Skip to content

Commit 19fcf3c

Browse files
owen-mcowen-mc
authored
Merge pull request #18454 from owen-mc/go/mad/encoding-and-weak
Go: Add models for standard library updates in Go 1.24
2 parents a21dfc9 + dbad4df commit 19fcf3c

File tree

8 files changed

+130
-36
lines changed

8 files changed

+130
-36
lines changed

‎go/ql/lib/change-notes/2025-01-09-model-stdlib-1.24.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Taint models have been added for the `weak` package, which was added in Go 1.24.
5+
* Taint models have been added for the interfaces `TextAppender` and `BinaryAppender` in the `encoding` package, which were added in Go 1.24.

‎go/ql/lib/ext/encoding.model.yml

+4
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,11 @@ extensions:
33
pack: codeql/go-all
44
extensible: summaryModel
55
data:
6+
- ["encoding", "BinaryAppender", True, "AppendBinary", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
7+
- ["encoding", "BinaryAppender", True, "AppendBinary", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
68
- ["encoding", "BinaryMarshaler", True, "MarshalBinary", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
79
- ["encoding", "BinaryUnmarshaler", True, "UnmarshalBinary", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]
10+
- ["encoding", "TextAppender", True, "AppendText", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
11+
- ["encoding", "TextAppender", True, "AppendText", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
812
- ["encoding", "TextMarshaler", True, "MarshalText", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
913
- ["encoding", "TextUnmarshaler", True, "UnmarshalText", "", "", "Argument[0]", "Argument[receiver]", "taint", "manual"]

‎go/ql/lib/ext/weak.model.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: summaryModel
5+
data:
6+
- ["weak", "", False, "Make", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
7+
- ["weak", "Pointer", False, "Value", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]

‎go/ql/test/library-tests/semmle/go/frameworks/BeegoOrm/StoredXss.expected

+36-32
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,36 @@
1+
#select
2+
| test.go:81:13:81:29 | type conversion | test.go:80:13:80:16 | &... | test.go:81:13:81:29 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:80:13:80:16 | &... | stored value |
3+
| test.go:82:13:82:43 | type conversion | test.go:80:13:80:16 | &... | test.go:82:13:82:43 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:80:13:80:16 | &... | stored value |
4+
| test.go:86:13:86:30 | type conversion | test.go:85:22:85:26 | &... | test.go:86:13:86:30 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:85:22:85:26 | &... | stored value |
5+
| test.go:90:13:90:30 | type conversion | test.go:89:21:89:25 | &... | test.go:90:13:90:30 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:89:21:89:25 | &... | stored value |
6+
| test.go:95:13:95:37 | type conversion | test.go:95:20:95:36 | call to Value | test.go:95:13:95:37 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:95:20:95:36 | call to Value | stored value |
7+
| test.go:96:13:96:49 | type conversion | test.go:96:20:96:39 | call to RawValue | test.go:96:13:96:49 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:96:20:96:39 | call to RawValue | stored value |
8+
| test.go:97:13:97:38 | type conversion | test.go:97:20:97:37 | call to String | test.go:97:13:97:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:97:20:97:37 | call to String | stored value |
9+
| test.go:98:13:98:37 | type conversion | test.go:98:20:98:36 | call to Value | test.go:98:13:98:37 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:98:20:98:36 | call to Value | stored value |
10+
| test.go:99:13:99:49 | type conversion | test.go:99:20:99:39 | call to RawValue | test.go:99:13:99:49 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:99:20:99:39 | call to RawValue | stored value |
11+
| test.go:100:13:100:38 | type conversion | test.go:100:20:100:37 | call to String | test.go:100:13:100:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:100:20:100:37 | call to String | stored value |
12+
| test.go:101:13:101:38 | type conversion | test.go:101:20:101:37 | call to Value | test.go:101:13:101:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:101:20:101:37 | call to Value | stored value |
13+
| test.go:102:13:102:50 | type conversion | test.go:102:20:102:40 | call to RawValue | test.go:102:13:102:50 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:102:20:102:40 | call to RawValue | stored value |
14+
| test.go:103:13:103:39 | type conversion | test.go:103:20:103:38 | call to String | test.go:103:13:103:39 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:103:20:103:38 | call to String | stored value |
15+
| test.go:110:13:110:33 | type conversion | test.go:109:9:109:13 | &... | test.go:110:13:110:33 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:109:9:109:13 | &... | stored value |
16+
| test.go:114:13:114:29 | type conversion | test.go:113:9:113:12 | &... | test.go:114:13:114:29 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:113:9:113:12 | &... | stored value |
17+
| test.go:118:13:118:48 | type conversion | test.go:117:12:117:19 | &... | test.go:118:13:118:48 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:117:12:117:19 | &... | stored value |
18+
| test.go:122:13:122:43 | type conversion | test.go:121:16:121:24 | &... | test.go:122:13:122:43 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:121:16:121:24 | &... | stored value |
19+
| test.go:126:13:126:39 | type conversion | test.go:125:16:125:23 | &... | test.go:126:13:126:39 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:125:16:125:23 | &... | stored value |
20+
| test.go:130:13:130:47 | type conversion | test.go:129:15:129:24 | &... | test.go:130:13:130:47 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:129:15:129:24 | &... | stored value |
21+
| test.go:134:13:134:38 | type conversion | test.go:133:18:133:30 | &... | test.go:134:13:134:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:133:18:133:30 | &... | stored value |
22+
| test.go:141:13:141:48 | type conversion | test.go:140:12:140:19 | &... | test.go:141:13:141:48 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:140:12:140:19 | &... | stored value |
23+
| test.go:145:13:145:43 | type conversion | test.go:144:16:144:24 | &... | test.go:145:13:145:43 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:144:16:144:24 | &... | stored value |
24+
| test.go:149:13:149:39 | type conversion | test.go:148:16:148:23 | &... | test.go:149:13:149:39 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:148:16:148:23 | &... | stored value |
25+
| test.go:153:13:153:47 | type conversion | test.go:152:15:152:24 | &... | test.go:153:13:153:47 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:152:15:152:24 | &... | stored value |
26+
| test.go:157:13:157:38 | type conversion | test.go:156:18:156:30 | &... | test.go:157:13:157:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:156:18:156:30 | &... | stored value |
27+
| test.go:161:13:161:28 | type conversion | test.go:160:14:160:22 | &... | test.go:161:13:161:28 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:160:14:160:22 | &... | stored value |
28+
| test.go:165:13:165:32 | type conversion | test.go:164:15:164:24 | &... | test.go:165:13:165:32 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:164:15:164:24 | &... | stored value |
129
edges
2-
| test.go:80:13:80:16 | &... | test.go:81:13:81:29 | type conversion | provenance | Src:MaD:339 |
3-
| test.go:80:13:80:16 | &... | test.go:82:13:82:43 | type conversion | provenance | Src:MaD:339 |
4-
| test.go:85:22:85:26 | &... | test.go:86:13:86:30 | type conversion | provenance | Src:MaD:340 |
5-
| test.go:89:21:89:25 | &... | test.go:90:13:90:30 | type conversion | provenance | Src:MaD:341 |
30+
| test.go:80:13:80:16 | &... | test.go:81:13:81:29 | type conversion | provenance | Src:MaD:1 |
31+
| test.go:80:13:80:16 | &... | test.go:82:13:82:43 | type conversion | provenance | Src:MaD:1 |
32+
| test.go:85:22:85:26 | &... | test.go:86:13:86:30 | type conversion | provenance | Src:MaD:2 |
33+
| test.go:89:21:89:25 | &... | test.go:90:13:90:30 | type conversion | provenance | Src:MaD:3 |
634
| test.go:95:20:95:36 | call to Value | test.go:95:13:95:37 | type conversion | provenance | |
735
| test.go:96:20:96:39 | call to RawValue | test.go:96:13:96:49 | type conversion | provenance | |
836
| test.go:97:20:97:37 | call to String | test.go:97:13:97:38 | type conversion | provenance | |
@@ -26,6 +54,10 @@ edges
2654
| test.go:156:18:156:30 | &... | test.go:157:13:157:38 | type conversion | provenance | |
2755
| test.go:160:14:160:22 | &... | test.go:161:13:161:28 | type conversion | provenance | |
2856
| test.go:164:15:164:24 | &... | test.go:165:13:165:32 | type conversion | provenance | |
57+
models
58+
| 1 | Source: group:beego-orm; Ormer; true; Read; ; ; Argument[0]; database; manual |
59+
| 2 | Source: group:beego-orm; Ormer; true; ReadForUpdate; ; ; Argument[0]; database; manual |
60+
| 3 | Source: group:beego-orm; Ormer; true; ReadOrCreate; ; ; Argument[0]; database; manual |
2961
nodes
3062
| test.go:80:13:80:16 | &... | semmle.label | &... |
3163
| test.go:81:13:81:29 | type conversion | semmle.label | type conversion |
@@ -81,31 +113,3 @@ nodes
81113
| test.go:164:15:164:24 | &... | semmle.label | &... |
82114
| test.go:165:13:165:32 | type conversion | semmle.label | type conversion |
83115
subpaths
84-
#select
85-
| test.go:81:13:81:29 | type conversion | test.go:80:13:80:16 | &... | test.go:81:13:81:29 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:80:13:80:16 | &... | stored value |
86-
| test.go:82:13:82:43 | type conversion | test.go:80:13:80:16 | &... | test.go:82:13:82:43 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:80:13:80:16 | &... | stored value |
87-
| test.go:86:13:86:30 | type conversion | test.go:85:22:85:26 | &... | test.go:86:13:86:30 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:85:22:85:26 | &... | stored value |
88-
| test.go:90:13:90:30 | type conversion | test.go:89:21:89:25 | &... | test.go:90:13:90:30 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:89:21:89:25 | &... | stored value |
89-
| test.go:95:13:95:37 | type conversion | test.go:95:20:95:36 | call to Value | test.go:95:13:95:37 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:95:20:95:36 | call to Value | stored value |
90-
| test.go:96:13:96:49 | type conversion | test.go:96:20:96:39 | call to RawValue | test.go:96:13:96:49 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:96:20:96:39 | call to RawValue | stored value |
91-
| test.go:97:13:97:38 | type conversion | test.go:97:20:97:37 | call to String | test.go:97:13:97:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:97:20:97:37 | call to String | stored value |
92-
| test.go:98:13:98:37 | type conversion | test.go:98:20:98:36 | call to Value | test.go:98:13:98:37 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:98:20:98:36 | call to Value | stored value |
93-
| test.go:99:13:99:49 | type conversion | test.go:99:20:99:39 | call to RawValue | test.go:99:13:99:49 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:99:20:99:39 | call to RawValue | stored value |
94-
| test.go:100:13:100:38 | type conversion | test.go:100:20:100:37 | call to String | test.go:100:13:100:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:100:20:100:37 | call to String | stored value |
95-
| test.go:101:13:101:38 | type conversion | test.go:101:20:101:37 | call to Value | test.go:101:13:101:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:101:20:101:37 | call to Value | stored value |
96-
| test.go:102:13:102:50 | type conversion | test.go:102:20:102:40 | call to RawValue | test.go:102:13:102:50 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:102:20:102:40 | call to RawValue | stored value |
97-
| test.go:103:13:103:39 | type conversion | test.go:103:20:103:38 | call to String | test.go:103:13:103:39 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:103:20:103:38 | call to String | stored value |
98-
| test.go:110:13:110:33 | type conversion | test.go:109:9:109:13 | &... | test.go:110:13:110:33 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:109:9:109:13 | &... | stored value |
99-
| test.go:114:13:114:29 | type conversion | test.go:113:9:113:12 | &... | test.go:114:13:114:29 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:113:9:113:12 | &... | stored value |
100-
| test.go:118:13:118:48 | type conversion | test.go:117:12:117:19 | &... | test.go:118:13:118:48 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:117:12:117:19 | &... | stored value |
101-
| test.go:122:13:122:43 | type conversion | test.go:121:16:121:24 | &... | test.go:122:13:122:43 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:121:16:121:24 | &... | stored value |
102-
| test.go:126:13:126:39 | type conversion | test.go:125:16:125:23 | &... | test.go:126:13:126:39 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:125:16:125:23 | &... | stored value |
103-
| test.go:130:13:130:47 | type conversion | test.go:129:15:129:24 | &... | test.go:130:13:130:47 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:129:15:129:24 | &... | stored value |
104-
| test.go:134:13:134:38 | type conversion | test.go:133:18:133:30 | &... | test.go:134:13:134:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:133:18:133:30 | &... | stored value |
105-
| test.go:141:13:141:48 | type conversion | test.go:140:12:140:19 | &... | test.go:141:13:141:48 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:140:12:140:19 | &... | stored value |
106-
| test.go:145:13:145:43 | type conversion | test.go:144:16:144:24 | &... | test.go:145:13:145:43 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:144:16:144:24 | &... | stored value |
107-
| test.go:149:13:149:39 | type conversion | test.go:148:16:148:23 | &... | test.go:149:13:149:39 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:148:16:148:23 | &... | stored value |
108-
| test.go:153:13:153:47 | type conversion | test.go:152:15:152:24 | &... | test.go:153:13:153:47 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:152:15:152:24 | &... | stored value |
109-
| test.go:157:13:157:38 | type conversion | test.go:156:18:156:30 | &... | test.go:157:13:157:38 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:156:18:156:30 | &... | stored value |
110-
| test.go:161:13:161:28 | type conversion | test.go:160:14:160:22 | &... | test.go:161:13:161:28 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:160:14:160:22 | &... | stored value |
111-
| test.go:165:13:165:32 | type conversion | test.go:164:15:164:24 | &... | test.go:165:13:165:32 | type conversion | Stored cross-site scripting vulnerability due to $@. | test.go:164:15:164:24 | &... | stored value |

‎go/ql/test/library-tests/semmle/go/frameworks/BeegoOrm/StoredXss.qlref

+2-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
Security/CWE-079/StoredXss.ql
1+
query: Security/CWE-079/StoredXss.ql
2+
postprocess: utils/test/PrettyPrintModels.ql

‎go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Encoding.go

+48-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
// Code generated by https://github.com/gagliardetto/codebox. DO NOT EDIT.
2-
31
package main
42

53
import "encoding"
@@ -30,6 +28,34 @@ func TaintStepTest_EncodingTextUnmarshalerUnmarshalText_B0I0O0(sourceCQL interfa
3028
return intoTextUnmarshaler443
3129
}
3230

31+
func TaintStepTest_EncodingBinaryAppenderAppendBinary_manual1(sourceCQL interface{}) interface{} {
32+
fromBinaryAppender := sourceCQL.(encoding.BinaryAppender)
33+
var arg0 []byte
34+
intoByte, _ := fromBinaryAppender.AppendBinary(arg0)
35+
return intoByte
36+
}
37+
38+
func TaintStepTest_EncodingBinaryAppenderAppendBinary_manual2(sourceCQL interface{}) interface{} {
39+
var recv encoding.BinaryAppender
40+
fromByteSlice := sourceCQL.([]byte)
41+
intoByte, _ := recv.AppendBinary(fromByteSlice)
42+
return intoByte
43+
}
44+
45+
func TaintStepTest_EncodingTextAppenderAppendText_manual1(sourceCQL interface{}) interface{} {
46+
fromTextAppender := sourceCQL.(encoding.TextAppender)
47+
var arg0 []byte
48+
intoByte, _ := fromTextAppender.AppendText(arg0)
49+
return intoByte
50+
}
51+
52+
func TaintStepTest_EncodingTextAppenderAppendText_manual2(sourceCQL interface{}) interface{} {
53+
var recv encoding.TextAppender
54+
fromByteSlice := sourceCQL.([]byte)
55+
intoByte, _ := recv.AppendText(fromByteSlice)
56+
return intoByte
57+
}
58+
3359
func RunAllTaints_Encoding() {
3460
{
3561
source := newSource(0)
@@ -51,4 +77,24 @@ func RunAllTaints_Encoding() {
5177
out := TaintStepTest_EncodingTextUnmarshalerUnmarshalText_B0I0O0(source)
5278
sink(3, out)
5379
}
80+
{
81+
source := newSource(4)
82+
out := TaintStepTest_EncodingBinaryAppenderAppendBinary_manual1(source)
83+
sink(4, out)
84+
}
85+
{
86+
source := newSource(5)
87+
out := TaintStepTest_EncodingBinaryAppenderAppendBinary_manual2(source)
88+
sink(5, out)
89+
}
90+
{
91+
source := newSource(6)
92+
out := TaintStepTest_EncodingTextAppenderAppendText_manual1(source)
93+
sink(6, out)
94+
}
95+
{
96+
source := newSource(7)
97+
out := TaintStepTest_EncodingTextAppenderAppendText_manual2(source)
98+
sink(7, out)
99+
}
54100
}

‎go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Weak.go

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
package main
2+
3+
import "weak"
4+
5+
func TaintStepTest_WeakMake_manual(sourceCQL interface{}) interface{} {
6+
fromStringPointer := sourceCQL.(*string)
7+
intoWeakPointer := weak.Make(fromStringPointer)
8+
return intoWeakPointer
9+
}
10+
func TaintStepTest_WeakValue_manual(sourceCQL interface{}) interface{} {
11+
fromWeakPointer := sourceCQL.(weak.Pointer[string])
12+
intoStringPointer := fromWeakPointer.Value()
13+
return intoStringPointer
14+
}
15+
16+
func RunAllTaints_Weak() {
17+
{
18+
source := newSource(0)
19+
out := TaintStepTest_WeakMake_manual(source)
20+
sink(0, out)
21+
}
22+
{
23+
source := newSource(1)
24+
out := TaintStepTest_WeakValue_manual(source)
25+
sink(1, out)
26+
}
27+
}

‎go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module example.com/m
22

3-
go 1.23
3+
go 1.24
44

55
require (
66
golang.org/x/net v0.0.0-20201010224723-4f7140c49acb

0 commit comments

Comments
 (0)