Skip to content

Commit 1926ffd

Browse files
owen-mcowen-mc
committed
Convert XSS tests to use inline expectations
1 parent 1530ac1 commit 1926ffd

File tree

11 files changed

+70
-64
lines changed

11 files changed

+70
-64
lines changed

‎go/ql/test/query-tests/Security/CWE-079/HTMLTemplateEscapingPassthrough.go‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,45 +26,45 @@ func bad(req *http.Request) {
2626

2727
{
2828
{
29-
var a = template.HTML(req.UserAgent())
30-
checkError(tmpl.Execute(os.Stdout, a))
29+
var a = template.HTML(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
30+
checkError(tmpl.Execute(os.Stdout, a)) // $ Alert[go/html-template-escaping-passthrough]
3131
}
3232
{
3333
{
3434
var a template.HTML
35-
a = template.HTML(req.UserAgent())
36-
checkError(tmpl.Execute(os.Stdout, a))
35+
a = template.HTML(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
36+
checkError(tmpl.Execute(os.Stdout, a)) // $ Alert[go/html-template-escaping-passthrough]
3737
}
3838
{
3939
var a HTMLAlias
40-
a = HTMLAlias(req.UserAgent())
41-
checkError(tmpl.Execute(os.Stdout, a))
40+
a = HTMLAlias(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
41+
checkError(tmpl.Execute(os.Stdout, a)) // $ Alert[go/html-template-escaping-passthrough]
4242
}
4343
}
4444
}
4545
{
46-
var c = template.HTMLAttr(req.UserAgent())
47-
checkError(tmplTag.Execute(os.Stdout, c))
46+
var c = template.HTMLAttr(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
47+
checkError(tmplTag.Execute(os.Stdout, c)) // $ Alert[go/html-template-escaping-passthrough]
4848
}
4949
{
50-
var d = template.JS(req.UserAgent())
51-
checkError(tmplScript.Execute(os.Stdout, d))
50+
var d = template.JS(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
51+
checkError(tmplScript.Execute(os.Stdout, d)) // $ Alert[go/html-template-escaping-passthrough]
5252
}
5353
{
54-
var e = template.JSStr(req.UserAgent())
55-
checkError(tmplScript.Execute(os.Stdout, e))
54+
var e = template.JSStr(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
55+
checkError(tmplScript.Execute(os.Stdout, e)) // $ Alert[go/html-template-escaping-passthrough]
5656
}
5757
{
58-
var b = template.CSS(req.UserAgent())
59-
checkError(tmpl.Execute(os.Stdout, b))
58+
var b = template.CSS(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
59+
checkError(tmpl.Execute(os.Stdout, b)) // $ Alert[go/html-template-escaping-passthrough]
6060
}
6161
{
62-
var f = template.Srcset(req.UserAgent())
63-
checkError(tmplSrcset.Execute(os.Stdout, f))
62+
var f = template.Srcset(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
63+
checkError(tmplSrcset.Execute(os.Stdout, f)) // $ Alert[go/html-template-escaping-passthrough]
6464
}
6565
{
66-
var g = template.URL(req.UserAgent())
67-
checkError(tmpl.Execute(os.Stdout, g))
66+
var g = template.URL(req.UserAgent()) // $ Source[go/html-template-escaping-passthrough]
67+
checkError(tmpl.Execute(os.Stdout, g)) // $ Alert[go/html-template-escaping-passthrough]
6868
}
6969
}
7070

‎go/ql/test/query-tests/Security/CWE-079/HTMLTemplateEscapingPassthrough.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: Security/CWE-079/HTMLTemplateEscapingPassthrough.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/query-tests/Security/CWE-079/ReflectedXss.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ import (
88
func serve() {
99
http.HandleFunc("/user", func(w http.ResponseWriter, r *http.Request) {
1010
r.ParseForm()
11-
username := r.Form.Get("username")
11+
username := r.Form.Get("username") // $ Source[go/reflected-xss]
1212
if !isValidUsername(username) {
1313
// BAD: a request parameter is incorporated without validation into the response
14-
fmt.Fprintf(w, "%q is an unknown user", username)
14+
fmt.Fprintf(w, "%q is an unknown user", username) // $ Alert[go/reflected-xss]
1515
} else {
1616
// TODO: Handle successful login
1717
}

‎go/ql/test/query-tests/Security/CWE-079/ReflectedXss.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: Security/CWE-079/ReflectedXss.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/query-tests/Security/CWE-079/StoredXss.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ func ListFiles(w http.ResponseWriter, r *http.Request) {
1010
files, _ := ioutil.ReadDir(".")
1111

1212
for _, file := range files {
13-
io.WriteString(w, file.Name()+"\n")
13+
io.WriteString(w, file.Name()+"\n") // $ Alert[go/stored-xss]
1414
}
1515
}

‎go/ql/test/query-tests/Security/CWE-079/StoredXss.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: Security/CWE-079/StoredXss.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/query-tests/Security/CWE-079/contenttype.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@ import (
88
func serve2() {
99
http.HandleFunc("/echo", func(w http.ResponseWriter, r *http.Request) {
1010
r.ParseForm()
11-
data := r.Form.Get("data")
11+
data := r.Form.Get("data") // $ Source[go/reflected-xss]
1212

1313
// Not OK; direct flow from request body to output.
1414
// The response Content-Type header is derived from a call to
1515
// `http.DetectContentType`, which can be easily manipulated into returning
1616
// `text/html` for XSS.
17-
w.Write([]byte(data))
17+
w.Write([]byte(data)) // $ Alert[go/reflected-xss]
1818
})
1919
http.ListenAndServe(":80", nil)
2020
}
@@ -46,11 +46,11 @@ func serve4() {
4646
func serve5() {
4747
http.HandleFunc("/echo", func(w http.ResponseWriter, r *http.Request) {
4848
r.ParseForm()
49-
data := r.Form.Get("data")
49+
data := r.Form.Get("data") // $ Source[go/reflected-xss]
5050

5151
w.Header().Set("Content-Type", "text/html")
5252

53-
fmt.Fprintf(w, "Constant: %s", data) // Not OK; the content-type header is explicitly set to html
53+
fmt.Fprintf(w, "Constant: %s", data) // $ Alert[go/reflected-xss] // The content-type header is explicitly set to html
5454
})
5555
http.ListenAndServe(":80", nil)
5656
}
@@ -60,8 +60,8 @@ func serve10() {
6060
r.ParseForm()
6161
data := r.Form.Get("data")
6262

63-
data = r.FormValue("data")
64-
fmt.Fprintf(w, "\t<html><body>%s</body></html>", data) // Not OK
63+
data = r.FormValue("data") // $ Source[go/reflected-xss]
64+
fmt.Fprintf(w, "\t<html><body>%s</body></html>", data) // $ Alert[go/reflected-xss]
6565
})
6666
}
6767

@@ -70,13 +70,13 @@ func serve11() {
7070
r.ParseForm()
7171
data := r.Form.Get("data")
7272

73-
data = r.FormValue("data")
73+
data = r.FormValue("data") // $ Source[go/reflected-xss]
7474
fmt.Fprintf(w, `
7575
<html>
7676
<body>
7777
%s
7878
</body>
79-
</html>`, data) // Not OK
79+
</html>`, data) // $ Alert[go/reflected-xss]
8080
})
8181
}
8282

@@ -85,10 +85,10 @@ func serve12() {
8585
r.ParseForm()
8686
data := r.Form.Get("data")
8787

88-
data = r.FormValue("data")
88+
data = r.FormValue("data") // $ Source[go/reflected-xss]
8989
fmt.Fprintf(w, `
9090
%s
91-
`, data) // Not OK
91+
`, data) // $ Alert[go/reflected-xss]
9292
})
9393
}
9494

@@ -110,7 +110,7 @@ func serve14() {
110110
r.ParseForm()
111111
data := r.Form.Get("data")
112112

113-
data = r.FormValue("data")
114-
fmt.Fprintf(w, "<html><body>%s</body></html>", data) // Not OK
113+
data = r.FormValue("data") // $ Source[go/reflected-xss]
114+
fmt.Fprintf(w, "<html><body>%s</body></html>", data) // $ Alert[go/reflected-xss]
115115
})
116116
}

‎go/ql/test/query-tests/Security/CWE-079/reflectedxsstest.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,29 +28,29 @@ func ErrTest(w http.ResponseWriter, r http.Request) {
2828
w.Write([]byte(fmt.Sprintf("Cookie result: %v", cookie))) // GOOD: Cookie's value is not user-controlled in reflected xss.
2929
w.Write([]byte(fmt.Sprintf("Cookie check error: %v", err))) // GOOD: Cookie's err return is harmless
3030
http.Error(w, fmt.Sprintf("Cookie result: %v", cookie), 500) // Good: only plain text is written.
31-
file, header, err := r.FormFile("someFile")
31+
file, header, err := r.FormFile("someFile") // $ Source[go/reflected-xss]
3232
content, err2 := ioutil.ReadAll(file)
33-
w.Write([]byte(fmt.Sprintf("File content: %v", content))) // BAD: file content is user-controlled
34-
w.Write([]byte(fmt.Sprintf("File name: %v", header.Filename))) // BAD: file header is user-controlled
33+
w.Write([]byte(fmt.Sprintf("File content: %v", content))) // $ Alert[go/reflected-xss] // BAD: file content is user-controlled
34+
w.Write([]byte(fmt.Sprintf("File name: %v", header.Filename))) // $ Alert[go/reflected-xss] // BAD: file header is user-controlled
3535
w.Write([]byte(fmt.Sprintf("FormFile error: %v", err))) // GOOD: FormFile's err return is harmless
3636
w.Write([]byte(fmt.Sprintf("FormFile error: %v", err2))) // GOOD: ReadAll's err return is harmless
3737

38-
reader, err := r.MultipartReader()
38+
reader, err := r.MultipartReader() // $ Source[go/reflected-xss]
3939
part, err2 := reader.NextPart()
4040
partName := part.FileName()
4141
byteSlice := make([]byte, 100)
4242
part.Read(byteSlice)
4343

44-
w.Write([]byte(fmt.Sprintf("Part name: %v", partName))) // BAD: part name is user-controlled
45-
w.Write(byteSlice) // BAD: part contents are user-controlled
44+
w.Write([]byte(fmt.Sprintf("Part name: %v", partName))) // $ Alert[go/reflected-xss] // BAD: part name is user-controlled
45+
w.Write(byteSlice) // $ Alert[go/reflected-xss] // BAD: part contents are user-controlled
4646
w.Write([]byte(fmt.Sprintf("MultipartReader error: %v", err))) // GOOD: MultipartReader's err return is harmless
4747
w.Write([]byte(fmt.Sprintf("MultipartReader error: %v", err2))) // GOOD: NextPart's err return is harmless
4848
}
4949

5050
func QueryMapTest(w http.ResponseWriter, r http.Request) {
51-
keys, ok := r.URL.Query()["data_id"]
51+
keys, ok := r.URL.Query()["data_id"] // $ Source[go/reflected-xss]
5252
if ok && len(keys[0]) > 0 {
5353
key := keys[0]
54-
w.Write([]byte(key)) // BAD: query string is user-controlled
54+
w.Write([]byte(key)) // $ Alert[go/reflected-xss] // BAD: query string is user-controlled
5555
}
5656
}

‎go/ql/test/query-tests/Security/CWE-079/stored.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ var q string
1515
func storedserve1() {
1616
http.HandleFunc("/user", func(w http.ResponseWriter, r *http.Request) {
1717
r.ParseForm()
18-
rows, _ := db.Query(q, 32)
18+
rows, _ := db.Query(q, 32) // $ Source[go/stored-xss]
1919

2020
for rows.Next() {
2121
var (
@@ -27,7 +27,7 @@ func storedserve1() {
2727
}
2828

2929
// BAD: the stored XSS query assumes all query results are untrusted
30-
io.WriteString(w, name)
30+
io.WriteString(w, name) // $ Alert[go/stored-xss]
3131
}
3232
})
3333
}
@@ -56,9 +56,9 @@ func storedserve2() {
5656

5757
func storedserve3() {
5858
http.HandleFunc("/user", func(w http.ResponseWriter, r *http.Request) {
59-
filepath.WalkDir(".", func(path string, _ fs.DirEntry, err error) error {
59+
filepath.WalkDir(".", func(path string, _ fs.DirEntry, err error) error { // $ Source[go/stored-xss]
6060
// BAD: filenames are considered to be untrusted
61-
io.WriteString(w, path)
61+
io.WriteString(w, path) // $ Alert[go/stored-xss]
6262
return nil
6363
})
6464
})

‎go/ql/test/query-tests/Security/CWE-079/tst.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ import (
1111
func serve6() {
1212
http.HandleFunc("/user", func(w http.ResponseWriter, r *http.Request) {
1313
r.ParseForm()
14-
username := r.Form.Get("username")
14+
username := r.Form.Get("username") // $ Source[go/reflected-xss]
1515
if !isValidUsername(username) {
1616
// BAD: a request parameter is incorporated without validation into the response
1717
a := []string{username, "is", "an", "unknown", "user"}
18-
w.Write([]byte(strings.Join(a, " ")))
18+
w.Write([]byte(strings.Join(a, " "))) // $ Alert[go/reflected-xss]
1919
} else {
2020
// TODO: do something exciting
2121
}
@@ -45,12 +45,12 @@ func serve7() {
4545
func serve8() {
4646
http.HandleFunc("/user", func(w http.ResponseWriter, r *http.Request) {
4747
r.ParseForm()
48-
service := r.Form.Get("service")
48+
service := r.Form.Get("service") // $ Source[go/reflected-xss]
4949
if service != "service1" && service != "service2" {
5050
fmt.Fprintln(w, "Service not found")
5151
} else {
5252
// OK (service is known to be either "service1" or "service2" here), but currently flagged
53-
w.Write([]byte(service))
53+
w.Write([]byte(service)) // $ SPURIOUS: Alert[go/reflected-xss]
5454
}
5555
})
5656
}

0 commit comments

Comments
 (0)