Skip to content

Commit 095881e

Browse files
owen-mcowen-mc
committed
Make SafeUrlFlow test more comprehensive (failing)
1 parent 39e114f commit 095881e

File tree

2 files changed

+32
-27
lines changed

2 files changed

+32
-27
lines changed

‎go/ql/test/library-tests/semmle/go/security/SafeUrlFlow/SafeUrlFlow.expected‎

Lines changed: 30 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,19 @@
1616
| SafeUrlFlow.go:71:39:71:54 | call to String | SafeUrlFlow.go:55:13:55:19 | selection of URL | SafeUrlFlow.go:71:39:71:54 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:55:13:55:19 | selection of URL | here |
1717
| SafeUrlFlow.go:75:70:75:85 | call to String | SafeUrlFlow.go:55:13:55:19 | selection of URL | SafeUrlFlow.go:75:70:75:85 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:55:13:55:19 | selection of URL | here |
1818
| SafeUrlFlow.go:79:40:79:55 | call to String | SafeUrlFlow.go:55:13:55:19 | selection of URL | SafeUrlFlow.go:79:40:79:55 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:55:13:55:19 | selection of URL | here |
19-
| SafeUrlFlow.go:90:24:90:41 | call to String | SafeUrlFlow.go:85:10:85:17 | selection of Host | SafeUrlFlow.go:90:24:90:41 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:85:10:85:17 | selection of Host | here |
20-
| SafeUrlFlow.go:111:11:111:23 | reconstructed | SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:111:11:111:23 | reconstructed | A safe URL flows here from $@. | SafeUrlFlow.go:101:13:101:19 | selection of URL | here |
21-
| SafeUrlFlow.go:114:24:114:46 | ...+... | SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:114:24:114:46 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:101:13:101:19 | selection of URL | here |
22-
| SafeUrlFlow.go:115:29:115:54 | ...+... | SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:115:29:115:54 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:101:13:101:19 | selection of URL | here |
23-
| SafeUrlFlow.go:116:12:116:38 | ...+... | SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:116:12:116:38 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:101:13:101:19 | selection of URL | here |
24-
| SafeUrlFlow.go:117:12:117:21 | opaquePart | SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:117:12:117:21 | opaquePart | A safe URL flows here from $@. | SafeUrlFlow.go:101:13:101:19 | selection of URL | here |
19+
| SafeUrlFlow.go:93:11:93:28 | call to String | SafeUrlFlow.go:85:10:85:17 | selection of Host | SafeUrlFlow.go:93:11:93:28 | call to String | A safe URL flows here from $@. | SafeUrlFlow.go:85:10:85:17 | selection of Host | here |
20+
| SafeUrlFlow.go:107:11:107:23 | reconstructed | SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:107:11:107:23 | reconstructed | A safe URL flows here from $@. | SafeUrlFlow.go:97:13:97:19 | selection of URL | here |
21+
| SafeUrlFlow.go:110:24:110:46 | ...+... | SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:110:24:110:46 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:97:13:97:19 | selection of URL | here |
22+
| SafeUrlFlow.go:111:29:111:54 | ...+... | SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:111:29:111:54 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:97:13:97:19 | selection of URL | here |
23+
| SafeUrlFlow.go:112:12:112:38 | ...+... | SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:112:12:112:38 | ...+... | A safe URL flows here from $@. | SafeUrlFlow.go:97:13:97:19 | selection of URL | here |
24+
| SafeUrlFlow.go:113:12:113:21 | opaquePart | SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:113:12:113:21 | opaquePart | A safe URL flows here from $@. | SafeUrlFlow.go:97:13:97:19 | selection of URL | here |
2525
edges
2626
| SafeUrlFlow.go:10:10:10:17 | selection of Host | SafeUrlFlow.go:11:24:11:46 | ...+... | provenance | Sink:MaD:1 |
2727
| SafeUrlFlow.go:10:10:10:17 | selection of Host | SafeUrlFlow.go:17:19:17:22 | host | provenance | |
2828
| SafeUrlFlow.go:13:13:13:19 | selection of URL | SafeUrlFlow.go:14:29:14:35 | baseURL | provenance | Src:MaD:2 |
2929
| SafeUrlFlow.go:14:29:14:35 | baseURL | SafeUrlFlow.go:14:29:14:44 | call to String | provenance | MaD:3 |
30+
| SafeUrlFlow.go:17:2:17:10 | targetURL | SafeUrlFlow.go:18:11:18:19 | targetURL | provenance | |
31+
| SafeUrlFlow.go:17:19:17:22 | host | SafeUrlFlow.go:17:2:17:10 | targetURL | provenance | Config |
3032
| SafeUrlFlow.go:17:19:17:22 | host | SafeUrlFlow.go:18:11:18:19 | targetURL | provenance | Config |
3133
| SafeUrlFlow.go:18:11:18:19 | targetURL | SafeUrlFlow.go:18:11:18:28 | call to String | provenance | MaD:3 |
3234
| SafeUrlFlow.go:37:13:37:19 | selection of URL | SafeUrlFlow.go:47:24:47:57 | ...+... | provenance | Src:MaD:2 Sink:MaD:1 |
@@ -55,13 +57,15 @@ edges
5557
| SafeUrlFlow.go:75:70:75:76 | baseURL | SafeUrlFlow.go:75:70:75:85 | call to String | provenance | MaD:3 |
5658
| SafeUrlFlow.go:79:40:79:46 | baseURL | SafeUrlFlow.go:79:40:79:55 | call to String | provenance | MaD:3 |
5759
| SafeUrlFlow.go:85:10:85:17 | selection of Host | SafeUrlFlow.go:88:19:88:22 | host | provenance | |
58-
| SafeUrlFlow.go:88:19:88:22 | host | SafeUrlFlow.go:90:24:90:32 | targetURL | provenance | Config |
59-
| SafeUrlFlow.go:90:24:90:32 | targetURL | SafeUrlFlow.go:90:24:90:41 | call to String | provenance | MaD:3 Sink:MaD:1 |
60-
| SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:111:11:111:23 | reconstructed | provenance | Src:MaD:2 |
61-
| SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:114:24:114:46 | ...+... | provenance | Src:MaD:2 Sink:MaD:1 |
62-
| SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:115:29:115:54 | ...+... | provenance | Src:MaD:2 |
63-
| SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:116:12:116:38 | ...+... | provenance | Src:MaD:2 |
64-
| SafeUrlFlow.go:101:13:101:19 | selection of URL | SafeUrlFlow.go:117:12:117:21 | opaquePart | provenance | Src:MaD:2 |
60+
| SafeUrlFlow.go:88:19:88:22 | host | SafeUrlFlow.go:92:2:92:10 | targetURL | provenance | Config |
61+
| SafeUrlFlow.go:88:19:88:22 | host | SafeUrlFlow.go:93:11:93:19 | targetURL | provenance | Config |
62+
| SafeUrlFlow.go:92:2:92:10 | targetURL | SafeUrlFlow.go:93:11:93:19 | targetURL | provenance | |
63+
| SafeUrlFlow.go:93:11:93:19 | targetURL | SafeUrlFlow.go:93:11:93:28 | call to String | provenance | MaD:3 |
64+
| SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:107:11:107:23 | reconstructed | provenance | Src:MaD:2 |
65+
| SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:110:24:110:46 | ...+... | provenance | Src:MaD:2 Sink:MaD:1 |
66+
| SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:111:29:111:54 | ...+... | provenance | Src:MaD:2 |
67+
| SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:112:12:112:38 | ...+... | provenance | Src:MaD:2 |
68+
| SafeUrlFlow.go:97:13:97:19 | selection of URL | SafeUrlFlow.go:113:12:113:21 | opaquePart | provenance | Src:MaD:2 |
6569
models
6670
| 1 | Sink: net/http; ; false; Redirect; ; ; Argument[2]; url-redirection[0]; manual |
6771
| 2 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
@@ -72,6 +76,7 @@ nodes
7276
| SafeUrlFlow.go:13:13:13:19 | selection of URL | semmle.label | selection of URL |
7377
| SafeUrlFlow.go:14:29:14:35 | baseURL | semmle.label | baseURL |
7478
| SafeUrlFlow.go:14:29:14:44 | call to String | semmle.label | call to String |
79+
| SafeUrlFlow.go:17:2:17:10 | targetURL | semmle.label | targetURL |
7580
| SafeUrlFlow.go:17:19:17:22 | host | semmle.label | host |
7681
| SafeUrlFlow.go:18:11:18:19 | targetURL | semmle.label | targetURL |
7782
| SafeUrlFlow.go:18:11:18:28 | call to String | semmle.label | call to String |
@@ -104,12 +109,16 @@ nodes
104109
| SafeUrlFlow.go:79:40:79:55 | call to String | semmle.label | call to String |
105110
| SafeUrlFlow.go:85:10:85:17 | selection of Host | semmle.label | selection of Host |
106111
| SafeUrlFlow.go:88:19:88:22 | host | semmle.label | host |
107-
| SafeUrlFlow.go:90:24:90:32 | targetURL | semmle.label | targetURL |
108-
| SafeUrlFlow.go:90:24:90:41 | call to String | semmle.label | call to String |
109-
| SafeUrlFlow.go:101:13:101:19 | selection of URL | semmle.label | selection of URL |
110-
| SafeUrlFlow.go:111:11:111:23 | reconstructed | semmle.label | reconstructed |
111-
| SafeUrlFlow.go:114:24:114:46 | ...+... | semmle.label | ...+... |
112-
| SafeUrlFlow.go:115:29:115:54 | ...+... | semmle.label | ...+... |
113-
| SafeUrlFlow.go:116:12:116:38 | ...+... | semmle.label | ...+... |
114-
| SafeUrlFlow.go:117:12:117:21 | opaquePart | semmle.label | opaquePart |
112+
| SafeUrlFlow.go:92:2:92:10 | targetURL | semmle.label | targetURL |
113+
| SafeUrlFlow.go:93:11:93:19 | targetURL | semmle.label | targetURL |
114+
| SafeUrlFlow.go:93:11:93:28 | call to String | semmle.label | call to String |
115+
| SafeUrlFlow.go:97:13:97:19 | selection of URL | semmle.label | selection of URL |
116+
| SafeUrlFlow.go:107:11:107:23 | reconstructed | semmle.label | reconstructed |
117+
| SafeUrlFlow.go:110:24:110:46 | ...+... | semmle.label | ...+... |
118+
| SafeUrlFlow.go:111:29:111:54 | ...+... | semmle.label | ...+... |
119+
| SafeUrlFlow.go:112:12:112:38 | ...+... | semmle.label | ...+... |
120+
| SafeUrlFlow.go:113:12:113:21 | opaquePart | semmle.label | opaquePart |
115121
subpaths
122+
testFailures
123+
| SafeUrlFlow.go:90:62:90:71 | comment | Missing result: Alert |
124+
| SafeUrlFlow.go:93:11:93:28 | call to String | Unexpected result: Alert |

‎go/ql/test/library-tests/semmle/go/security/SafeUrlFlow/SafeUrlFlow.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -88,13 +88,9 @@ func testHostFieldAssignmentFlow(w http.ResponseWriter, req *http.Request) {
8888
targetURL.Host = host // additional flow step from Host field to URL struct
8989

9090
http.Redirect(w, req, targetURL.String(), http.StatusFound) // $ Alert
91-
}
92-
93-
func testHostFieldOverwritten(w http.ResponseWriter, req *http.Request) {
94-
baseURL := req.URL
9591

96-
baseURL.Host = "something.else.com" // barrier edge (Host field overwritten) blocks flow here
97-
http.Get(baseURL.String())
92+
targetURL.Host = "something.else.com" // barrier edge (Host field overwritten) blocks flow here
93+
http.Get(targetURL.String())
9894
}
9995

10096
func testFieldAccess(w http.ResponseWriter, req *http.Request) {

0 commit comments

Comments
 (0)