Skip to content

Commit 7bc07d9

Browse files
am0o0am0o0
committed
add additional taint steps inline tests
1 parent 3bc24c3 commit 7bc07d9

3 files changed

Lines changed: 68 additions & 84 deletions

File tree

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/AdditionalTaintSteps.ql‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,43 @@ import go
22
import TestUtilities.InlineExpectationsTest
33

44
module FasthttpTest implements TestSig {
5-
string getARelevantTag() { result = ["URI", "req"] }
5+
string getARelevantTag() { result = ["UriSucc","UriPred", "ReqSucc", "ReqPred"] }
66

77
predicate hasActualResult(Location location, string element, string tag, string value) {
8-
exists(Fasthttp::Request::RequestAdditionalStep q, DataFlow::Node succ |
9-
q.hasTaintStep(_, succ)
8+
exists(Fasthttp::Request::RequestAdditionalStep q, DataFlow::Node succ, DataFlow::Node pred |
9+
q.hasTaintStep(pred, succ)
1010
|
11-
succ.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
12-
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
13-
element = succ.toString() and
14-
value = succ.toString() and
15-
tag = "req"
11+
(
12+
pred.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
13+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
14+
element = pred.toString() and
15+
value = pred.toString() and
16+
tag = "ReqPred"
17+
or
18+
succ.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
19+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
20+
element = succ.toString() and
21+
value = succ.toString() and
22+
tag = "ReqSucc"
23+
)
1624
)
1725
or
18-
exists(Fasthttp::URI::UriAdditionalStep q, DataFlow::Node succ | q.hasTaintStep(_, succ) |
19-
succ.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
20-
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
21-
element = succ.toString() and
22-
value = succ.toString() and
23-
tag = "URI"
26+
exists(Fasthttp::URI::UriAdditionalStep q, DataFlow::Node succ, DataFlow::Node pred |
27+
q.hasTaintStep(pred, succ)
28+
|
29+
(
30+
pred.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
31+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
32+
element = pred.toString() and
33+
value = pred.toString() and
34+
tag = "UriPred"
35+
or
36+
succ.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
37+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
38+
element = succ.toString() and
39+
value = succ.toString() and
40+
tag = "UriSucc"
41+
)
2442
)
2543
}
2644
}

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/SSRF.expected‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/fasthttp.go‎

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ import (
1010
)
1111

1212
func fasthttpClient() {
13+
userInput := "user Controlled input"
14+
userInputByte := []byte("user Controlled input")
1315
// #SSRF
1416
response, _ := fasthttp.DialDualStack("127.0.0.1:8909")
1517
response, _ = fasthttp.Dial("google.com:80")
@@ -18,31 +20,33 @@ func fasthttpClient() {
1820
resByte := make([]byte, 1000)
1921
_, _ = response.Read(resByte)
2022

21-
// #SSRF
2223
res := &fasthttp.Response{}
2324
req := &fasthttp.Request{}
25+
req.SetHost(userInput) // $ ReqSucc=req ReqPred=userInput
26+
req.SetHostBytes(userInputByte) // $ ReqSucc=req ReqPred=userInputByte
27+
req.SetRequestURI(userInput) // $ ReqSucc=req ReqPred=userInput
28+
req.SetRequestURIBytes(userInputByte) // $ ReqSucc=req ReqPred=userInputByte
29+
2430
uri := fasthttp.AcquireURI()
31+
userInput = "UserControlled.com:80"
32+
userInputByte = []byte("UserControlled.com:80")
33+
uri.SetHost(userInput) // $ UriPred=userInput UriSucc=uri
34+
uri.SetHostBytes(userInputByte) // $ UriPred=userInputByte UriSucc=uri
35+
userInput = "http://UserControlled.com"
36+
userInputByte = []byte("http://UserControlled.com")
37+
uri.Update(userInput) // $ UriPred=userInput UriSucc=uri
38+
uri.UpdateBytes(userInputByte) // $ UriPred=userInputByte UriSucc=uri
39+
uri.Parse(userInputByte, userInputByte) // $ UriPred=userInputByte UriPred=userInputByte UriSucc=uri
40+
req.SetURI(uri) // $ ReqSucc=req ReqPred=uri UriSucc=uri
41+
2542
fasthttp.Get(resByte, "http://127.0.0.1:8909") // $ SSRF="http://127.0.0.1:8909"
2643
fasthttp.GetDeadline(resByte, "http://127.0.0.1:8909", time.Time{}) // $ SSRF="http://127.0.0.1:8909"
2744
fasthttp.GetTimeout(resByte, "http://127.0.0.1:8909", 5) // $ SSRF="http://127.0.0.1:8909"
2845
fasthttp.Post(resByte, "http://127.0.0.1:8909", nil) // $ SSRF="http://127.0.0.1:8909"
29-
fasthttp.Do(req, res) // $ req=req
30-
fasthttp.DoRedirects(req, res, 2) // $ req=req
31-
fasthttp.DoDeadline(req, res, time.Time{}) // $ req=req
32-
fasthttp.DoTimeout(req, res, 5) // $ req=req
33-
34-
// additional steps
35-
uri.SetHost("UserControlled.com:80") // $ URI=uri
36-
uri.SetHostBytes([]byte("UserControlled.com:80")) // $ URI=uri
37-
uri.Update("http://httpbin.org/ip") // $ URI=uri
38-
uri.UpdateBytes([]byte("http://httpbin.org/ip")) // $ URI=uri
39-
uri.Parse(nil, []byte("http://httpbin.org/ip")) // $ URI=uri
40-
41-
req.SetHost("UserControlled.com:80") // $ req=req
42-
req.SetHostBytes([]byte("UserControlled.com:80")) // $ req=req
43-
req.SetRequestURI("https://UserControlled.com") // $ req=req
44-
req.SetRequestURIBytes([]byte("https://UserControlled.com")) // $ req=req
45-
req.SetURI(uri) // $ req=req URI=uri
46+
fasthttp.Do(req, res) // $ ReqSucc=req
47+
fasthttp.DoRedirects(req, res, 2) // $ ReqSucc=req
48+
fasthttp.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req
49+
fasthttp.DoTimeout(req, res, 5) // $ ReqSucc=req
4650

4751
hostClient := &fasthttp.HostClient{
4852
Addr: "localhost:8080",
@@ -51,31 +55,31 @@ func fasthttpClient() {
5155
hostClient.GetDeadline(resByte, "http://127.0.0.1:8909", time.Time{}) // $ SSRF="http://127.0.0.1:8909"
5256
hostClient.GetTimeout(resByte, "http://127.0.0.1:8909", 5) // $ SSRF="http://127.0.0.1:8909"
5357
hostClient.Post(resByte, "http://127.0.0.1:8909", nil) // $ SSRF="http://127.0.0.1:8909"
54-
hostClient.Do(req, res) // $ req=req
55-
hostClient.DoDeadline(req, res, time.Time{}) // $ req=req
56-
hostClient.DoRedirects(req, res, 2) // $ req=req
57-
hostClient.DoTimeout(req, res, 5) // $ req=req
58+
hostClient.Do(req, res) // $ ReqSucc=req
59+
hostClient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req
60+
hostClient.DoRedirects(req, res, 2) // $ ReqSucc=req
61+
hostClient.DoTimeout(req, res, 5) // $ ReqSucc=req
5862

5963
var lbclient fasthttp.LBClient
6064
lbclient.Clients = append(lbclient.Clients, hostClient)
61-
lbclient.Do(req, res) // $ req=req
62-
lbclient.DoDeadline(req, res, time.Time{}) // $ req=req
63-
lbclient.DoTimeout(req, res, 5) // $ req=req
65+
lbclient.Do(req, res) // $ ReqSucc=req
66+
lbclient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req
67+
lbclient.DoTimeout(req, res, 5) // $ ReqSucc=req
6468

6569
client := fasthttp.Client{}
6670
client.Get(resByte, "http://127.0.0.1:8909") // $ SSRF="http://127.0.0.1:8909"
6771
client.GetDeadline(resByte, "http://127.0.0.1:8909", time.Time{}) // $ SSRF="http://127.0.0.1:8909"
6872
client.GetTimeout(resByte, "http://127.0.0.1:8909", 5) // $ SSRF="http://127.0.0.1:8909"
6973
client.Post(resByte, "http://127.0.0.1:8909", nil) // $ SSRF="http://127.0.0.1:8909"
70-
client.Do(req, res) // $ req=req SSRF=req
71-
client.DoDeadline(req, res, time.Time{}) // $ req=req SSRF=req
72-
client.DoRedirects(req, res, 2) // $ req=req SSRF=req
73-
client.DoTimeout(req, res, 5) // $ req=req SSRF=req
74+
client.Do(req, res) // $ ReqSucc=req SSRF=req
75+
client.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SSRF=req
76+
client.DoRedirects(req, res, 2) // $ ReqSucc=req SSRF=req
77+
client.DoTimeout(req, res, 5) // $ ReqSucc=req SSRF=req
7478

7579
pipelineClient := fasthttp.PipelineClient{}
76-
pipelineClient.Do(req, res) // $ req=req SSRF=req
77-
pipelineClient.DoDeadline(req, res, time.Time{}) // $ req=req SSRF=req
78-
pipelineClient.DoTimeout(req, res, 5) // $ req=req SSRF=req
80+
pipelineClient.Do(req, res) // $ ReqSucc=req SSRF=req
81+
pipelineClient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SSRF=req
82+
pipelineClient.DoTimeout(req, res, 5) // $ ReqSucc=req SSRF=req
7983

8084
tcpDialer := fasthttp.TCPDialer{}
8185
tcpDialer.Dial("127.0.0.1:8909") // $ SSRF="127.0.0.1:8909"

0 commit comments

Comments
 (0)