Skip to content

Commit f1b6920

Browse files
owen-mcowen-mc
committed
First attempt
1 parent 8d456df commit f1b6920

200 files changed

Lines changed: 959 additions & 833 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎go/ql/test/experimental/CWE-090/LDAPInjection.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -54,31 +54,31 @@ func main() {}
5454
// bad is an example of a bad implementation
5555
func (ld *Ldap) bad(req *http.Request) {
5656
// ...
57-
untrusted := req.UserAgent()
57+
untrusted := req.UserAgent() // $ Source[go/ldap-injection]
5858
goldap.NewSearchRequest(
59-
untrusted, // BAD: untrusted dn
59+
untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted dn
6060
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
61-
"(&(objectClass=organizationalPerson))"+untrusted, // BAD: untrusted filter
62-
[]string{"dn", "cn", untrusted}, // BAD: untrusted attribute
61+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted filter
62+
[]string{"dn", "cn", untrusted}, // $ Alert[go/ldap-injection] // BAD: untrusted attribute
6363
nil,
6464
)
6565
goldapv3.NewSearchRequest(
66-
untrusted, // BAD: untrusted dn
66+
untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted dn
6767
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
68-
"(&(objectClass=organizationalPerson))"+untrusted, // BAD: untrusted filter
69-
[]string{"dn", "cn", untrusted}, // BAD: untrusted attribute
68+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted filter
69+
[]string{"dn", "cn", untrusted}, // $ Alert[go/ldap-injection] // BAD: untrusted attribute
7070
nil,
7171
)
7272
gopkgldapv2.NewSearchRequest(
73-
untrusted, // BAD: untrusted dn
73+
untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted dn
7474
goldap.ScopeWholeSubtree, goldap.NeverDerefAliases, 0, 0, false,
75-
"(&(objectClass=organizationalPerson))"+untrusted, // BAD: untrusted filter
76-
[]string{"dn", "cn", untrusted}, // BAD: untrusted attribute
75+
"(&(objectClass=organizationalPerson))"+untrusted, // $ Alert[go/ldap-injection] // BAD: untrusted filter
76+
[]string{"dn", "cn", untrusted}, // $ Alert[go/ldap-injection] // BAD: untrusted attribute
7777
nil,
7878
)
7979
client := &ldapclient.LDAPClient{}
80-
client.Authenticate(untrusted, "123456") // BAD: untrusted filter
81-
client.GetGroupsOfUser(untrusted) // BAD: untrusted filter
80+
client.Authenticate(untrusted, "123456") // $ Alert[go/ldap-injection] // BAD: untrusted filter
81+
client.GetGroupsOfUser(untrusted) // $ Alert[go/ldap-injection] // BAD: untrusted filter
8282
// ...
8383
}
8484

‎go/ql/test/experimental/CWE-090/LDAPInjection.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: experimental/CWE-090/LDAPInjection.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-203/Timing.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: experimental/CWE-203/Timing.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-203/timing.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
1212
secret := "MySuperSecretPasscode"
1313
secretHeader := "X-Secret"
1414

15-
headerSecret := req.Header.Get(secretHeader)
15+
headerSecret := req.Header.Get(secretHeader) // $ Source[go/timing-attack]
1616
secretStr := string(secret)
17-
if len(headerSecret) != 0 && headerSecret != secretStr {
17+
if len(headerSecret) != 0 && headerSecret != secretStr { // $ Alert[go/timing-attack]
1818
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
1919
}
2020
return nil, nil
@@ -25,9 +25,9 @@ func bad2(w http.ResponseWriter, req *http.Request) (interface{}, error) {
2525
secret := "MySuperSecretPasscode"
2626
secretHeader := "X-Secret"
2727

28-
headerSecret := req.Header.Get(secretHeader)
28+
headerSecret := req.Header.Get(secretHeader) // $ Source[go/timing-attack]
2929
secretStr := string(secret)
30-
if len(headerSecret) != 0 && strings.Compare(headerSecret, secretStr) != 0 {
30+
if len(headerSecret) != 0 && strings.Compare(headerSecret, secretStr) != 0 { // $ Alert[go/timing-attack]
3131
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
3232
}
3333
return nil, nil
@@ -38,8 +38,8 @@ func bad4(w http.ResponseWriter, req *http.Request) (interface{}, error) {
3838
secret := "MySuperSecretPasscode"
3939
secretHeader := "X-Secret"
4040

41-
headerSecret := req.Header.Get(secretHeader)
42-
if len(secret) != 0 && headerSecret != "SecretStringLiteral" {
41+
headerSecret := req.Header.Get(secretHeader) // $ Source[go/timing-attack]
42+
if len(secret) != 0 && headerSecret != "SecretStringLiteral" { // $ Alert[go/timing-attack]
4343
return nil, fmt.Errorf("header %s=%s did not match expected secret", secretHeader, headerSecret)
4444
}
4545
return nil, nil

‎go/ql/test/experimental/CWE-285/PamAuthBypass.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
1-
experimental/CWE-285/PamAuthBypass.ql
1+
query: experimental/CWE-285/PamAuthBypass.ql
2+
postprocess:
3+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-285/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
func bad() error {
1010
t, _ := pam.StartFunc("", "", func(s pam.Style, msg string) (string, error) {
1111
return "", nil
12-
})
12+
}) // $ Alert[go/pam-auth-bypass]
1313
return t.Authenticate(0)
1414

1515
}

‎go/ql/test/experimental/CWE-287/ImproperLdapAuth.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
1515
ldapServer := "ldap.example.com"
1616
ldapPort := 389
1717
bindDN := "cn=admin,dc=example,dc=com"
18-
bindPassword := req.URL.Query()["password"][0]
18+
bindPassword := req.URL.Query()["password"][0] // $ Source[go/improper-ldap-auth]
1919

2020
// Connect to the LDAP server
2121
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ldapServer, ldapPort))
@@ -25,7 +25,7 @@ func bad(w http.ResponseWriter, req *http.Request) (interface{}, error) {
2525
defer l.Close()
2626

2727
// BAD: user input is not sanetized
28-
err = l.Bind(bindDN, bindPassword)
28+
err = l.Bind(bindDN, bindPassword) // $ Alert[go/improper-ldap-auth]
2929
if err != nil {
3030
return fmt.Errorf("LDAP bind failed: %v", err), err
3131
}
@@ -84,7 +84,7 @@ func bad2(req *http.Request) {
8484
ldapPort := 389
8585
bindDN := "cn=admin,dc=example,dc=com"
8686
// BAD : empty password
87-
bindPassword := ""
87+
bindPassword := "" // $ Source[go/improper-ldap-auth]
8888

8989
// Connect to the LDAP server
9090
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ldapServer, ldapPort))
@@ -94,7 +94,7 @@ func bad2(req *http.Request) {
9494
defer l.Close()
9595

9696
// BAD : bindPassword is empty
97-
err = l.Bind(bindDN, bindPassword)
97+
err = l.Bind(bindDN, bindPassword) // $ Alert[go/improper-ldap-auth]
9898
if err != nil {
9999
log.Fatalf("LDAP bind failed: %v", err)
100100
}

‎go/ql/test/experimental/CWE-287/ImproperLdapAuth.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
query: experimental/CWE-287/ImproperLdapAuth.ql
2-
postprocess: utils/test/PrettyPrintModels.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-321-V2/HardCodedKeys.qlref‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
1-
experimental/CWE-321-V2/HardCodedKeys.ql
1+
query: experimental/CWE-321-V2/HardCodedKeys.ql
2+
postprocess:
3+
- utils/test/InlineExpectationsTestQuery.ql

‎go/ql/test/experimental/CWE-321-V2/go-jose.v3.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
)
1111

1212
// NOT OK
13-
var JwtKey = []byte("AllYourBase")
13+
var JwtKey = []byte("AllYourBase") // $ Source[go/parse-jwt-with-hardcoded-key] Alert[go/parse-jwt-with-hardcoded-key]
1414

1515
func main2(r *http.Request) {
1616
signedToken := r.URL.Query().Get("signedToken")
@@ -21,7 +21,7 @@ func verifyJWT(signedToken string) {
2121
fmt.Println("verifying JWT")
2222
DecodedToken, _ := jwt.ParseSigned(signedToken)
2323
out := CustomerInfo{}
24-
if err := DecodedToken.Claims(JwtKey, &out); err != nil {
24+
if err := DecodedToken.Claims(JwtKey, &out); err != nil { // $ Alert[go/parse-jwt-with-hardcoded-key] Source[go/parse-jwt-with-hardcoded-key]
2525
panic(err)
2626
}
2727
fmt.Printf("%v\n", out)

0 commit comments

Comments
 (0)