github / github/codeql

Go: Tainted data does not propagate data flow after append function

オープン
#14,116 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

Go: v1.19.1 linux/amd64
CodeQL: v2.11.0

Question: Query the data flow results from the `input` parameter in the `source` function to the `name` parameter in the `sink` function.

```go
package main

import (
"fmt"
)

type info struct {
name string
}
func main() {
source("input")
}

func source(input string) {
var data []info
data = append(data, info{
name: input,
})
dao(data)

}

func dao(data []info) {
for _, item := range data {
name := item.name
sink(name)
}
}

func sink(name string) {
fmt.Println(name)
}

```

The following is my query statement. After execution, I did not get the expected results.

append_struct_result

```codeql
/**
* @kind path-problem
*/

import go
import DataFlow::PathGraph

class Configuration extends TaintTracking::Configuration {
Configuration() { this = "Configuration" }

override predicate isSource(DataFlow::Node source) {
exists(Function func | func.getName() = "source" | func.getParameter(0) = source.asParameter())
}

override predicate isSink(DataFlow::Node sink) {
exists(DataFlow::CallNode call | call.getTarget().getName() = "sink" |
call.getArgument(0) = sink
)
}
}

from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Source: $@ , Sink: $@ .", source.getNode(), source.toString(),
sink.getNode(), sink.toString()
```

When I debug using `DataFlow::PartialPathGraph`, it seems that the tainted data does not propagate the data flow after passing through the `append` function.

append_struct_partial

```codeql
/**
* @kind path-problem
*/

import go
import DataFlow::PartialPathGraph

class Configuration extends TaintTracking::Configuration {
Configuration() { this = "Configuration" }

override predicate isSource(DataFlow::Node source) {
exists(Function func | func.getName() = "source" | func.getParameter(0) = source.asParameter())
}

override predicate isSink(DataFlow::Node sink) {
exists(DataFlow::CallNode call | call.getTarget().getName() = "sink" |
call.getArgument(0) = sink
)
}

override int explorationLimit() { result = 5 }
}

from Configuration cfg, DataFlow::PartialPathNode source, DataFlow::PartialPathNode sink
where cfg.hasPartialFlow(source, sink, _)
select sink.getNode(), source, sink, "Source: $@ , Sink: $@ .", source.getNode(), source.toString(), sink.getNode(), sink.toString()
```

How to solve this problem?

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。