Skip to content

Commit 92910f9

Browse files
smowtonsmowton
authored
Merge pull request #17296 from smowton/smowton/admin/revert-mad-sink-conversion
Go: Revert problematic conversion from QL-specified sink nodes to models-as-data; add change note for one correct but undocumented fix
2 parents b6f1024 + 7cb67a5 commit 92910f9

File tree

67 files changed

+833
-1527
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+833
-1527
lines changed

‎go/ql/lib/change-notes/2024-08-24-ioutil-fix.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed an issue where `io/ioutil.WriteFile`'s non-path arguments incorrectly generated `go/path-injection` alerts when untrusted data was written to a file, or controlled the file's mode.
5+

‎go/ql/lib/ext/database.sql.driver.model.yml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,4 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/go-all
4-
extensible: sinkModel
5-
data:
6-
- ["database/sql/driver", "Execer", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
7-
- ["database/sql/driver", "ExecerContext", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
8-
- ["database/sql/driver", "Conn", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
9-
- ["database/sql/driver", "ConnPrepareContext", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
10-
- ["database/sql/driver", "Queryer", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
11-
- ["database/sql/driver", "QueryerContext", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
122
- addsTo:
133
pack: codeql/go-all
144
extensible: summaryModel

‎go/ql/lib/ext/database.sql.model.yml

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,4 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/go-all
4-
extensible: sinkModel
5-
data:
6-
- ["database/sql", "Conn", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
7-
- ["database/sql", "Conn", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
8-
- ["database/sql", "Conn", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
9-
- ["database/sql", "Conn", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
10-
- ["database/sql", "Conn", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
11-
- ["database/sql", "Conn", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
12-
- ["database/sql", "Conn", False, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
13-
- ["database/sql", "Conn", False, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
14-
- ["database/sql", "DB", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
15-
- ["database/sql", "DB", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
16-
- ["database/sql", "DB", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
17-
- ["database/sql", "DB", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
18-
- ["database/sql", "DB", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
19-
- ["database/sql", "DB", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
20-
- ["database/sql", "DB", False, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
21-
- ["database/sql", "DB", False, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
22-
- ["database/sql", "Tx", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
23-
- ["database/sql", "Tx", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
24-
- ["database/sql", "Tx", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
25-
- ["database/sql", "Tx", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
26-
- ["database/sql", "Tx", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
27-
- ["database/sql", "Tx", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
28-
- ["database/sql", "Tx", False, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
29-
- ["database/sql", "Tx", False, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
302
- addsTo:
313
pack: codeql/go-all
324
extensible: summaryModel

‎go/ql/lib/ext/fmt.model.yml

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,4 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/go-all
4-
extensible: sinkModel
5-
data:
6-
- ["fmt", "", False, "Print", "", "", "Argument[0]", "log-injection", "manual"]
7-
- ["fmt", "", False, "Printf", "", "", "Argument[0..1]", "log-injection", "manual"]
8-
- ["fmt", "", False, "Println", "", "", "Argument[0]", "log-injection", "manual"]
92
- addsTo:
103
pack: codeql/go-all
114
extensible: summaryModel

‎go/ql/lib/ext/github.com.beego.beego.client.orm.model.yml

Lines changed: 0 additions & 42 deletions
This file was deleted.

‎go/ql/lib/ext/github.com.beego.beego.core.logs.model.yml

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎go/ql/lib/ext/github.com.beego.beego.core.utils.model.yml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,6 @@ extensions:
66
- ["beego-utils", "github.com/astaxie/beego/utils"]
77
- ["beego-utils", "github.com/beego/beego/utils"]
88
- ["beego-utils", "github.com/beego/beego/core/utils"]
9-
- addsTo:
10-
pack: codeql/go-all
11-
extensible: sinkModel
12-
data:
13-
- ["group:beego-utils", "", False, "Display", "", "", "Argument[0]", "log-injection", "manual"]
149
- addsTo:
1510
pack: codeql/go-all
1611
extensible: summaryModel

‎go/ql/lib/ext/github.com.beego.beego.server.web.model.yml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,6 @@ extensions:
1010
pack: codeql/go-all
1111
extensible: sinkModel
1212
data:
13-
# log-injection
14-
- ["group:beego", "", False, "Alert", "", "", "Argument[0..1]", "log-injection", "manual"]
15-
- ["group:beego", "", False, "Critical", "", "", "Argument[0..1]", "log-injection", "manual"]
16-
- ["group:beego", "", False, "Debug", "", "", "Argument[0..1]", "log-injection", "manual"]
17-
- ["group:beego", "", False, "Emergency", "", "", "Argument[0..1]", "log-injection", "manual"]
18-
- ["group:beego", "", False, "Error", "", "", "Argument[0..1]", "log-injection", "manual"]
19-
- ["group:beego", "", False, "Info", "", "", "Argument[0..1]", "log-injection", "manual"]
20-
- ["group:beego", "", False, "Informational", "", "", "Argument[0..1]", "log-injection", "manual"]
21-
- ["group:beego", "", False, "Notice", "", "", "Argument[0..1]", "log-injection", "manual"]
22-
- ["group:beego", "", False, "Trace", "", "", "Argument[0..1]", "log-injection", "manual"]
23-
- ["group:beego", "", False, "Warn", "", "", "Argument[0..1]", "log-injection", "manual"]
24-
- ["group:beego", "", False, "Warning", "", "", "Argument[0..1]", "log-injection", "manual"]
2513
# path-injection
2614
- ["group:beego", "", False, "Walk", "", "", "Argument[1]", "path-injection", "manual"]
2715
- ["group:beego", "Controller", False, "SaveToFile", "", "", "Argument[1]", "path-injection", "manual"]

‎go/ql/lib/ext/github.com.couchbase.gocb.model.yml

Lines changed: 21 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -3,43 +3,28 @@ extensions:
33
pack: codeql/go-all
44
extensible: packageGrouping
55
data:
6-
- ["gocb1", "fixed-version:github.com/couchbase/gocb"]
7-
- ["gocb1", "fixed-version:gopkg.in/couchbase/gocb.v1"]
8-
- ["gocb1", "fixed-version:github.com/couchbaselabs/gocb"]
9-
- ["gocb2", "github.com/couchbase/gocb/v2"]
10-
- ["gocb2", "gopkg.in/couchbase/gocb.v2"]
11-
- ["gocb2", "github.com/couchbaselabs/gocb/v2"]
12-
- addsTo:
13-
pack: codeql/go-all
14-
extensible: sinkModel
15-
data:
16-
- ["group:gocb1", "Bucket", True, "ExecuteN1qlQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
17-
- ["group:gocb1", "Bucket", True, "ExecuteAnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
18-
- ["group:gocb1", "Cluster", True, "ExecuteN1qlQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
19-
- ["group:gocb1", "Cluster", True, "ExecuteAnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
20-
- ["group:gocb2", "Cluster", True, "AnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
21-
- ["group:gocb2", "Cluster", True, "Query", "", "", "Argument[0]", "nosql-injection", "manual"]
22-
- ["group:gocb2", "Scope", True, "AnalyticsQuery", "", "", "Argument[0]", "nosql-injection", "manual"]
23-
- ["group:gocb2", "Scope", True, "Query", "", "", "Argument[0]", "nosql-injection", "manual"]
6+
- ["gocb", "github.com/couchbase/gocb"]
7+
- ["gocb", "gopkg.in/couchbase/gocb"]
8+
- ["gocb", "github.com/couchbaselabs/gocb"]
249
- addsTo:
2510
pack: codeql/go-all
2611
extensible: summaryModel
2712
data:
28-
- ["group:gocb1", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
29-
- ["group:gocb1", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
30-
- ["group:gocb1", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
31-
- ["group:gocb1", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
32-
- ["group:gocb1", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
33-
- ["group:gocb1", "AnalyticsQuery", True, "Priority", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
34-
- ["group:gocb1", "AnalyticsQuery", True, "RawParam", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
35-
- ["group:gocb1", "AnalyticsQuery", True, "ServerSideTimeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
36-
- ["group:gocb1", "N1qlQuery", True, "AdHoc", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
37-
- ["group:gocb1", "N1qlQuery", True, "Consistency", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
38-
- ["group:gocb1", "N1qlQuery", True, "ConsistentWith", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
39-
- ["group:gocb1", "N1qlQuery", True, "Custom", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
40-
- ["group:gocb1", "N1qlQuery", True, "PipelineBatch", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
41-
- ["group:gocb1", "N1qlQuery", True, "PipelineCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
42-
- ["group:gocb1", "N1qlQuery", True, "Profile", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
43-
- ["group:gocb1", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
44-
- ["group:gocb1", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
45-
- ["group:gocb1", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
13+
- ["group:gocb", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
14+
- ["group:gocb", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
15+
- ["group:gocb", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
16+
- ["group:gocb", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
17+
- ["group:gocb", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
18+
- ["group:gocb", "AnalyticsQuery", True, "Priority", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
19+
- ["group:gocb", "AnalyticsQuery", True, "RawParam", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
20+
- ["group:gocb", "AnalyticsQuery", True, "ServerSideTimeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
21+
- ["group:gocb", "N1qlQuery", True, "AdHoc", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
22+
- ["group:gocb", "N1qlQuery", True, "Consistency", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
23+
- ["group:gocb", "N1qlQuery", True, "ConsistentWith", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
24+
- ["group:gocb", "N1qlQuery", True, "Custom", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
25+
- ["group:gocb", "N1qlQuery", True, "PipelineBatch", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
26+
- ["group:gocb", "N1qlQuery", True, "PipelineCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
27+
- ["group:gocb", "N1qlQuery", True, "Profile", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
28+
- ["group:gocb", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
29+
- ["group:gocb", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
30+
- ["group:gocb", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]

‎go/ql/lib/ext/github.com.davecgh.go-spew.spew.model.yml

Lines changed: 0 additions & 14 deletions
This file was deleted.

0 commit comments

Comments
 (0)