Skip to content

Commit 1ff1c5c

Browse files
am0o0am0o0
committed
fix two bugs, make package path more neat
1 parent 345fdf1 commit 1ff1c5c

1 file changed

Lines changed: 77 additions & 76 deletions

File tree

‎go/ql/lib/semmle/go/frameworks/Fasthttp.qll‎

Lines changed: 77 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/**
2-
* Provides classes for working with the [fasthttp](github.com/valyala/fasthttp) package.
2+
* Provides classes for working with untrusted flow sources, sinks and taint propagators
3+
* from the `github.com/valyala/fasthttp` package.
34
*/
45

56
import go
@@ -9,6 +10,12 @@ private import semmle.go.security.RequestForgeryCustomizations
910
* Provides classes for working with the [fasthttp](github.com/valyala/fasthttp) package.
1011
*/
1112
module Fasthttp {
13+
/** Gets the v1 module path `github.com/valyala/fasthttp`. */
14+
string v1modulePath() { result = "github.com/valyala/fasthttp" }
15+
16+
/** Gets the path for the root package of fasthttp. */
17+
string packagePath() { result = package(v1modulePath(), "") }
18+
1219
/**
1320
* A class when you are using Fasthttp related queries to fully supports additional steps
1421
*/
@@ -29,8 +36,8 @@ module Fasthttp {
2936
*/
3037
class FileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
3138
FileSystemAccess() {
32-
exists(DataFlow::Function f |
33-
f.hasQualifiedName("github.com/valyala/fasthttp",
39+
exists(Function f |
40+
f.hasQualifiedName(packagePath(),
3441
[
3542
"ServeFile", "ServeFileUncompressed", "ServeFileBytes", "ServeFileBytesUncompressed",
3643
"SaveMultipartFile"
@@ -49,7 +56,7 @@ module Fasthttp {
4956
HtmlQuoteSanitizer() {
5057
exists(DataFlow::CallNode c |
5158
c.getTarget()
52-
.hasQualifiedName("github.com/valyala/fasthttp",
59+
.hasQualifiedName(packagePath(),
5360
["AppendHTMLEscape", "AppendHTMLEscapeBytes", "AppendQuotedArg"])
5461
|
5562
this = c.getArgument(1)
@@ -65,9 +72,8 @@ module Fasthttp {
6572
*/
6673
class RequestForgerySink extends RequestForgery::Sink {
6774
RequestForgerySink() {
68-
exists(DataFlow::Function f |
69-
f.hasQualifiedName("github.com/valyala/fasthttp",
70-
["Get", "GetDeadline", "GetTimeout", "Post"]) and
75+
exists(Function f |
76+
f.hasQualifiedName(packagePath(), ["Get", "GetDeadline", "GetTimeout", "Post"]) and
7177
this = f.getACall().getArgument(1)
7278
)
7379
}
@@ -84,9 +90,8 @@ module Fasthttp {
8490
*/
8591
class RequestForgerySinkDo extends RequestForgery::Sink {
8692
RequestForgerySinkDo() {
87-
exists(DataFlow::Function f |
88-
f.hasQualifiedName("github.com/valyala/fasthttp",
89-
["Do", "DoDeadline", "DoTimeout", "DoRedirects"]) and
93+
exists(Function f |
94+
f.hasQualifiedName(packagePath(), ["Do", "DoDeadline", "DoTimeout", "DoRedirects"]) and
9095
this = f.getACall().getArgument(0)
9196
)
9297
}
@@ -102,8 +107,8 @@ module Fasthttp {
102107
*/
103108
class RequestForgerySinkDial extends RequestForgery::Sink {
104109
RequestForgerySinkDial() {
105-
exists(DataFlow::Function f |
106-
f.hasQualifiedName("github.com/valyala/fasthttp",
110+
exists(Function f |
111+
f.hasQualifiedName(packagePath(),
107112
["DialDualStack", "Dial", "DialTimeout", "DialDualStackTimeout"]) and
108113
this = f.getACall().getArgument(0)
109114
)
@@ -132,11 +137,11 @@ module Fasthttp {
132137
exists(DataFlow::MethodCallNode m, DataFlow::Variable frn |
133138
(
134139
m.getTarget()
135-
.hasQualifiedName("github.com/valyala/fasthttp.URI",
140+
.hasQualifiedName(packagePath(), "URI",
136141
["SetHost", "SetHostBytes", "Update", "UpdateBytes"]) and
137142
pred = m.getArgument(0)
138143
or
139-
m.getTarget().hasQualifiedName("github.com/valyala/fasthttp.URI", "Parse") and
144+
m.getTarget().hasQualifiedName(packagePath(), "URI", "Parse") and
140145
pred = m.getArgument([0, 1])
141146
) and
142147
frn.getARead() = m.getReceiver() and
@@ -145,7 +150,7 @@ module Fasthttp {
145150
or
146151
// CopyTo method copy receiver to first argument
147152
exists(DataFlow::MethodCallNode m |
148-
m.getTarget().hasQualifiedName("github.com/valyala/fasthttp.URI", "CopyTo") and
153+
m.getTarget().hasQualifiedName(packagePath(), "URI", "CopyTo") and
149154
pred = m.getReceiver() and
150155
succ = m.getArgument(1)
151156
)
@@ -157,12 +162,12 @@ module Fasthttp {
157162
*/
158163
class UntrustedFlowSource extends UntrustedFlowSource::Range instanceof DataFlow::Node {
159164
UntrustedFlowSource() {
160-
exists(DataFlow::Method m |
161-
m.hasQualifiedName("github.com/valyala/fasthttp.URI",
165+
exists(Method m |
166+
m.hasQualifiedName(packagePath(), "URI",
162167
["Path", "PathOriginal", "LastPathSegment", "FullURI", "QueryString", "String"]) and
163168
this = m.getACall()
164169
or
165-
m.hasQualifiedName("github.com/valyala/fasthttp.URI", "WriteTo") and
170+
m.hasQualifiedName(packagePath(), "URI", "WriteTo") and
166171
this = m.getACall().getArgument(0)
167172
)
168173
}
@@ -178,12 +183,12 @@ module Fasthttp {
178183
*/
179184
class UntrustedFlowSource extends UntrustedFlowSource::Range instanceof DataFlow::Node {
180185
UntrustedFlowSource() {
181-
exists(DataFlow::Method m |
182-
m.hasQualifiedName("github.com/valyala/fasthttp.Args",
186+
exists(Method m |
187+
m.hasQualifiedName(packagePath(), "Args",
183188
["Peek", "PeekBytes", "PeekMulti", "PeekMultiBytes", "QueryString", "String"]) and
184189
this = m.getACall()
185190
or
186-
m.hasQualifiedName("github.com/valyala/fasthttp.Args", "WriteTo") and
191+
m.hasQualifiedName(packagePath(), "Args", "WriteTo") and
187192
this = m.getACall().getArgument(0)
188193
)
189194
}
@@ -201,8 +206,8 @@ module Fasthttp {
201206
*/
202207
class RequestForgerySinkDial extends RequestForgery::Sink {
203208
RequestForgerySinkDial() {
204-
exists(DataFlow::Method m |
205-
m.hasQualifiedName("github.com/valyala/fasthttp.TCPDialer",
209+
exists(Method m |
210+
m.hasQualifiedName(packagePath(), "TCPDialer",
206211
["Dial", "DialTimeout", "DialDualStack", "DialDualStackTimeout"]) and
207212
this = m.getACall().getArgument(0)
208213
)
@@ -226,9 +231,8 @@ module Fasthttp {
226231
*/
227232
class RequestForgerySink extends RequestForgery::Sink {
228233
RequestForgerySink() {
229-
exists(DataFlow::Method m |
230-
m.hasQualifiedName("github.com/valyala/fasthttp.Client",
231-
["Get", "GetDeadline", "GetTimeout", "Post"]) and
234+
exists(Method m |
235+
m.hasQualifiedName(packagePath(), "Client", ["Get", "GetDeadline", "GetTimeout", "Post"]) and
232236
this = m.getACall().getArgument(0)
233237
)
234238
}
@@ -245,8 +249,8 @@ module Fasthttp {
245249
*/
246250
class RequestForgerySinkDo extends RequestForgery::Sink {
247251
RequestForgerySinkDo() {
248-
exists(DataFlow::Method m |
249-
m.hasQualifiedName("github.com/valyala/fasthttp.Client",
252+
exists(Method m |
253+
m.hasQualifiedName(packagePath(), "Client",
250254
["Do", "DoDeadline", "DoTimeout", "DoRedirects"]) and
251255
this = m.getACall().getArgument(0)
252256
)
@@ -270,9 +274,8 @@ module Fasthttp {
270274
*/
271275
class RequestForgerySinkDo extends RequestForgery::Sink {
272276
RequestForgerySinkDo() {
273-
exists(DataFlow::Method m |
274-
m.hasQualifiedName("github.com/valyala/fasthttp.PipelineClient",
275-
["Do", "DoDeadline", "DoTimeout"]) and
277+
exists(Method m |
278+
m.hasQualifiedName(packagePath(), "PipelineClient", ["Do", "DoDeadline", "DoTimeout"]) and
276279
this = m.getACall().getArgument(0)
277280
)
278281
}
@@ -296,8 +299,8 @@ module Fasthttp {
296299
*/
297300
class RequestForgerySink extends RequestForgery::Sink {
298301
RequestForgerySink() {
299-
exists(DataFlow::Method m |
300-
m.hasQualifiedName("github.com/valyala/fasthttp.HostClient",
302+
exists(Method m |
303+
m.hasQualifiedName(packagePath(), "HostClient",
301304
["Get", "GetDeadline", "GetTimeout", "Post"]) and
302305
this = m.getACall().getArgument(1)
303306
)
@@ -315,8 +318,8 @@ module Fasthttp {
315318
*/
316319
class RequestForgerySinkDo extends RequestForgery::Sink {
317320
RequestForgerySinkDo() {
318-
exists(DataFlow::Method m |
319-
m.hasQualifiedName("github.com/valyala/fasthttp.HostClient",
321+
exists(Method m |
322+
m.hasQualifiedName(packagePath(), "HostClient",
320323
["Do", "DoDeadline", "DoTimeout", "DoRedirects"]) and
321324
this = m.getACall().getArgument(0)
322325
)
@@ -340,9 +343,8 @@ module Fasthttp {
340343
*/
341344
class RequestForgerySinkDo extends RequestForgery::Sink {
342345
RequestForgerySinkDo() {
343-
exists(DataFlow::Method m |
344-
m.hasQualifiedName("github.com/valyala/fasthttp.LBClient",
345-
["Do", "DoDeadline", "DoTimeout"]) and
346+
exists(Method m |
347+
m.hasQualifiedName(packagePath(), "LBClient", ["Do", "DoDeadline", "DoTimeout"]) and
346348
this = m.getACall().getArgument(0)
347349
)
348350
}
@@ -370,7 +372,7 @@ module Fasthttp {
370372
override predicate hasTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
371373
exists(DataFlow::MethodCallNode m, DataFlow::Variable frn |
372374
m.getTarget()
373-
.hasQualifiedName("github.com/valyala/fasthttp.Request",
375+
.hasQualifiedName(packagePath(), "Request",
374376
["SetRequestURI", "SetRequestURIBytes", "SetURI", "SetHost", "SetHostBytes"]) and
375377
pred = m.getArgument(0) and
376378
frn.getARead() = m.getReceiver() and
@@ -388,8 +390,8 @@ module Fasthttp {
388390
*/
389391
class FileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
390392
FileSystemAccess() {
391-
exists(DataFlow::Method mcn |
392-
mcn.hasQualifiedName("github.com/valyala/fasthttp.Response", "SendFile") and
393+
exists(Method mcn |
394+
mcn.hasQualifiedName(packagePath(), "Response", "SendFile") and
393395
this = mcn.getACall()
394396
)
395397
}
@@ -403,8 +405,8 @@ module Fasthttp {
403405
*/
404406
class HttpResponseBodySink extends SharedXss::Sink {
405407
HttpResponseBodySink() {
406-
exists(DataFlow::Method m |
407-
m.hasQualifiedName("github.com/valyala/fasthttp", "Response",
408+
exists(Method m |
409+
m.hasQualifiedName(packagePath(), "Response",
408410
[
409411
"AppendBody", "AppendBodyString", "SetBody", "SetBodyString", "SetBodyRaw",
410412
"SetBodyStream"
@@ -420,15 +422,15 @@ module Fasthttp {
420422
*/
421423
class UntrustedFlowSource extends UntrustedFlowSource::Range instanceof DataFlow::Node {
422424
UntrustedFlowSource() {
423-
exists(DataFlow::Method m |
424-
m.hasQualifiedName("github.com/valyala/fasthttp.Request",
425+
exists(Method m |
426+
m.hasQualifiedName(packagePath(), "Request",
425427
[
426428
"Host", "RequestURI", "Body", "BodyGunzip", "BodyInflate", "BodyUnbrotli",
427429
"BodyStream", "BodyUncompressed"
428430
]) and
429431
this = m.getACall()
430432
or
431-
m.hasQualifiedName("github.com/valyala/fasthttp.Request",
433+
m.hasQualifiedName(packagePath(), "Request",
432434
[
433435
"BodyWriteTo", "WriteTo", "ReadBody", "ReadLimitBody", "ContinueReadBodyStream",
434436
"ContinueReadBody"
@@ -448,9 +450,8 @@ module Fasthttp {
448450
*/
449451
class FileSystemAccess extends FileSystemAccess::Range, DataFlow::CallNode {
450452
FileSystemAccess() {
451-
exists(DataFlow::Method mcn |
452-
mcn.hasQualifiedName("github.com/valyala/fasthttp.RequestCtx",
453-
["SendFileBytes", "SendFile"]) and
453+
exists(Method mcn |
454+
mcn.hasQualifiedName(packagePath(), "RequestCtx", ["SendFileBytes", "SendFile"]) and
454455
this = mcn.getACall()
455456
)
456457
}
@@ -466,9 +467,9 @@ module Fasthttp {
466467
*/
467468
class Redirect extends Http::Redirect::Range, DataFlow::CallNode {
468469
Redirect() {
469-
exists(DataFlow::Function f |
470-
f.hasQualifiedName("github.com/valyala/fasthttp.RequestCtx", ["Redirect", "RedirectBytes"]) and
471-
this = f.getACall()
470+
exists(Method m |
471+
m.hasQualifiedName(packagePath(), "RequestCtx", ["Redirect", "RedirectBytes"]) and
472+
this = m.getACall()
472473
)
473474
}
474475

@@ -482,8 +483,8 @@ module Fasthttp {
482483
*/
483484
class UntrustedFlowSource extends UntrustedFlowSource::Range instanceof DataFlow::Node {
484485
UntrustedFlowSource() {
485-
exists(DataFlow::Method m |
486-
m.hasQualifiedName("github.com/valyala/fasthttp.RequestCtx",
486+
exists(Method m |
487+
m.hasQualifiedName(packagePath(), "RequestCtx",
487488
["Path", "Referer", "PostBody", "RequestBodyStream", "RequestURI", "UserAgent", "Host"]) and
488489
this = m.getACall()
489490
)
@@ -496,36 +497,36 @@ module Fasthttp {
496497
*/
497498
class HttpResponseBodySink extends SharedXss::Sink {
498499
HttpResponseBodySink() {
499-
exists(DataFlow::Method m |
500-
m.hasQualifiedName("github.com/valyala/fasthttp.RequestCtx", ["Success", "SuccessString"]) and
500+
exists(Method m |
501+
m.hasQualifiedName(packagePath(), "RequestCtx", ["Success", "SuccessString"]) and
501502
this = m.getACall().getArgument(1)
502503
)
503504
}
504505
}
505506
}
506-
}
507507

508-
/**
509-
* Provide Methods of fasthttp.RequestHeader which mostly used as remote user controlled sources
510-
*/
511-
module RequestHeader {
512508
/**
513-
* The methods as Remote user controllable source which are mostly related to HTTP Request Headers
509+
* Provide Methods of fasthttp.RequestHeader which mostly used as remote user controlled sources
514510
*/
515-
class UntrustedFlowSource extends UntrustedFlowSource::Range instanceof DataFlow::Node {
516-
UntrustedFlowSource() {
517-
exists(DataFlow::Method m |
518-
m.hasQualifiedName("github.com/valyala/fasthttp.RequestHeader",
519-
[
520-
"Header", "TrailerHeader", "RequestURI", "Host", "UserAgent", "ContentEncoding",
521-
"ContentType", "Cookie", "CookieBytes", "MultipartFormBoundary", "Peek", "PeekAll",
522-
"PeekBytes", "PeekKeys", "PeekTrailerKeys", "Referer", "RawHeaders"
523-
]) and
524-
this = m.getACall()
525-
or
526-
m.hasQualifiedName("github.com/valyala/fasthttp.RequestHeader", "Write") and
527-
this = m.getACall().getArgument(0)
528-
)
511+
module RequestHeader {
512+
/**
513+
* The methods as Remote user controllable source which are mostly related to HTTP Request Headers
514+
*/
515+
class UntrustedFlowSource extends UntrustedFlowSource::Range instanceof DataFlow::Node {
516+
UntrustedFlowSource() {
517+
exists(Method m |
518+
m.hasQualifiedName(packagePath(), "RequestHeader",
519+
[
520+
"Header", "TrailerHeader", "RequestURI", "Host", "UserAgent", "ContentEncoding",
521+
"ContentType", "Cookie", "CookieBytes", "MultipartFormBoundary", "Peek", "PeekAll",
522+
"PeekBytes", "PeekKeys", "PeekTrailerKeys", "Referer", "RawHeaders"
523+
]) and
524+
this = m.getACall()
525+
or
526+
m.hasQualifiedName(packagePath(), "RequestHeader", "Write") and
527+
this = m.getACall().getArgument(0)
528+
)
529+
}
529530
}
530531
}
531532
}

0 commit comments

Comments
 (0)