|
13 | 13 |
|
14 | 14 | import go |
15 | 15 | import semmle.go.dataflow.Properties |
16 | | -import semmle.go.security.FlowSources |
17 | | -import CmdLineFlowSource |
18 | 16 | import MultipartAndFormRemoteSource |
19 | 17 |
|
20 | | -module DecompressionBombs implements DataFlow::StateConfigSig { |
| 18 | +module DecompressionBombsConfig implements DataFlow::StateConfigSig { |
21 | 19 | class FlowState = DataFlow::FlowState; |
22 | 20 |
|
23 | 21 | predicate isSource(DataFlow::Node source, FlowState state) { |
24 | | - ( |
| 22 | + |
25 | 23 | source instanceof UntrustedFlowSource |
26 | | - or |
27 | | - source instanceof CmdLineFlowSource |
28 | | - ) and |
| 24 | + and |
29 | 25 | state = "" |
30 | 26 | } |
31 | 27 |
|
@@ -167,7 +163,7 @@ module DecompressionBombs implements DataFlow::StateConfigSig { |
167 | 163 | or |
168 | 164 | exists(DataFlow::Function f, DataFlow::CallNode call | |
169 | 165 | ( |
170 | | - f.hasQualifiedName(["github.com/dsnet/compress/flate"], "NewReader") or |
| 166 | + f.hasQualifiedName("github.com/dsnet/compress/flate", "NewReader") or |
171 | 167 | f.hasQualifiedName(["compress/flate", "github.com/klauspost/compress/flate"], |
172 | 168 | ["NewReaderDict", "NewReader"]) |
173 | 169 | ) and |
@@ -253,7 +249,7 @@ module DecompressionBombs implements DataFlow::StateConfigSig { |
253 | 249 | // } |
254 | 250 | // override predicate isSink(DataFlow::Node sink) { sink instanceof DataFlow::Node } |
255 | 251 | // } |
256 | | -module DecompressionBombsFlow = TaintTracking::GlobalWithState<DecompressionBombs>; |
| 252 | +module DecompressionBombsFlow = TaintTracking::GlobalWithState<DecompressionBombsConfig>; |
257 | 253 |
|
258 | 254 | import DecompressionBombsFlow::PathGraph |
259 | 255 |
|
|
0 commit comments