Skip to content

Commit b4a9689

Browse files
owen-mcowen-mc
committed
Convert .qlref test to inline expectations
1 parent 6a8e20a commit b4a9689

207 files changed

Lines changed: 1011 additions & 903 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎go/ql/src/experimental/CWE-525/WebCacheDeception.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/*
1+
/**
22
* @name Web Cache Deception
33
* @description A caching system has been detected on the application and is vulnerable to web cache deception. By manipulating the URL it is possible to force the application to cache pages that are only accessible by an authenticated user. Once cached, these pages can be accessed by an unauthenticated user.
44
* @kind problem

‎go/ql/test/experimental/CWE-090/LDAPInjection.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -54,31 +54,31 @@ func main() {}
5454
// bad is an example of a bad implementation
5555
func (ld *Ldap) bad(req *http.Request) {
5656
// ...
57-
untrusted := req.UserAgent()
57+
untrusted := req.UserAgent() // $ Source
5858
goldap.NewSearchRequest(
59-
untrusted, // BAD: untrusted dn
59+
untrusted, // $ Alert // BAD: untrusted dn
6060
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
61-
"(&(objectClass=organizationalPerson))"+untrusted, // BAD: untrusted filter
62-
[]string{"dn", "cn", untrusted}, // BAD: untrusted attribute
61+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert // BAD: untrusted filter
62+
[]string{"dn", "cn", untrusted}, // $ Alert // BAD: untrusted attribute
6363
nil,
6464
)
6565
goldapv3.NewSearchRequest(
66-
untrusted, // BAD: untrusted dn
66+
untrusted, // $ Alert // BAD: untrusted dn
6767
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
68-
"(&(objectClass=organizationalPerson))"+untrusted, // BAD: untrusted filter
69-
[]string{"dn", "cn", untrusted}, // BAD: untrusted attribute
68+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert // BAD: untrusted filter
69+
[]string{"dn", "cn", untrusted}, // $ Alert // BAD: untrusted attribute
7070
nil,
7171
)
7272
gopkgldapv2.NewSearchRequest(
73-
untrusted, // BAD: untrusted dn
73+
untrusted, // $ Alert // BAD: untrusted dn
7474
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
75-
"(&(objectClass=organizationalPerson))"+untrusted, // BAD: untrusted filter
76-
[]string{"dn", "cn", untrusted}, // BAD: untrusted attribute
75+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert // BAD: untrusted filter
76+
[]string{"dn", "cn", untrusted}, // $ Alert // BAD: untrusted attribute
7777
nil,
7878
)
7979
client := &ldapclient.LDAPClient{}
80-
client.Authenticate(untrusted, "123456") // BAD: untrusted filter
81-
client.GetGroupsOfUser(untrusted) // BAD: untrusted filter
80+
client.Authenticate(untrusted, "123456") // $ Alert // BAD: untrusted filter
81+
client.GetGroupsOfUser(untrusted) // $ Alert // BAD: untrusted filter
8282
// ...
8383
}
8484

‎go/ql/test/experimental/CWE-090/LDAPInjection.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: experimental/CWE-090/LDAPInjection.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-203/Timing.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: experimental/CWE-203/Timing.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-203/timing.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
1212
secret := "MySuperSecretPasscode"
1313
secretHeader := "X-Secret"
1414

15-
headerSecret := req.Header.Get(secretHeader)
15+
headerSecret := req.Header.Get(secretHeader) // $ Source
1616
secretStr := string(secret)
17-
if len(headerSecret) != 0 && headerSecret != secretStr {
17+
if len(headerSecret) != 0 && headerSecret != secretStr { // $ Alert
1818
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
1919
}
2020
return nil, nil
@@ -25,9 +25,9 @@ func bad2(w http.ResponseWriter, req *http.Request) (interface{}, error) {
2525
secret := "MySuperSecretPasscode"
2626
secretHeader := "X-Secret"
2727

28-
headerSecret := req.Header.Get(secretHeader)
28+
headerSecret := req.Header.Get(secretHeader) // $ Source
2929
secretStr := string(secret)
30-
if len(headerSecret) != 0 && strings.Compare(headerSecret, secretStr) != 0 {
30+
if len(headerSecret) != 0 && strings.Compare(headerSecret, secretStr) != 0 { // $ Alert
3131
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
3232
}
3333
return nil, nil
@@ -38,8 +38,8 @@ func bad4(w http.ResponseWriter, req *http.Request) (interface{}, error) {
3838
secret := "MySuperSecretPasscode"
3939
secretHeader := "X-Secret"
4040

41-
headerSecret := req.Header.Get(secretHeader)
42-
if len(secret) != 0 && headerSecret != "SecretStringLiteral" {
41+
headerSecret := req.Header.Get(secretHeader) // $ Source
42+
if len(secret) != 0 && headerSecret != "SecretStringLiteral" { // $ Alert
4343
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
4444
}
4545
return nil, nil

‎go/ql/test/experimental/CWE-285/PamAuthBypass.qlref‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
experimental/CWE-285/PamAuthBypass.ql
1+
query: experimental/CWE-285/PamAuthBypass.ql
2+
postprocess: utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-285/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
func bad() error {
1010
t, _ := pam.StartFunc("", "", func(s pam.Style, msg string) (string, error) {
1111
return "", nil
12-
})
12+
}) // $ Alert
1313
return t.Authenticate(0)
1414

1515
}

‎go/ql/test/experimental/CWE-287/ImproperLdapAuth.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
1515
ldapServer := "ldap.example.com"
1616
ldapPort := 389
1717
bindDN := "cn=admin,dc=example,dc=com"
18-
bindPassword := req.URL.Query()["password"][0]
18+
bindPassword := req.URL.Query()["password"][0] // $ Source
1919

2020
// Connect to the LDAP server
2121
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ldapServer, ldapPort))
@@ -25,7 +25,7 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
2525
defer l.Close()
2626

2727
// BAD: user input is not sanetized
28-
err = l.Bind(bindDN, bindPassword)
28+
err = l.Bind(bindDN, bindPassword) // $ Alert
2929
if err != nil {
3030
return fmt.Errorf("LDAP bind failed: %v", err), err
3131
}
@@ -84,7 +84,7 @@ func bad2(req *http.Request) {
8484
ldapPort := 389
8585
bindDN := "cn=admin,dc=example,dc=com"
8686
// BAD : empty password
87-
bindPassword := ""
87+
bindPassword := "" // $ Source
8888

8989
// Connect to the LDAP server
9090
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ldapServer, ldapPort))
@@ -94,7 +94,7 @@ func bad2(req *http.Request) {
9494
defer l.Close()
9595

9696
// BAD : bindPassword is empty
97-
err = l.Bind(bindDN, bindPassword)
97+
err = l.Bind(bindDN, bindPassword) // $ Alert
9898
if err != nil {
9999
log.Fatalf("LDAP bind failed: %v", err)
100100
}

‎go/ql/test/experimental/CWE-287/ImproperLdapAuth.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: experimental/CWE-287/ImproperLdapAuth.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-321-V2/HardCodedKeys.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
#select
2+
| go-jose.v3.go:24:32:24:37 | JwtKey | go-jose.v3.go:13:21:13:33 | "AllYourBase" | go-jose.v3.go:24:32:24:37 | JwtKey | This $@. | go-jose.v3.go:13:21:13:33 | "AllYourBase" | Constant Key is used as JWT Secret key |
3+
| golang-jwt-v5.go:27:9:27:15 | JwtKey1 | golang-jwt-v5.go:19:22:19:34 | "AllYourBase" | golang-jwt-v5.go:27:9:27:15 | JwtKey1 | This $@. | golang-jwt-v5.go:19:22:19:34 | "AllYourBase" | Constant Key is used as JWT Secret key |
14
edges
25
| go-jose.v3.go:13:14:13:34 | type conversion | go-jose.v3.go:24:32:24:37 | JwtKey | provenance | |
36
| go-jose.v3.go:13:21:13:33 | "AllYourBase" | go-jose.v3.go:13:14:13:34 | type conversion | provenance | |
@@ -11,6 +14,3 @@ nodes
1114
| golang-jwt-v5.go:19:22:19:34 | "AllYourBase" | semmle.label | "AllYourBase" |
1215
| golang-jwt-v5.go:27:9:27:15 | JwtKey1 | semmle.label | JwtKey1 |
1316
subpaths
14-
#select
15-
| go-jose.v3.go:24:32:24:37 | JwtKey | go-jose.v3.go:13:21:13:33 | "AllYourBase" | go-jose.v3.go:24:32:24:37 | JwtKey | This $@. | go-jose.v3.go:13:21:13:33 | "AllYourBase" | Constant Key is used as JWT Secret key |
16-
| golang-jwt-v5.go:27:9:27:15 | JwtKey1 | golang-jwt-v5.go:19:22:19:34 | "AllYourBase" | golang-jwt-v5.go:27:9:27:15 | JwtKey1 | This $@. | golang-jwt-v5.go:19:22:19:34 | "AllYourBase" | Constant Key is used as JWT Secret key |

0 commit comments

Comments
 (0)