[DIFF-INFORMED] Go: RequestForgery, SafeUrlFlow

d10c · d10c · commit d6ef585110ee · 2025-07-17T11:46:42.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-918/RequestForgery.ql#L21 https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-601/OpenUrlRedirect.ql#L24
diff --git a/go/ql/lib/semmle/go/security/RequestForgery.qll b/go/ql/lib/semmle/go/security/RequestForgery.qll
@@ -31,6 +31,14 @@ module RequestForgery {
         w.writesField(v.getAUse(), f, pred) and succ = v.getAUse()
       )
     }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
+
+    Location getASelectedSinkLocation(DataFlow::Node sink) {
+      result = sink.getLocation()
+      or
+      result = sink.(Sink).getARequest().getLocation()
+    }
   }
 
   /** Tracks taint flow from untrusted data to request forgery attack vectors. */
diff --git a/go/ql/lib/semmle/go/security/SafeUrlFlow.qll b/go/ql/lib/semmle/go/security/SafeUrlFlow.qll
@@ -36,6 +36,10 @@ module SafeUrlFlow {
       or
       node instanceof SanitizerEdge
     }
+
+    predicate observeDiffInformedIncrementalMode() {
+      none() // only used as secondary configuration
+    }
   }
 
   /** Tracks taint flow for reasoning about safe URLs. */

Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,14 @@ module RequestForgery {`
`31`	`31`	`w.writesField(v.getAUse(), f, pred) and succ = v.getAUse()`
`32`	`32`	`)`
`33`	`33`	`}`
	`34`	`+`
	`35`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`36`	`+`
	`37`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`38`	`+ result = sink.getLocation()`
	`39`	`+ or`
	`40`	`+ result = sink.(Sink).getARequest().getLocation()`
	`41`	`+ }`
`34`	`42`	`}`
`35`	`43`
`36`	`44`	`/** Tracks taint flow from untrusted data to request forgery attack vectors. */`
Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,10 @@ module SafeUrlFlow {`
`36`	`36`	`or`
`37`	`37`	`node instanceof SanitizerEdge`
`38`	`38`	`}`
	`39`	`+`
	`40`	`+ predicate observeDiffInformedIncrementalMode() {`
	`41`	`+ none() // only used as secondary configuration`
	`42`	`+ }`
`39`	`43`	`}`
`40`	`44`
`41`	`45`	`/** Tracks taint flow for reasoning about safe URLs. */`