Skip to content

Commit e7cbca0

Browse files
owen-mcowen-mc
committed
Fix OpenUrlRedirect barrier for write to Url.Host
1 parent 09aab92 commit e7cbca0

File tree

2 files changed

+4
-34
lines changed

2 files changed

+4
-34
lines changed

‎go/ql/lib/semmle/go/security/OpenUrlRedirect.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,10 @@ module OpenUrlRedirect {
4848

4949
predicate isBarrierOut(DataFlow::Node node) {
5050
// block propagation of this unsafe value when its host is overwritten
51-
exists(Write w, Field f | f.hasQualifiedName("net/url", "URL", "Host") |
52-
w.writesField(node.(DataFlow::PostUpdateNode).getPreUpdateNode(), f, _)
51+
exists(Write w, Field f, DataFlow::Node base |
52+
f.hasQualifiedName("net/url", "URL", "Host") and
53+
w.writesField(base, f, _) and
54+
base.(DataFlow::PostUpdateNode).getPreUpdateNode() = node
5355
)
5456
or
5557
hostnameSanitizingPrefixEdge(node, _)

‎go/ql/test/query-tests/Security/CWE-601/OpenUrlRedirect/OpenUrlRedirect.expected‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@
1010
| stdlib.go:188:23:188:28 | target | stdlib.go:186:13:186:33 | call to FormValue | stdlib.go:188:23:188:28 | target | This path to an untrusted URL redirection depends on a $@. | stdlib.go:186:13:186:33 | call to FormValue | user-provided value |
1111
| stdlib.go:196:23:196:33 | selection of Path | stdlib.go:194:36:194:56 | call to FormValue | stdlib.go:196:23:196:33 | selection of Path | This path to an untrusted URL redirection depends on a $@. | stdlib.go:194:36:194:56 | call to FormValue | user-provided value |
1212
| stdlib.go:198:23:198:42 | call to EscapedPath | stdlib.go:194:36:194:56 | call to FormValue | stdlib.go:198:23:198:42 | call to EscapedPath | This path to an untrusted URL redirection depends on a $@. | stdlib.go:194:36:194:56 | call to FormValue | user-provided value |
13-
| stdlib.go:201:23:201:33 | selection of Path | stdlib.go:194:36:194:56 | call to FormValue | stdlib.go:201:23:201:33 | selection of Path | This path to an untrusted URL redirection depends on a $@. | stdlib.go:194:36:194:56 | call to FormValue | user-provided value |
14-
| stdlib.go:203:23:203:37 | call to String | stdlib.go:194:36:194:56 | call to FormValue | stdlib.go:203:23:203:37 | call to String | This path to an untrusted URL redirection depends on a $@. | stdlib.go:194:36:194:56 | call to FormValue | user-provided value |
1513
| stdlib.go:212:23:212:28 | selection of Path | stdlib.go:210:12:210:30 | call to FormValue | stdlib.go:212:23:212:28 | selection of Path | This path to an untrusted URL redirection depends on a $@. | stdlib.go:210:12:210:30 | call to FormValue | user-provided value |
1614
| stdlib.go:214:23:214:32 | call to String | stdlib.go:210:12:210:30 | call to FormValue | stdlib.go:214:23:214:32 | call to String | This path to an untrusted URL redirection depends on a $@. | stdlib.go:210:12:210:30 | call to FormValue | user-provided value |
1715
edges
@@ -59,28 +57,11 @@ edges
5957
| stdlib.go:196:23:196:28 | target | stdlib.go:196:23:196:28 | implicit dereference | provenance | Config |
6058
| stdlib.go:196:23:196:28 | target | stdlib.go:196:23:196:33 | selection of Path | provenance | Config Sink:MaD:1 |
6159
| stdlib.go:196:23:196:28 | target | stdlib.go:198:23:198:28 | target | provenance | |
62-
| stdlib.go:196:23:196:28 | target | stdlib.go:199:3:199:8 | target | provenance | |
6360
| stdlib.go:196:23:196:28 | target [postupdate] | stdlib.go:196:23:196:28 | implicit dereference | provenance | Config |
6461
| stdlib.go:196:23:196:28 | target [postupdate] | stdlib.go:198:23:198:28 | target | provenance | |
65-
| stdlib.go:196:23:196:28 | target [postupdate] | stdlib.go:199:3:199:8 | target | provenance | |
6662
| stdlib.go:198:23:198:28 | target | stdlib.go:198:23:198:42 | call to EscapedPath | provenance | Config Sink:MaD:1 |
67-
| stdlib.go:199:3:199:8 | implicit dereference | stdlib.go:199:3:199:8 | target [postupdate] | provenance | Config |
68-
| stdlib.go:199:3:199:8 | target | stdlib.go:199:3:199:8 | implicit dereference | provenance | Config |
69-
| stdlib.go:199:3:199:8 | target | stdlib.go:201:23:201:28 | target | provenance | |
70-
| stdlib.go:199:3:199:8 | target [postupdate] | stdlib.go:199:3:199:8 | implicit dereference | provenance | Config |
71-
| stdlib.go:199:3:199:8 | target [postupdate] | stdlib.go:201:23:201:28 | target | provenance | |
72-
| stdlib.go:201:23:201:28 | implicit dereference | stdlib.go:201:23:201:28 | target [postupdate] | provenance | Config |
73-
| stdlib.go:201:23:201:28 | implicit dereference | stdlib.go:201:23:201:33 | selection of Path | provenance | Config Sink:MaD:1 |
74-
| stdlib.go:201:23:201:28 | target | stdlib.go:201:23:201:28 | implicit dereference | provenance | Config |
75-
| stdlib.go:201:23:201:28 | target | stdlib.go:201:23:201:33 | selection of Path | provenance | Config Sink:MaD:1 |
76-
| stdlib.go:201:23:201:28 | target | stdlib.go:203:23:203:28 | target | provenance | |
77-
| stdlib.go:201:23:201:28 | target [postupdate] | stdlib.go:201:23:201:28 | implicit dereference | provenance | Config |
78-
| stdlib.go:201:23:201:28 | target [postupdate] | stdlib.go:203:23:203:28 | target | provenance | |
79-
| stdlib.go:203:23:203:28 | target | stdlib.go:203:23:203:37 | call to String | provenance | Config Sink:MaD:1 |
80-
| stdlib.go:210:3:210:3 | implicit dereference | stdlib.go:210:3:210:3 | u [postupdate] | provenance | Config |
8163
| stdlib.go:210:3:210:3 | implicit dereference [postupdate] | stdlib.go:210:3:210:3 | u [postupdate] | provenance | Config |
8264
| stdlib.go:210:3:210:3 | implicit dereference [postupdate] | stdlib.go:210:3:210:3 | u [postupdate] [pointer] | provenance | |
83-
| stdlib.go:210:3:210:3 | u [postupdate] | stdlib.go:210:3:210:3 | implicit dereference | provenance | Config |
8465
| stdlib.go:210:3:210:3 | u [postupdate] | stdlib.go:212:23:212:23 | u | provenance | |
8566
| stdlib.go:210:3:210:3 | u [postupdate] [pointer] | stdlib.go:212:23:212:23 | u [pointer] | provenance | |
8667
| stdlib.go:210:12:210:30 | call to FormValue | stdlib.go:210:3:210:3 | implicit dereference [postupdate] | provenance | Src:MaD:3 Config |
@@ -155,16 +136,6 @@ nodes
155136
| stdlib.go:196:23:196:33 | selection of Path | semmle.label | selection of Path |
156137
| stdlib.go:198:23:198:28 | target | semmle.label | target |
157138
| stdlib.go:198:23:198:42 | call to EscapedPath | semmle.label | call to EscapedPath |
158-
| stdlib.go:199:3:199:8 | implicit dereference | semmle.label | implicit dereference |
159-
| stdlib.go:199:3:199:8 | target | semmle.label | target |
160-
| stdlib.go:199:3:199:8 | target [postupdate] | semmle.label | target [postupdate] |
161-
| stdlib.go:201:23:201:28 | implicit dereference | semmle.label | implicit dereference |
162-
| stdlib.go:201:23:201:28 | target | semmle.label | target |
163-
| stdlib.go:201:23:201:28 | target [postupdate] | semmle.label | target [postupdate] |
164-
| stdlib.go:201:23:201:33 | selection of Path | semmle.label | selection of Path |
165-
| stdlib.go:203:23:203:28 | target | semmle.label | target |
166-
| stdlib.go:203:23:203:37 | call to String | semmle.label | call to String |
167-
| stdlib.go:210:3:210:3 | implicit dereference | semmle.label | implicit dereference |
168139
| stdlib.go:210:3:210:3 | implicit dereference [postupdate] | semmle.label | implicit dereference [postupdate] |
169140
| stdlib.go:210:3:210:3 | u [postupdate] | semmle.label | u [postupdate] |
170141
| stdlib.go:210:3:210:3 | u [postupdate] [pointer] | semmle.label | u [postupdate] [pointer] |
@@ -177,6 +148,3 @@ nodes
177148
| stdlib.go:214:23:214:23 | u | semmle.label | u |
178149
| stdlib.go:214:23:214:32 | call to String | semmle.label | call to String |
179150
subpaths
180-
testFailures
181-
| stdlib.go:201:23:201:33 | selection of Path | Fixed missing result: Alert |
182-
| stdlib.go:203:23:203:37 | call to String | Unexpected result: Alert |

0 commit comments

Comments
 (0)