Skip to content

Commit 37ce885

Browse files
owen-mcowen-mc
authored
Merge pull request #22064 from owen-mc/go/fix-test-failures
Go: fix tests with non-empty `testFailures`
2 parents 52acaec + ac618e1 commit 37ce885

4 files changed

Lines changed: 18 additions & 23 deletions

File tree

‎go/ql/lib/semmle/go/security/StoredXssCustomizations.qll‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,11 @@ module StoredXss {
3333
walkFn.getACall().getArgument(1) = f.getASuccessor*()
3434
)
3535
or
36-
// A call to os.FileInfo.Name
37-
exists(Method m | m.implements("io/fs", "FileInfo", "Name") |
38-
m = this.(DataFlow::CallNode).getTarget()
36+
// The return value of a call to `os.DirEntry.Name`, `os.FileInfo.Name`
37+
// or `os.File.ReadDirNames`.
38+
exists(DataFlow::CallNode cn, Method m | m = cn.getTarget() and this = cn.getResult(0) |
39+
m.implements("io/fs", ["DirEntry", "FileInfo"], "Name") or
40+
m.hasQualifiedName("os", "File", "ReadDirNames")
3941
)
4042
}
4143
}

‎go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -156,12 +156,3 @@ nodes
156156
| websocketXss.go:54:3:54:38 | ... := ...[1] | semmle.label | ... := ...[1] |
157157
| websocketXss.go:55:24:55:31 | gorilla3 | semmle.label | gorilla3 |
158158
subpaths
159-
testFailures
160-
| websocketXss.go:30:32:30:60 | comment | Missing result: Source[go/reflected-xss] |
161-
| websocketXss.go:31:11:31:14 | xnet [postupdate] | Unexpected result: Source |
162-
| websocketXss.go:34:30:34:58 | comment | Missing result: Source[go/reflected-xss] |
163-
| websocketXss.go:35:21:35:25 | xnet2 [postupdate] | Unexpected result: Source |
164-
| websocketXss.go:46:38:46:66 | comment | Missing result: Source[go/reflected-xss] |
165-
| websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | Unexpected result: Source |
166-
| websocketXss.go:50:33:50:61 | comment | Missing result: Source[go/reflected-xss] |
167-
| websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | Unexpected result: Source |

‎go/ql/test/query-tests/Security/CWE-079/StoredXss.expected‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,22 @@
11
#select
2+
| StoredXss.go:13:21:13:36 | ...+... | StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | Stored cross-site scripting vulnerability due to $@. | StoredXss.go:13:21:13:31 | call to Name | stored value |
23
| stored.go:30:22:30:25 | name | stored.go:18:3:18:28 | ... := ...[0] | stored.go:30:22:30:25 | name | Stored cross-site scripting vulnerability due to $@. | stored.go:18:3:18:28 | ... := ...[0] | stored value |
34
| stored.go:61:22:61:25 | path | stored.go:59:30:59:33 | SSA def(path) | stored.go:61:22:61:25 | path | Stored cross-site scripting vulnerability due to $@. | stored.go:59:30:59:33 | SSA def(path) | stored value |
45
edges
6+
| StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | provenance | |
57
| stored.go:18:3:18:28 | ... := ...[0] | stored.go:25:14:25:17 | rows | provenance | Src:MaD:1 |
68
| stored.go:25:14:25:17 | rows | stored.go:25:29:25:33 | &... [postupdate] | provenance | FunctionModel |
79
| stored.go:25:29:25:33 | &... [postupdate] | stored.go:30:22:30:25 | name | provenance | |
810
| stored.go:59:30:59:33 | SSA def(path) | stored.go:61:22:61:25 | path | provenance | |
911
models
1012
| 1 | Source: database/sql; DB; true; Query; ; ; ReturnValue[0]; database; manual |
1113
nodes
14+
| StoredXss.go:13:21:13:31 | call to Name | semmle.label | call to Name |
15+
| StoredXss.go:13:21:13:36 | ...+... | semmle.label | ...+... |
1216
| stored.go:18:3:18:28 | ... := ...[0] | semmle.label | ... := ...[0] |
1317
| stored.go:25:14:25:17 | rows | semmle.label | rows |
1418
| stored.go:25:29:25:33 | &... [postupdate] | semmle.label | &... [postupdate] |
1519
| stored.go:30:22:30:25 | name | semmle.label | name |
1620
| stored.go:59:30:59:33 | SSA def(path) | semmle.label | SSA def(path) |
1721
| stored.go:61:22:61:25 | path | semmle.label | path |
1822
subpaths
19-
testFailures
20-
| StoredXss.go:13:39:13:63 | comment | Missing result: Alert[go/stored-xss] |

‎go/ql/test/query-tests/Security/CWE-079/websocketXss.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,12 @@ func xss(w http.ResponseWriter, r *http.Request) {
2727
origin := "test"
2828
{
2929
ws, _ := websocket.Dial(uri, "", origin)
30-
var xnet = make([]byte, 512) // $ Source[go/reflected-xss]
31-
ws.Read(xnet)
30+
var xnet = make([]byte, 512)
31+
ws.Read(xnet) // $ Source[go/reflected-xss]
3232
fmt.Fprintf(w, "%v", xnet) // $ Alert[go/reflected-xss]
3333
codec := &websocket.Codec{Marshal: marshal, Unmarshal: unmarshal}
34-
xnet2 := make([]byte, 512) // $ Source[go/reflected-xss]
35-
codec.Receive(ws, xnet2)
34+
xnet2 := make([]byte, 512)
35+
codec.Receive(ws, xnet2) // $ Source[go/reflected-xss]
3636
fmt.Fprintf(w, "%v", xnet2) // $ Alert[go/reflected-xss]
3737
}
3838
{
@@ -43,12 +43,12 @@ func xss(w http.ResponseWriter, r *http.Request) {
4343
{
4444
dialer := gorilla.Dialer{}
4545
conn, _, _ := dialer.Dial(uri, nil)
46-
var gorillaMsg = make([]byte, 512) // $ Source[go/reflected-xss]
47-
gorilla.ReadJSON(conn, gorillaMsg)
48-
fmt.Fprintf(w, "%v", gorillaMsg) // $ Alert[go/reflected-xss]
46+
var gorillaMsg = make([]byte, 512)
47+
gorilla.ReadJSON(conn, gorillaMsg) // $ Source[go/reflected-xss]
48+
fmt.Fprintf(w, "%v", gorillaMsg) // $ Alert[go/reflected-xss]
4949

50-
gorilla2 := make([]byte, 512) // $ Source[go/reflected-xss]
51-
conn.ReadJSON(gorilla2)
50+
gorilla2 := make([]byte, 512)
51+
conn.ReadJSON(gorilla2) // $ Source[go/reflected-xss]
5252
fmt.Fprintf(w, "%v", gorilla2) // $ Alert[go/reflected-xss]
5353

5454
_, gorilla3, _ := conn.ReadMessage() // $ Source[go/reflected-xss]

0 commit comments

Comments
 (0)