github / github/codeql

General issue Go. Why isn't the following code recognized as a source in a global data stream?

Abierto
#19,807 4 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

Why isn't the following code recognized as a source in a global data stream? If I want to identify this source in the global data stream, how should I write my QL?

Here's the code context:

```
//router.go
func RegisterServers(group *gin.RouterGroup) {
group.POST("/abc/test", val.Validate[*param.TestParam], controller.TestReadFile)
}
```

```
//controller.go
func TestReadFile(c *gin.Context) {
req := val.Get[*param.TestParam](c)
cleanPath := req.Path
file, err := os.Open(cleanPath)
if err != nil {
if os.IsNotExist(err) {
c.JSON(http.StatusNotFound, gin.H{"error": "file not found"})
} else {
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to open file"})
}
return
}
......
}
```

```
//validator.go
package val
func Validate[T any](ctx *gin.Context) {
var req T
if err := ctx.ShouldBindJSON(&req); err != nil {
ctx.JSON(http.StatusBadRequest, gin.H{"code": constant.UnknownErrorCode, "msg": util.GetErrorText(constant.UnknownErrorCode)})
ctx.Abort()
return
}
ctx.Set("params", req)
ctx.Next()
}

func Get[T any](ctx *gin.Context) T {
return ctx.MustGet("params").(T)
}
```

```
//param.go
package param

type TestParam struct {
Path string `json:"filepath"`
}
```

I found that the default "ActiveThreatModelSource" in the official rule "TainterPath.ql" is not recognizable as a source by the above code.
Here's the code I wrote to try to add a new class about this kind of source, and I use "req" from "req.Path" as the source, although the result can be recognized when "Quick Evaluation" is used, but when it is run in the whole "TaintTracking::Global", it cannot be recognized that there is a problem with this "controller.go".
![Image](https://github.com/user-attachments/assets/608867b9-e792-428a-8125-74acc3b92ccc)
```
class GinContextGetSource extends DataFlow::Node {
GinContextGetSource() {
exists(Function asmGet, CallExpr call |
asmGet.hasQualifiedName("project/router/val", "Get")
and call.getTarget() = asmGet
and call.getEnclosingFunction() = this.asExpr().getEnclosingFunction()
and this.asExpr().toString() = "req"
and this.asExpr().getEnclosingFunction().getAParameter().toString() = "c"
)
}
}
```

I need to address this issue urgently. Because the routing and controller parts of the entire Gin project that I am currently responsible for are developed in this form, the global data flow in each of my official rules cannot be identified in any of the sources
Thank you so much!

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Comienza comparando el flujo de la fuente en router.go, controller.go, validator.go y param.go con la ActiveThreatModelSource predeterminada de TainterPath.ql. Reproduce la diferencia entre Quick Evaluation y TaintTracking::Global y, después, inspecciona la consulta personalizada GinContextGetSource y sus referencias a val.Get, req y c. Se considera terminado cuando la fuente prevista se reconoce en el flujo de datos global.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
go
Área
devtools, security
Tipo de issue
Error
Dificultad
5/5
Tiempo estimado
Más de una semana
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
25/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.