Skip to content

Commit cc421ae

Browse files
committed
Remove optional query IDs except when needed
1 parent adcd865 commit cc421ae

48 files changed

Lines changed: 300 additions & 300 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

go/ql/test/experimental/CWE-090/LDAPInjection.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -54,31 +54,31 @@ func main() {}
5454
// bad is an example of a bad implementation
5555
func (ld *Ldap) bad(req *http.Request) {
5656
// ...
57-
untrusted := req.UserAgent() // $ Source[go/ldap-injection]
57+
untrusted := req.UserAgent() // $ Source
5858
goldap.NewSearchRequest(
59-
untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted dn
59+
untrusted, // $ Alert // BAD: untrusted dn
6060
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
61-
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted filter
62-
[]string{"dn", "cn", untrusted}, // $ Alert[go/ldap-injection] // BAD: untrusted attribute
61+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert // BAD: untrusted filter
62+
[]string{"dn", "cn", untrusted}, // $ Alert // BAD: untrusted attribute
6363
nil,
6464
)
6565
goldapv3.NewSearchRequest(
66-
untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted dn
66+
untrusted, // $ Alert // BAD: untrusted dn
6767
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
68-
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted filter
69-
[]string{"dn", "cn", untrusted}, // $ Alert[go/ldap-injection] // BAD: untrusted attribute
68+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert // BAD: untrusted filter
69+
[]string{"dn", "cn", untrusted}, // $ Alert // BAD: untrusted attribute
7070
nil,
7171
)
7272
gopkgldapv2.NewSearchRequest(
73-
untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted dn
73+
untrusted, // $ Alert // BAD: untrusted dn
7474
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
75-
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted filter
76-
[]string{"dn", "cn", untrusted}, // $ Alert[go/ldap-injection] // BAD: untrusted attribute
75+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert // BAD: untrusted filter
76+
[]string{"dn", "cn", untrusted}, // $ Alert // BAD: untrusted attribute
7777
nil,
7878
)
7979
client := &ldapclient.LDAPClient{}
80-
client.Authenticate(untrusted, "123456") // $ Alert[go/ldap-injection] // BAD: untrusted filter
81-
client.GetGroupsOfUser(untrusted) // $ Alert[go/ldap-injection] // BAD: untrusted filter
80+
client.Authenticate(untrusted, "123456") // $ Alert // BAD: untrusted filter
81+
client.GetGroupsOfUser(untrusted) // $ Alert // BAD: untrusted filter
8282
// ...
8383
}
8484

go/ql/test/experimental/CWE-203/timing.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
1212
secret := "MySuperSecretPasscode"
1313
secretHeader := "X-Secret"
1414

15-
headerSecret := req.Header.Get(secretHeader) // $ Source[go/timing-attack]
15+
headerSecret := req.Header.Get(secretHeader) // $ Source
1616
secretStr := string(secret)
17-
if len(headerSecret) != 0 && headerSecret != secretStr { // $ Alert[go/timing-attack]
17+
if len(headerSecret) != 0 && headerSecret != secretStr { // $ Alert
1818
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
1919
}
2020
return nil, nil
@@ -25,9 +25,9 @@ func bad2(w http.ResponseWriter, req *http.Request) (interface{}, error) {
2525
secret := "MySuperSecretPasscode"
2626
secretHeader := "X-Secret"
2727

28-
headerSecret := req.Header.Get(secretHeader) // $ Source[go/timing-attack]
28+
headerSecret := req.Header.Get(secretHeader) // $ Source
2929
secretStr := string(secret)
30-
if len(headerSecret) != 0 && strings.Compare(headerSecret, secretStr) != 0 { // $ Alert[go/timing-attack]
30+
if len(headerSecret) != 0 && strings.Compare(headerSecret, secretStr) != 0 { // $ Alert
3131
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
3232
}
3333
return nil, nil
@@ -38,8 +38,8 @@ func bad4(w http.ResponseWriter, req *http.Request) (interface{}, error) {
3838
secret := "MySuperSecretPasscode"
3939
secretHeader := "X-Secret"
4040

41-
headerSecret := req.Header.Get(secretHeader) // $ Source[go/timing-attack]
42-
if len(secret) != 0 && headerSecret != "SecretStringLiteral" { // $ Alert[go/timing-attack]
41+
headerSecret := req.Header.Get(secretHeader) // $ Source
42+
if len(secret) != 0 && headerSecret != "SecretStringLiteral" { // $ Alert
4343
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
4444
}
4545
return nil, nil

go/ql/test/experimental/CWE-287/ImproperLdapAuth.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
1515
ldapServer := "ldap.example.com"
1616
ldapPort := 389
1717
bindDN := "cn=admin,dc=example,dc=com"
18-
bindPassword := req.URL.Query()["password"][0] // $ Source[go/improper-ldap-auth]
18+
bindPassword := req.URL.Query()["password"][0] // $ Source
1919

2020
// Connect to the LDAP server
2121
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ldapServer, ldapPort))
@@ -25,7 +25,7 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
2525
defer l.Close()
2626

2727
// BAD: user input is not sanetized
28-
err = l.Bind(bindDN, bindPassword) // $ Alert[go/improper-ldap-auth]
28+
err = l.Bind(bindDN, bindPassword) // $ Alert
2929
if err != nil {
3030
return fmt.Errorf("LDAP bind failed: %v", err), err
3131
}
@@ -84,7 +84,7 @@ func bad2(req *http.Request) {
8484
ldapPort := 389
8585
bindDN := "cn=admin,dc=example,dc=com"
8686
// BAD : empty password
87-
bindPassword := "" // $ Source[go/improper-ldap-auth]
87+
bindPassword := "" // $ Source
8888

8989
// Connect to the LDAP server
9090
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ldapServer, ldapPort))
@@ -94,7 +94,7 @@ func bad2(req *http.Request) {
9494
defer l.Close()
9595

9696
// BAD : bindPassword is empty
97-
err = l.Bind(bindDN, bindPassword) // $ Alert[go/improper-ldap-auth]
97+
err = l.Bind(bindDN, bindPassword) // $ Alert
9898
if err != nil {
9999
log.Fatalf("LDAP bind failed: %v", err)
100100
}

go/ql/test/experimental/CWE-369/DivideByZero.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,37 +7,37 @@ import (
77
)
88

99
func myHandler1(w http.ResponseWriter, r *http.Request) {
10-
param1 := r.URL.Query()["param1"][0] // $ Source[go/divide-by-zero]
10+
param1 := r.URL.Query()["param1"][0] // $ Source
1111
value, _ := strconv.Atoi(param1)
12-
out := 1337 / value // $ Alert[go/divide-by-zero]
12+
out := 1337 / value // $ Alert
1313
fmt.Println(out)
1414
}
1515

1616
func myHandler2(w http.ResponseWriter, r *http.Request) {
17-
param1 := r.URL.Query()["param1"][0] // $ Source[go/divide-by-zero]
17+
param1 := r.URL.Query()["param1"][0] // $ Source
1818
value := int(param1[0])
19-
out := 1337 / value // $ Alert[go/divide-by-zero]
19+
out := 1337 / value // $ Alert
2020
fmt.Println(out)
2121
}
2222

2323
func myHandler3(w http.ResponseWriter, r *http.Request) {
24-
param1 := r.URL.Query()["param1"][0] // $ Source[go/divide-by-zero]
24+
param1 := r.URL.Query()["param1"][0] // $ Source
2525
value, _ := strconv.ParseInt(param1, 10, 64)
26-
out := 1337 / value // $ Alert[go/divide-by-zero]
26+
out := 1337 / value // $ Alert
2727
fmt.Println(out)
2828
}
2929

3030
func myHandler4(w http.ResponseWriter, r *http.Request) {
31-
param1 := r.URL.Query()["param1"][0] // $ Source[go/divide-by-zero]
31+
param1 := r.URL.Query()["param1"][0] // $ Source
3232
value, _ := strconv.ParseFloat(param1, 32)
33-
out := 1337 / value // $ Alert[go/divide-by-zero]
33+
out := 1337 / value // $ Alert
3434
fmt.Println(out)
3535
}
3636

3737
func myHandler5(w http.ResponseWriter, r *http.Request) {
38-
param1 := r.URL.Query()["param1"][0] // $ Source[go/divide-by-zero]
38+
param1 := r.URL.Query()["param1"][0] // $ Source
3939
value, _ := strconv.ParseUint(param1, 10, 64)
40-
out := 1337 / value // $ Alert[go/divide-by-zero]
40+
out := 1337 / value // $ Alert
4141
fmt.Println(out)
4242
}
4343

@@ -51,10 +51,10 @@ func myHandler6(w http.ResponseWriter, r *http.Request) {
5151
}
5252

5353
func myHandler7(w http.ResponseWriter, r *http.Request) {
54-
param1 := r.URL.Query()["param1"][0] // $ Source[go/divide-by-zero]
54+
param1 := r.URL.Query()["param1"][0] // $ Source
5555
value := int(param1[0])
5656
if value >= 0 {
57-
out := 1337 / value // $ Alert[go/divide-by-zero]
57+
out := 1337 / value // $ Alert
5858
fmt.Println(out)
5959
}
6060
}

0 commit comments

Comments
 (0)