Skip to content

Commit e38cb0f

Browse files
am0o0am0o0
committed
fix a issue in fasthttp library, add SSRF inline queires
1 parent 7bc07d9 commit e38cb0f

4 files changed

Lines changed: 62 additions & 44 deletions

File tree

‎go/ql/lib/semmle/go/frameworks/Fasthttp.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ module Fasthttp {
220220
RequestForgerySink() {
221221
exists(Method m |
222222
m.hasQualifiedName(packagePath(), "Client", ["Get", "GetDeadline", "GetTimeout", "Post"]) and
223-
this = m.getACall().getArgument(0)
223+
this = m.getACall().getArgument(1)
224224
)
225225
}
226226

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/SSRF.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
testFailures
2+
failures

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/SSRF.ql‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,20 @@
11
import go
22
import semmle.go.security.RequestForgery
3+
import TestUtilities.InlineExpectationsTest
34

4-
select any(RequestForgery::Sink s)
5+
module FasthttpTest implements TestSig {
6+
string getARelevantTag() { result = "SsrfSink" }
7+
8+
predicate hasActualResult(Location location, string element, string tag, string value) {
9+
exists(RequestForgery::Sink ssrfSink |
10+
ssrfSink
11+
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
12+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
13+
element = ssrfSink.toString() and
14+
value = ssrfSink.toString() and
15+
tag = "SsrfSink"
16+
)
17+
}
18+
}
19+
20+
import MakeTest<FasthttpTest>

‎go/ql/test/library-tests/semmle/go/frameworks/Fasthttp/fasthttp.go‎

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,12 @@ import (
1010
)
1111

1212
func fasthttpClient() {
13-
userInput := "user Controlled input"
13+
userInput := "127.0.0.1:8909"
1414
userInputByte := []byte("user Controlled input")
15-
// #SSRF
16-
response, _ := fasthttp.DialDualStack("127.0.0.1:8909")
17-
response, _ = fasthttp.Dial("google.com:80")
18-
response, _ = fasthttp.DialTimeout("google.com:80", 5)
19-
response, _ = fasthttp.DialDualStackTimeout("google.com:80", 5)
20-
resByte := make([]byte, 1000)
21-
_, _ = response.Read(resByte)
15+
fasthttp.DialDualStack(userInput) // $ SsrfSink=userInput
16+
fasthttp.Dial(userInput) // $ SsrfSink=userInput
17+
fasthttp.DialTimeout(userInput, 5) // $ SsrfSink=userInput
18+
fasthttp.DialDualStackTimeout(userInput, 5) // $ SsrfSink=userInput
2219

2320
res := &fasthttp.Response{}
2421
req := &fasthttp.Request{}
@@ -39,53 +36,56 @@ func fasthttpClient() {
3936
uri.Parse(userInputByte, userInputByte) // $ UriPred=userInputByte UriPred=userInputByte UriSucc=uri
4037
req.SetURI(uri) // $ ReqSucc=req ReqPred=uri UriSucc=uri
4138

42-
fasthttp.Get(resByte, "http://127.0.0.1:8909") // $ SSRF="http://127.0.0.1:8909"
43-
fasthttp.GetDeadline(resByte, "http://127.0.0.1:8909", time.Time{}) // $ SSRF="http://127.0.0.1:8909"
44-
fasthttp.GetTimeout(resByte, "http://127.0.0.1:8909", 5) // $ SSRF="http://127.0.0.1:8909"
45-
fasthttp.Post(resByte, "http://127.0.0.1:8909", nil) // $ SSRF="http://127.0.0.1:8909"
46-
fasthttp.Do(req, res) // $ ReqSucc=req
47-
fasthttp.DoRedirects(req, res, 2) // $ ReqSucc=req
48-
fasthttp.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req
49-
fasthttp.DoTimeout(req, res, 5) // $ ReqSucc=req
39+
resByte := make([]byte, 1000)
40+
userInput = "http://127.0.0.1:8909"
41+
fasthttp.Get(resByte, userInput) // $ SsrfSink=userInput
42+
fasthttp.GetDeadline(resByte, userInput, time.Time{}) // $ SsrfSink=userInput
43+
fasthttp.GetTimeout(resByte, userInput, 5) // $ SsrfSink=userInput
44+
fasthttp.Post(resByte, userInput, nil) // $ SsrfSink=userInput
45+
fasthttp.Do(req, res) // $ ReqSucc=req SsrfSink=req
46+
fasthttp.DoRedirects(req, res, 2) // $ ReqSucc=req SsrfSink=req
47+
fasthttp.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SsrfSink=req
48+
fasthttp.DoTimeout(req, res, 5) // $ ReqSucc=req SsrfSink=req
5049

5150
hostClient := &fasthttp.HostClient{
5251
Addr: "localhost:8080",
5352
}
54-
hostClient.Get(resByte, "http://127.0.0.1:8909") // $ SSRF="http://127.0.0.1:8909"
55-
hostClient.GetDeadline(resByte, "http://127.0.0.1:8909", time.Time{}) // $ SSRF="http://127.0.0.1:8909"
56-
hostClient.GetTimeout(resByte, "http://127.0.0.1:8909", 5) // $ SSRF="http://127.0.0.1:8909"
57-
hostClient.Post(resByte, "http://127.0.0.1:8909", nil) // $ SSRF="http://127.0.0.1:8909"
58-
hostClient.Do(req, res) // $ ReqSucc=req
59-
hostClient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req
60-
hostClient.DoRedirects(req, res, 2) // $ ReqSucc=req
61-
hostClient.DoTimeout(req, res, 5) // $ ReqSucc=req
53+
hostClient.Get(resByte, userInput) // $ SsrfSink=userInput
54+
hostClient.GetDeadline(resByte, userInput, time.Time{}) // $ SsrfSink=userInput
55+
hostClient.GetTimeout(resByte, userInput, 5) // $ SsrfSink=userInput
56+
hostClient.Post(resByte, userInput, nil) // $ SsrfSink=userInput
57+
hostClient.Do(req, res) // $ ReqSucc=req SsrfSink=req
58+
hostClient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SsrfSink=req
59+
hostClient.DoRedirects(req, res, 2) // $ ReqSucc=req SsrfSink=req
60+
hostClient.DoTimeout(req, res, 5) // $ ReqSucc=req SsrfSink=req
6261

6362
var lbclient fasthttp.LBClient
6463
lbclient.Clients = append(lbclient.Clients, hostClient)
65-
lbclient.Do(req, res) // $ ReqSucc=req
66-
lbclient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req
67-
lbclient.DoTimeout(req, res, 5) // $ ReqSucc=req
64+
lbclient.Do(req, res) // $ ReqSucc=req SsrfSink=req
65+
lbclient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SsrfSink=req
66+
lbclient.DoTimeout(req, res, 5) // $ ReqSucc=req SsrfSink=req
6867

6968
client := fasthttp.Client{}
70-
client.Get(resByte, "http://127.0.0.1:8909") // $ SSRF="http://127.0.0.1:8909"
71-
client.GetDeadline(resByte, "http://127.0.0.1:8909", time.Time{}) // $ SSRF="http://127.0.0.1:8909"
72-
client.GetTimeout(resByte, "http://127.0.0.1:8909", 5) // $ SSRF="http://127.0.0.1:8909"
73-
client.Post(resByte, "http://127.0.0.1:8909", nil) // $ SSRF="http://127.0.0.1:8909"
74-
client.Do(req, res) // $ ReqSucc=req SSRF=req
75-
client.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SSRF=req
76-
client.DoRedirects(req, res, 2) // $ ReqSucc=req SSRF=req
77-
client.DoTimeout(req, res, 5) // $ ReqSucc=req SSRF=req
69+
client.Get(resByte, userInput) // $ SsrfSink=userInput
70+
client.GetDeadline(resByte, userInput, time.Time{}) // $ SsrfSink=userInput
71+
client.GetTimeout(resByte, userInput, 5) // $ SsrfSink=userInput
72+
client.Post(resByte, userInput, nil) // $ SsrfSink=userInput
73+
client.Do(req, res) // $ ReqSucc=req SsrfSink=req SsrfSink=req
74+
client.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SsrfSink=req SsrfSink=req
75+
client.DoRedirects(req, res, 2) // $ ReqSucc=req SsrfSink=req SsrfSink=req
76+
client.DoTimeout(req, res, 5) // $ ReqSucc=req SsrfSink=req SsrfSink=req
7877

7978
pipelineClient := fasthttp.PipelineClient{}
80-
pipelineClient.Do(req, res) // $ ReqSucc=req SSRF=req
81-
pipelineClient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SSRF=req
82-
pipelineClient.DoTimeout(req, res, 5) // $ ReqSucc=req SSRF=req
79+
pipelineClient.Do(req, res) // $ ReqSucc=req SsrfSink=req SsrfSink=req
80+
pipelineClient.DoDeadline(req, res, time.Time{}) // $ ReqSucc=req SsrfSink=req SsrfSink=req
81+
pipelineClient.DoTimeout(req, res, 5) // $ ReqSucc=req SsrfSink=req SsrfSink=req
8382

8483
tcpDialer := fasthttp.TCPDialer{}
85-
tcpDialer.Dial("127.0.0.1:8909") // $ SSRF="127.0.0.1:8909"
86-
tcpDialer.DialTimeout("127.0.0.1:8909", 5) // $ SSRF="127.0.0.1:8909"
87-
tcpDialer.DialDualStack("127.0.0.1:8909") // $ SSRF="127.0.0.1:8909"
88-
tcpDialer.DialDualStackTimeout("127.0.0.1:8909", 5) // $ SSRF="127.0.0.1:8909"
84+
userInput = "127.0.0.1:8909"
85+
tcpDialer.Dial(userInput) // $ SsrfSink=userInput
86+
tcpDialer.DialTimeout(userInput, 5) // $ SsrfSink=userInput
87+
tcpDialer.DialDualStack(userInput) // $ SsrfSink=userInput
88+
tcpDialer.DialDualStackTimeout(userInput, 5) // $ SsrfSink=userInput
8989
}
9090

9191
func main() {

0 commit comments

Comments
 (0)