql/lib/ext/net.url.model.yml +++ b/go/ql/lib/ext/net.url.model.yml @@ -12,6 +12,7 @@ extensions: - ["net/url", "", False, "QueryUnescape", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] - ["net/url", "", False, "User", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["net/url", "", False, "UserPassword", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["net/url", "URL", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] - ["net/url", "URL", True, "EscapedPath", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] - ["net/url", "URL", True, "Hostname", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] - ["net/url", "URL", True, "MarshalBinary", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] @@ -24,5 +25,6 @@ extensions: - ["net/url", "URL", True, "ResolveReference", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["net/url", "Userinfo", True, "Password", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] - ["net/url", "Userinfo", True, "Username", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["net/url", "Values", True, "Clone", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] - ["net/url", "Values", True, "Encode", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] - ["net/url", "Values", True, "Get", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] diff --git a/go/ql/lib/ext/strings.model.yml b/go/ql/lib/ext/strings.model.yml index 01015b31517e..4a6d852baab4 100644 --- a/go/ql/lib/ext/strings.model.yml +++ b/go/ql/lib/ext/strings.model.yml @@ -3,9 +3,15 @@ extensions: pack: codeql/go-all extensible: summaryModel data: - - ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["strings", "", False, "Join", "", "", "Argument[0..1]", "ReturnValue", "taint", "manual"] + - ["strings", "", False, "Clone", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - ["strings", "", False, "Cut", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"] + - ["strings", "", False, "CutLast", "", "", "Argument[0]", "ReturnValue[0..1]", "taint", "manual"] + - ["strings", "", False, "CutPrefix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] + - ["strings", "", False, "CutSuffix", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"] + - ["strings", "", False, "Fields", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"] + - ["strings", "", False, "FieldsFunc", "", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "manual"] + - ["strings", "", False, "Join", "", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "manual"] + - ["strings", "", False, "Join", "", "", "Argument[1]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "Map", "", "", "Argument[1]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "NewReader", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "Repeat", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] @@ -34,6 +40,13 @@ extensions: - ["strings", "", False, "TrimRightFunc", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "TrimSpace", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] - ["strings", "", False, "TrimSuffix", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["strings", "Builder", True, "String", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] + - ["strings", "Builder", True, "WriteByte", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] + - ["strings", "Builder", True, "WriteRune", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] + - ["strings", "Reader", True, "ReadByte", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] + - ["strings", "Reader", True, "ReadRune", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"] - ["strings", "Reader", True, "Reset", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"] + - ["strings", "Replacer", True, "Replace", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"] - ["strings", "Replacer", True, "Replace", "", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["strings", "Replacer", True, "WriteString", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"] - ["strings", "Replacer", True, "WriteString", "", "", "Argument[1]", "Argument[0]", "taint", "manual"] diff --git a/go/ql/lib/semmle/go/frameworks/stdlib/EncodingJson.qll b/go/ql/lib/semmle/go/frameworks/stdlib/EncodingJson.qll index bf6e25ff9f12..e04f9392def7 100644 --- a/go/ql/lib/semmle/go/frameworks/stdlib/EncodingJson.qll +++ b/go/ql/lib/semmle/go/frameworks/stdlib/EncodingJson.qll @@ -41,9 +41,15 @@ module EncodingJson { FunctionOutput outp; FunctionModels() { - // signature: func NewEncoder(w io.Writer) *Encoder - this.hasQualifiedName("encoding/json", "NewEncoder") and - (inp.isResult() and outp.isParameter(0)) + ( + // signature: func NewEncoder(w io.Writer) *Encoder + this.hasQualifiedName("encoding/json", "NewEncoder") + or + // signature: func NewEncoder(w io.Writer, opts ...Options) *Encoder + this.hasQualifiedName("encoding/json/jsontext", "NewEncoder") + ) and + inp.isResult() and + outp.isParameter(0) } override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go index ac528c46267d..d744819e2807 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Bytes.go @@ -335,6 +335,20 @@ func TaintStepTest_Cutright(sourceCQL interface{}) interface{} { return right } +func TaintStepTest_CutLastleft(sourceCQL interface{}) interface{} { + fromReader628 := sourceCQL.([]byte) + sep := []byte{} + left, _, _ := bytes.CutLast(fromReader628, sep) + return left +} + +func TaintStepTest_CutLastright(sourceCQL interface{}) interface{} { + fromReader628 := sourceCQL.([]byte) + sep := []byte{} + _, right, _ := bytes.CutLast(fromReader628, sep) + return right +} + func TaintStepTest_CutPrefix(sourceCQL interface{}) interface{} { fromReader628 := sourceCQL.([]byte) sep := []byte{} @@ -636,4 +650,14 @@ func RunAllTaints_Bytes() { out := TaintStepTest_BytesBufferPeek(source) sink(55, out) } + { + source := newSource(56) + out := TaintStepTest_CutLastleft(source) + sink(56, out) + } + { + source := newSource(57) + out := TaintStepTest_CutLastright(source) + sink(57, out) + } } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go index 59a61cff31a9..3e2f5af18bba 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSql.go @@ -2,7 +2,10 @@ package main -import "database/sql" +import ( + "database/sql" + "database/sql/driver" +) func TaintStepTest_DatabaseSqlNamed_B0I0O0(sourceCQL interface{}) interface{} { fromString656 := sourceCQL.(string) @@ -79,6 +82,12 @@ func TaintStepTest_DatabaseSqlConnPrepareContext(sourceCQL interface{}) interfac return intoPrepareResult0 } +func TaintStepTest_DatabaseSqlConvertAssign(sourceCQL interface{}) interface{} { + var destination interface{} + sql.ConvertAssign(driver.ScanContext{}, &destination, sourceCQL) + return destination +} + func RunAllTaints_DatabaseSql() { { source := newSource(0) @@ -135,4 +144,9 @@ func RunAllTaints_DatabaseSql() { out := TaintStepTest_DatabaseSqlConnPrepareContext(source) sink(10, out) } + { + source := newSource(11) + out := TaintStepTest_DatabaseSqlConvertAssign(source) + sink(11, out) + } } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go index fe44132e0fb4..ff572e9d889d 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/DatabaseSqlDriver.go @@ -45,6 +45,13 @@ func TaintStepTest_DatabaseSqlDriverValuerValue_B0I0O0(sourceCQL interface{}) in return intoValue982 } +func TaintStepTest_DatabaseSqlDriverRowsColumnScannerScanColumn(sourceCQL interface{}) interface{} { + fromRows := sourceCQL.(driver.RowsColumnScanner) + var destination interface{} + fromRows.ScanColumn(driver.ScanContext{}, 0, &destination) + return destination +} + func RunAllTaints_DatabaseSqlDriver() { { source := newSource(0) @@ -76,4 +83,9 @@ func RunAllTaints_DatabaseSqlDriver() { out := TaintStepTest_DatabaseSqlDriverValuerValue_B0I0O0(source) sink(5, out) } + { + source := newSource(6) + out := TaintStepTest_DatabaseSqlDriverRowsColumnScannerScanColumn(source) + sink(6, out) + } } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJsonJsontext.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJsonJsontext.go new file mode 100644 index 000000000000..771de17ded3f --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/EncodingJsonJsontext.go @@ -0,0 +1,413 @@ +package main + +import ( + "encoding/json/jsontext" + "io" +) + +func TaintStepTest_JsontextAppendFloat_I0(sourceCQL interface{}) interface{} { + fromByte := sourceCQL.([]byte) + intoByte := jsontext.AppendFloat(fromByte, 0, 64) + return intoByte +} + +func TaintStepTest_JsontextAppendFloat_I1(sourceCQL interface{}) interface{} { + fromFloat := sourceCQL.(float64) + intoByte := jsontext.AppendFloat(nil, fromFloat, 64) + return intoByte +} + +func TaintStepTest_JsontextAppendFormat_I0(sourceCQL interface{}) interface{} { + fromByte := sourceCQL.([]byte) + intoByte, _ := jsontext.AppendFormat(fromByte, []byte{}) + return intoByte +} + +func TaintStepTest_JsontextAppendFormat_I1(sourceCQL interface{}) interface{} { + fromByte := sourceCQL.([]byte) + intoByte, _ := jsontext.AppendFormat(nil, fromByte) + return intoByte +} + +func TaintStepTest_JsontextAppendQuote_I0(sourceCQL interface{}) interface{} { + fromByte := sourceCQL.([]byte) + intoByte, _ := jsontext.AppendQuote(fromByte, []byte{}) + return intoByte +} + +func TaintStepTest_JsontextAppendQuote_I1(sourceCQL interface{}) interface{} { + fromString := sourceCQL.(string) + intoByte, _ := jsontext.AppendQuote(nil, fromString) + return intoByte +} + +func TaintStepTest_JsontextAppendUnquote_I0(sourceCQL interface{}) interface{} { + fromByte := sourceCQL.([]byte) + intoByte, _ := jsontext.AppendUnquote(fromByte, []byte{}) + return intoByte +} + +func TaintStepTest_JsontextAppendUnquote_I1(sourceCQL interface{}) interface{} { + fromString := sourceCQL.(string) + intoByte, _ := jsontext.AppendUnquote(nil, fromString) + return intoByte +} + +func TaintStepTest_JsontextNewDecoder(sourceCQL interface{}) interface{} { + fromReader := sourceCQL.(io.Reader) + intoDecoder := jsontext.NewDecoder(fromReader) + return intoDecoder +} + +func TaintStepTest_JsontextNewEncoder(sourceCQL interface{}) interface{} { + fromEncoder := sourceCQL.(*jsontext.Encoder) + var intoWriter io.Writer + intermediateCQL := jsontext.NewEncoder(intoWriter) + link(fromEncoder, intermediateCQL) + return intoWriter +} + +func TaintStepTest_JsontextFloat(sourceCQL interface{}) interface{} { + fromFloat := sourceCQL.(float64) + intoToken := jsontext.Float(fromFloat) + return intoToken +} + +func TaintStepTest_JsontextFloat32(sourceCQL interface{}) interface{} { + fromFloat := sourceCQL.(float32) + intoToken := jsontext.Float32(fromFloat) + return intoToken +} + +func TaintStepTest_JsontextInt(sourceCQL interface{}) interface{} { + fromInt := sourceCQL.(int64) + intoToken := jsontext.Int(fromInt) + return intoToken +} + +func TaintStepTest_JsontextString(sourceCQL interface{}) interface{} { + fromString := sourceCQL.(string) + intoToken := jsontext.String(fromString) + return intoToken +} + +func TaintStepTest_JsontextUint(sourceCQL interface{}) interface{} { + fromUint := sourceCQL.(uint64) + intoToken := jsontext.Uint(fromUint) + return intoToken +} + +func TaintStepTest_JsontextDecoderReadToken(sourceCQL interface{}) interface{} { + fromDecoder := sourceCQL.(jsontext.Decoder) + intoToken, _ := fromDecoder.ReadToken() + return intoToken +} + +func TaintStepTest_JsontextDecoderReadValue(sourceCQL interface{}) interface{} { + fromDecoder := sourceCQL.(jsontext.Decoder) + intoValue, _ := fromDecoder.ReadValue() + return intoValue +} + +func TaintStepTest_JsontextDecoderReset(sourceCQL interface{}) interface{} { + fromReader := sourceCQL.(io.Reader) + var intoDecoder jsontext.Decoder + intoDecoder.Reset(fromReader) + return intoDecoder +} + +func TaintStepTest_JsontextDecoderUnreadBuffer(sourceCQL interface{}) interface{} { + fromDecoder := sourceCQL.(jsontext.Decoder) + intoByte := fromDecoder.UnreadBuffer() + return intoByte +} + +func TaintStepTest_JsontextEncoderReset(sourceCQL interface{}) interface{} { + fromEncoder := sourceCQL.(jsontext.Encoder) + var intoWriter io.Writer + fromEncoder.Reset(intoWriter) + return intoWriter +} + +func TaintStepTest_JsontextEncoderWriteToken(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + var intoEncoder jsontext.Encoder + intoEncoder.WriteToken(fromToken) + return intoEncoder +} + +func TaintStepTest_JsontextEncoderWriteValue(sourceCQL interface{}) interface{} { + fromValue := sourceCQL.(jsontext.Value) + var intoEncoder jsontext.Encoder + intoEncoder.WriteValue(fromValue) + return intoEncoder +} + +func TaintStepTest_JsontextPointerAppendToken_Receiver(sourceCQL interface{}) interface{} { + fromPointer := sourceCQL.(jsontext.Pointer) + intoPointer := fromPointer.AppendToken("") + return intoPointer +} + +func TaintStepTest_JsontextPointerAppendToken_I0(sourceCQL interface{}) interface{} { + fromString := sourceCQL.(string) + var pointer jsontext.Pointer + intoPointer := pointer.AppendToken(fromString) + return intoPointer +} + +func TaintStepTest_JsontextPointerLastToken(sourceCQL interface{}) interface{} { + fromPointer := sourceCQL.(jsontext.Pointer) + intoString := fromPointer.LastToken() + return intoString +} + +func TaintStepTest_JsontextPointerParent(sourceCQL interface{}) interface{} { + fromPointer := sourceCQL.(jsontext.Pointer) + intoPointer := fromPointer.Parent() + return intoPointer +} + +func TaintStepTest_JsontextTokenClone(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + intoToken := fromToken.Clone() + return intoToken +} + +func TaintStepTest_JsontextTokenFloat(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + intoFloat, _ := fromToken.Float() + return intoFloat +} + +func TaintStepTest_JsontextTokenFloat32(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + intoFloat, _ := fromToken.Float32() + return intoFloat +} + +func TaintStepTest_JsontextTokenInt(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + intoInt, _ := fromToken.Int() + return intoInt +} + +func TaintStepTest_JsontextTokenString(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + intoString := fromToken.String() + return intoString +} + +func TaintStepTest_JsontextTokenUint(sourceCQL interface{}) interface{} { + fromToken := sourceCQL.(jsontext.Token) + intoUint, _ := fromToken.Uint() + return intoUint +} + +func TaintStepTest_JsontextValueClone(sourceCQL interface{}) interface{} { + fromValue := sourceCQL.(jsontext.Value) + intoValue := fromValue.Clone() + return intoValue +} + +func TaintStepTest_JsontextValueMarshalJSON(sourceCQL interface{}) interface{} { + fromValue := sourceCQL.(jsontext.Value) + intoByte, _ := fromValue.MarshalJSON() + return intoByte +} + +func TaintStepTest_JsontextValueString(sourceCQL interface{}) interface{} { + fromValue := sourceCQL.(jsontext.Value) + intoString := fromValue.String() + return intoString +} + +func TaintStepTest_JsontextValueUnmarshalJSON(sourceCQL interface{}) interface{} { + fromByte := sourceCQL.([]byte) + var intoValue jsontext.Value + intoValue.UnmarshalJSON(fromByte) + return intoValue +} + +func RunAllTaints_EncodingJsonJsontext() { + { + source := newSource(0) + out := TaintStepTest_JsontextAppendFloat_I0(source) + sink(0, out) + } + { + source := newSource(1) + out := TaintStepTest_JsontextAppendFloat_I1(source) + sink(1, out) + } + { + source := newSource(2) + out := TaintStepTest_JsontextAppendFormat_I0(source) + sink(2, out) + } + { + source := newSource(3) + out := TaintStepTest_JsontextAppendFormat_I1(source) + sink(3, out) + } + { + source := newSource(4) + out := TaintStepTest_JsontextAppendQuote_I0(source) + sink(4, out) + } + { + source := newSource(5) + out := TaintStepTest_JsontextAppendQuote_I1(source) + sink(5, out) + } + { + source := newSource(6) + out := TaintStepTest_JsontextAppendUnquote_I0(source) + sink(6, out) + } + { + source := newSource(7) + out := TaintStepTest_JsontextAppendUnquote_I1(source) + sink(7, out) + } + { + source := newSource(8) + out := TaintStepTest_JsontextNewDecoder(source) + sink(8, out) + } + { + source := newSource(9) + out := TaintStepTest_JsontextNewEncoder(source) + sink(9, out) + } + { + source := newSource(10) + out := TaintStepTest_JsontextFloat(source) + sink(10, out) + } + { + source := newSource(11) + out := TaintStepTest_JsontextFloat32(source) + sink(11, out) + } + { + source := newSource(12) + out := TaintStepTest_JsontextInt(source) + sink(12, out) + } + { + source := newSource(13) + out := TaintStepTest_JsontextString(source) + sink(13, out) + } + { + source := newSource(14) + out := TaintStepTest_JsontextUint(source) + sink(14, out) + } + { + source := newSource(15) + out := TaintStepTest_JsontextDecoderReadToken(source) + sink(15, out) + } + { + source := newSource(16) + out := TaintStepTest_JsontextDecoderReadValue(source) + sink(16, out) + } + { + source := newSource(17) + out := TaintStepTest_JsontextDecoderReset(source) + sink(17, out) + } + { + source := newSource(18) + out := TaintStepTest_JsontextDecoderUnreadBuffer(source) + sink(18, out) + } + { + source := newSource(19) + out := TaintStepTest_JsontextEncoderReset(source) + sink(19, out) + } + { + source := newSource(20) + out := TaintStepTest_JsontextEncoderWriteToken(source) + sink(20, out) + } + { + source := newSource(21) + out := TaintStepTest_JsontextEncoderWriteValue(source) + sink(21, out) + } + { + source := newSource(22) + out := TaintStepTest_JsontextPointerAppendToken_Receiver(source) + sink(22, out) + } + { + source := newSource(23) + out := TaintStepTest_JsontextPointerAppendToken_I0(source) + sink(23, out) + } + { + source := newSource(24) + out := TaintStepTest_JsontextPointerLastToken(source) + sink(24, out) + } + { + source := newSource(25) + out := TaintStepTest_JsontextPointerParent(source) + sink(25, out) + } + { + source := newSource(26) + out := TaintStepTest_JsontextTokenClone(source) + sink(26, out) + } + { + source := newSource(27) + out := TaintStepTest_JsontextTokenFloat(source) + sink(27, out) + } + { + source := newSource(28) + out := TaintStepTest_JsontextTokenFloat32(source) + sink(28, out) + } + { + source := newSource(29) + out := TaintStepTest_JsontextTokenInt(source) + sink(29, out) + } + { + source := newSource(30) + out := TaintStepTest_JsontextTokenString(source) + sink(30, out) + } + { + source := newSource(31) + out := TaintStepTest_JsontextTokenUint(source) + sink(31, out) + } + { + source := newSource(32) + out := TaintStepTest_JsontextValueClone(source) + sink(32, out) + } + { + source := newSource(33) + out := TaintStepTest_JsontextValueMarshalJSON(source) + sink(33, out) + } + { + source := newSource(34) + out := TaintStepTest_JsontextValueString(source) + sink(34, out) + } + { + source := newSource(35) + out := TaintStepTest_JsontextValueUnmarshalJSON(source) + sink(35, out) + } +} diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go index ebf7fce029d0..86129bedbff2 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/NetHttp.go @@ -6,6 +6,7 @@ import ( "bufio" "io" "net/http" + "net/url" ) func TaintStepTest_NetHttpCanonicalHeaderKey_B0I0O0(sourceCQL interface{}) interface{} { @@ -175,6 +176,16 @@ func TaintStepTest_NetHttpResponseWriterWrite_B0I0O0(sourceCQL interface{}) inte return intoResponseWriter139 } +func TaintStepTest_NetUrlURLClone(sourceCQL interface{}) interface{} { + fromURL := sourceCQL.(*url.URL) + return fromURL.Clone() +} + +func TaintStepTest_NetUrlValuesClone(sourceCQL interface{}) interface{} { + fromValues := sourceCQL.(url.Values) + return fromValues.Clone() +} + func RunAllTaints_NetHttp() { { source := newSource(0) @@ -306,4 +317,14 @@ func RunAllTaints_NetHttp() { out := TaintStepTest_NetHttpResponseWriterWrite_B0I0O0(source) sink(23, out) } + { + source := newSource(26) + out := TaintStepTest_NetUrlURLClone(source) + sink(26, out) + } + { + source := newSource(27) + out := TaintStepTest_NetUrlValuesClone(source) + sink(27, out) + } } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go index 878f4809130b..ac152a84c3b5 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Strings.go @@ -7,21 +7,80 @@ import ( "strings" ) +func TaintStepTest_StringsClone(sourceCQL interface{}) interface{} { + return strings.Clone(sourceCQL.(string)) +} + +func TaintStepTest_StringsCutleft(sourceCQL interface{}) interface{} { + left, _, _ := strings.Cut(sourceCQL.(string), "") + return left +} + +func TaintStepTest_StringsCutright(sourceCQL interface{}) interface{} { + _, right, _ := strings.Cut(sourceCQL.(string), "") + return right +} + +func TaintStepTest_StringsCutPrefix(sourceCQL interface{}) interface{} { + result, _ := strings.CutPrefix(sourceCQL.(string), "") + return result +} + +func TaintStepTest_StringsCutSuffix(sourceCQL interface{}) interface{} { + result, _ := strings.CutSuffix(sourceCQL.(string), "") + return result +} + +func TaintStepTest_StringsFieldsFuncSeq(sourceCQL interface{}) interface{} { + for result := range strings.FieldsFuncSeq(sourceCQL.(string), nil) { + return result + } + return "" +} + +func TaintStepTest_StringsFieldsSeq(sourceCQL interface{}) interface{} { + for result := range strings.FieldsSeq(sourceCQL.(string)) { + return result + } + return "" +} + +func TaintStepTest_StringsLines(sourceCQL interface{}) interface{} { + for result := range strings.Lines(sourceCQL.(string)) { + return result + } + return "" +} + +func TaintStepTest_StringsSplitAfterSeq(sourceCQL interface{}) interface{} { + for result := range strings.SplitAfterSeq(sourceCQL.(string), "") { + return result + } + return "" +} + +func TaintStepTest_StringsSplitSeq(sourceCQL interface{}) interface{} { + for result := range strings.SplitSeq(sourceCQL.(string), "") { + return result + } + return "" +} + func TaintStepTest_StringsFields_B0I0O0(sourceCQL interface{}) interface{} { fromString656 := sourceCQL.(string) intoString414 := strings.Fields(fromString656) - return intoString414 + return intoString414[0] } func TaintStepTest_StringsFieldsFunc_B0I0O0(sourceCQL interface{}) interface{} { fromString518 := sourceCQL.(string) intoString650 := strings.FieldsFunc(fromString518, nil) - return intoString650 + return intoString650[0] } func TaintStepTest_StringsJoin_B0I0O0(sourceCQL interface{}) interface{} { - fromString784 := sourceCQL.([]string) - intoString957 := strings.Join(fromString784, "") + fromString784 := sourceCQL.(string) + intoString957 := strings.Join([]string{fromString784}, "") return intoString957 } @@ -231,6 +290,18 @@ func TaintStepTest_StringsBuilderWriteString_B0I0O0(sourceCQL interface{}) inter return intoBuilder389 } +func TaintStepTest_StringsBuilderWriteByte(sourceCQL interface{}) interface{} { + var builder strings.Builder + builder.WriteByte(sourceCQL.(byte)) + return builder +} + +func TaintStepTest_StringsBuilderWriteRune(sourceCQL interface{}) interface{} { + var builder strings.Builder + builder.WriteRune(sourceCQL.(rune)) + return builder +} + func TaintStepTest_StringsReaderRead_B0I0O0(sourceCQL interface{}) interface{} { fromReader198 := sourceCQL.(strings.Reader) var intoByte477 []byte @@ -245,6 +316,18 @@ func TaintStepTest_StringsReaderReadAt_B0I0O0(sourceCQL interface{}) interface{} return intoByte382 } +func TaintStepTest_StringsReaderReadByte(sourceCQL interface{}) interface{} { + reader := sourceCQL.(strings.Reader) + result, _ := reader.ReadByte() + return result +} + +func TaintStepTest_StringsReaderReadRune(sourceCQL interface{}) interface{} { + reader := sourceCQL.(strings.Reader) + result, _, _ := reader.ReadRune() + return result +} + func TaintStepTest_StringsReaderReset_B0I0O0(sourceCQL interface{}) interface{} { fromString715 := sourceCQL.(string) var intoReader179 strings.Reader @@ -274,6 +357,28 @@ func TaintStepTest_StringsReplacerWriteString_B0I0O0(sourceCQL interface{}) inte return intoWriter754 } +func TaintStepTest_StringsReplacerReplaceReceiver(sourceCQL interface{}) interface{} { + return sourceCQL.(*strings.Replacer).Replace("") +} + +func TaintStepTest_StringsReplacerWriteStringReceiver(sourceCQL interface{}) interface{} { + var writer io.Writer + sourceCQL.(*strings.Replacer).WriteString(writer, "") + return writer +} + +func TaintStepTest_StringsCutLastleft(sourceCQL interface{}) interface{} { + fromString := sourceCQL.(string) + left, _, _ := strings.CutLast(fromString, "") + return left +} + +func TaintStepTest_StringsCutLastright(sourceCQL interface{}) interface{} { + fromString := sourceCQL.(string) + _, right, _ := strings.CutLast(fromString, "") + return right +} + func RunAllTaints_Strings() { { source := newSource(0) @@ -490,4 +595,94 @@ func RunAllTaints_Strings() { out := TaintStepTest_StringsReplacerWriteString_B0I0O0(source) sink(42, out) } + { + source := newSource(43) + out := TaintStepTest_StringsCutLastleft(source) + sink(43, out) + } + { + source := newSource(44) + out := TaintStepTest_StringsCutLastright(source) + sink(44, out) + } + { + source := newSource(45) + out := TaintStepTest_StringsClone(source) + sink(45, out) + } + { + source := newSource(46) + out := TaintStepTest_StringsCutleft(source) + sink(46, out) + } + { + source := newSource(47) + out := TaintStepTest_StringsCutright(source) + sink(47, out) + } + { + source := newSource(48) + out := TaintStepTest_StringsCutPrefix(source) + sink(48, out) + } + { + source := newSource(49) + out := TaintStepTest_StringsCutSuffix(source) + sink(49, out) + } + // { + // source := newSource(50) + // out := TaintStepTest_StringsFieldsFuncSeq(source) + // sink(50, out) + // } + // { + // source := newSource(51) + // out := TaintStepTest_StringsFieldsSeq(source) + // sink(51, out) + // } + // { + // source := newSource(52) + // out := TaintStepTest_StringsLines(source) + // sink(52, out) + // } + // { + // source := newSource(53) + // out := TaintStepTest_StringsSplitAfterSeq(source) + // sink(53, out) + // } + // { + // source := newSource(54) + // out := TaintStepTest_StringsSplitSeq(source) + // sink(54, out) + // } + { + source := newSource(55) + out := TaintStepTest_StringsBuilderWriteByte(source) + sink(55, out) + } + { + source := newSource(56) + out := TaintStepTest_StringsBuilderWriteRune(source) + sink(56, out) + } + { + source := newSource(57) + out := TaintStepTest_StringsReaderReadByte(source) + sink(57, out) + } + { + source := newSource(58) + out := TaintStepTest_StringsReaderReadRune(source) + sink(58, out) + } + { + source := newSource(59) + out := TaintStepTest_StringsReplacerReplaceReceiver(source) + sink(59, out) + } + { + source := newSource(60) + out := TaintStepTest_StringsReplacerWriteStringReceiver(source) + sink(60, out) + } } diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/go.mod b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/go.mod index 1a8220297f27..50e9957cce14 100644 --- a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/go.mod +++ b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/go.mod @@ -1,6 +1,6 @@ module example.com/m -go 1.26 +go 1.27 require ( golang.org/x/net v0.0.0-20201010224723-4f7140c49acb