General issue Go. Why isn't the following code recognized as a source in a global data stream?
还没有人认领这个 Issue。
评估
调研方向
首先,将 router.go、controller.go、validator.go 和 param.go 中的 source flow 与 TainterPath.ql 中默认的 ActiveThreatModelSource 进行比较。复现 Quick Evaluation 与 TaintTracking::Global 之间的差异,然后检查自定义的 GinContextGetSource 查询及其对 val.Get、req 和 c 的引用。当预期的 source 在全局数据流中被识别时,即表示完成。
由索引模型根据 Issue 内容生成。
描述
Why isn't the following code recognized as a source in a global data stream? If I want to identify this source in the global data stream, how should I write my QL?
Here's the code context:
//router.go
func RegisterServers(group *gin.RouterGroup) {
group.POST("/abc/test", val.Validate[*param.TestParam], controller.TestReadFile)
}
//controller.go
func TestReadFile(c *gin.Context) {
req := val.Get[*param.TestParam](c)
cleanPath := req.Path
file, err := os.Open(cleanPath)
if err != nil {
if os.IsNotExist(err) {
c.JSON(http.StatusNotFound, gin.H{"error": "file not found"})
} else {
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to open file"})
}
return
}
......
}
//validator.go
package val
func Validate[T any](ctx *gin.Context) {
var req T
if err := ctx.ShouldBindJSON(&req); err != nil {
ctx.JSON(http.StatusBadRequest, gin.H{"code": constant.UnknownErrorCode, "msg": util.GetErrorText(constant.UnknownErrorCode)})
ctx.Abort()
return
}
ctx.Set("params", req)
ctx.Next()
}
func Get[T any](ctx *gin.Context) T {
return ctx.MustGet("params").(T)
}
//param.go
package param
type TestParam struct {
Path string `json:"filepath"`
}
I found that the default "ActiveThreatModelSource" in the official rule "TainterPath.ql" is not recognizable as a source by the above code.
Here's the code I wrote to try to add a new class about this kind of source, and I use "req" from "req.Path" as the source, although the result can be recognized when "Quick Evaluation" is used, but when it is run in the whole "TaintTracking::Global", it cannot be recognized that there is a problem with this "controller.go".
class GinContextGetSource extends DataFlow::Node {
GinContextGetSource() {
exists(Function asmGet, CallExpr call |
asmGet.hasQualifiedName("project/router/val", "Get")
and call.getTarget() = asmGet
and call.getEnclosingFunction() = this.asExpr().getEnclosingFunction()
and this.asExpr().toString() = "req"
and this.asExpr().getEnclosingFunction().getAParameter().toString() = "c"
)
}
}
I need to address this issue urgently. Because the routing and controller parts of the entire Gin project that I am currently responsible for are developed in this form, the global data flow in each of my official rules cannot be identified in any of the sources
Thank you so much!
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 10 小时
- 30 天内合并 PR
- 134
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
github/codeql 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 84/100
-
难度 2/5 1-3 小时 新手友好度 82/100
-
难度 2/5 1-3 小时 新手友好度 78/100
-
false-positive
难度 2/5 1-3 小时 新手友好度 70/100
-
false-positive
难度 3/5 1-2 天 新手友好度 68/100
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 74/100
-
难度 1/5 1 小时以内 新手友好度 92/100
-
难度 1/5 1-3 小时 新手友好度 86/100
DavidAnson/markdownlint-cli2#940 ·
-
难度 1/5 1 小时以内 新手友好度 72/100
EclipseFdn/open-vsx.org#13385 · 1 条评论 ·
-
bug ci good first issue
难度 2/5 1-3 小时 新手友好度 88/100