Skip to content

Commit a4b701d

Browse files
author
Sauyon Lee
authored
Merge pull request #480 from sauyon/go116
Add preliminary support for go 1.16
2 parents 7e37c2b + 17cd04c commit a4b701d

File tree

21 files changed

+340
-21
lines changed

21 files changed

+340
-21
lines changed

‎.github/workflows/codeqltest.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ jobs:
77
runs-on: ubuntu-latest
88
steps:
99

10-
- name: Set up Go 1.14
10+
- name: Set up Go 1.16
1111
uses: actions/setup-go@v1
1212
with:
13-
go-version: 1.14
13+
go-version: 1.16
1414
id: go
1515

1616
- name: Set up CodeQL CLI
@@ -52,10 +52,10 @@ jobs:
5252
name: Test MacOS
5353
runs-on: macOS-latest
5454
steps:
55-
- name: Set up Go 1.14
55+
- name: Set up Go 1.16
5656
uses: actions/setup-go@v1
5757
with:
58-
go-version: 1.14
58+
go-version: 1.16
5959
id: go
6060

6161
- name: Set up CodeQL CLI
@@ -85,10 +85,10 @@ jobs:
8585
name: Test Windows
8686
runs-on: windows-latest
8787
steps:
88-
- name: Set up Go 1.14
88+
- name: Set up Go 1.16
8989
uses: actions/setup-go@v1
9090
with:
91-
go-version: 1.14
91+
go-version: 1.16
9292
id: go
9393

9494
- name: Set up CodeQL CLI

‎Makefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,8 @@ ql/src/go.dbscheme.stats: ql/src/go.dbscheme build/stats/src.stamp extractor
115115

116116
test: all build/testdb/check-upgrade-path
117117
codeql test run ql/test --search-path . --consistency-queries ql/test/consistency
118-
env GOARCH=386 codeql$(EXE) test run ql/test/query-tests/Security/CWE-681 --search-path . --consistency-queries ql/test/consistency
118+
# use GOOS=linux because GOOS=darwin GOARCH=386 is no longer supported
119+
env GOOS=linux GOARCH=386 codeql$(EXE) test run ql/test/query-tests/Security/CWE-681 --search-path . --consistency-queries ql/test/consistency
119120
cd extractor; go test -mod=vendor ./... | grep -vF "[no test files]"
120121

121122
.PHONY: build/testdb/check-upgrade-path

‎change-notes/2021-02-18-go-116.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The extractor now supports Go 1.16 and the new `io/fs` library that was introduced.

‎extractor/cli/go-autobuilder/go-autobuilder.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -549,10 +549,13 @@ func main() {
549549
install = exec.Command("glide", "install")
550550
log.Println("Installing dependencies using `glide install`")
551551
} else {
552+
// explicitly set go module support
552553
if depMode == GoGetWithModules {
553-
// enable go modules if used
554554
os.Setenv("GO111MODULE", "on")
555+
} else if depMode == GoGetNoModules {
556+
os.Setenv("GO111MODULE", "off")
555557
}
558+
556559
// get dependencies
557560
install = exec.Command("go", "get", "-v", "./...")
558561
log.Println("Installing dependencies using `go get -v ./...`.")

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/github/codeql-go
22

3-
go 1.14
3+
go 1.16
44

55
require (
66
golang.org/x/mod v0.3.0

‎ql/src/semmle/go/frameworks/Stdlib.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ import semmle.go.frameworks.stdlib.Fmt
4040
import semmle.go.frameworks.stdlib.Html
4141
import semmle.go.frameworks.stdlib.HtmlTemplate
4242
import semmle.go.frameworks.stdlib.Io
43+
import semmle.go.frameworks.stdlib.IoFs
4344
import semmle.go.frameworks.stdlib.IoIoutil
4445
import semmle.go.frameworks.stdlib.Log
4546
import semmle.go.frameworks.stdlib.Mime

‎ql/src/semmle/go/frameworks/stdlib/Io.qll‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,14 @@ module Io {
6161
// signature: func WriteString(w Writer, s string) (n int, err error)
6262
hasQualifiedName("io", "WriteString") and
6363
(inp.isParameter(1) and outp.isParameter(0))
64+
or
65+
// signature: func NopCloser(r io.Reader) io.ReadCloser
66+
hasQualifiedName("io", "NopCloser") and
67+
(inp.isParameter(0) and outp.isResult())
68+
or
69+
// signature: func ReadAll(r io.Reader) ([]byte, error)
70+
hasQualifiedName("io", "ReadAll") and
71+
(inp.isParameter(0) and outp.isResult(0))
6472
}
6573

6674
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎ql/src/semmle/go/frameworks/stdlib/IoFs.qll‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the 'io/fs' package.
3+
*/
4+
5+
import go
6+
7+
/**
8+
* Provides classes modeling security-relevant aspects of the 'io/fs' package.
9+
*/
10+
module IoFs {
11+
/** Gets the package name `io/fs`. */
12+
string packagePath() { result = "io/fs" }
13+
14+
private class FunctionModels extends TaintTracking::FunctionModel {
15+
FunctionInput inp;
16+
FunctionOutput outp;
17+
18+
FunctionModels() {
19+
//signature: func Glob(fsys FS, pattern string) (matches []string, err error)
20+
this.hasQualifiedName(packagePath(), "Glob") and
21+
(inp.isParameter(0) and outp.isResult(0))
22+
or
23+
//signature: func ReadFile(fsys FS, name string) ([]byte, error)
24+
this.hasQualifiedName(packagePath(), "ReadFile") and
25+
(inp.isParameter(0) and outp.isResult(0))
26+
or
27+
//signature: func ReadDir(fsys FS, name string) ([]DirEntry, error)
28+
this.hasQualifiedName(packagePath(), "ReadDir") and
29+
(inp.isParameter(0) and outp.isResult(0))
30+
or
31+
//signature: func Sub(fsys FS, dir string) (FS, error)
32+
this.hasQualifiedName(packagePath(), "Sub") and
33+
(inp.isParameter(0) and outp.isResult(0))
34+
}
35+
36+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
37+
input = inp and output = outp
38+
}
39+
}
40+
41+
/**
42+
* Models a step from `fs` to `path` and `d` in
43+
* `fs.WalkDir(fs, "root", func(path string, d DirEntry, err error) {}`
44+
*/
45+
private class WalkDirStep extends TaintTracking::AdditionalTaintStep {
46+
override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
47+
//signature: func WalkDir(fsys FS, root string, fn WalkDirFunc) error
48+
exists(DataFlow::CallNode call, DataFlow::FunctionNode f |
49+
call.getTarget().hasQualifiedName(packagePath(), "WalkDir") and
50+
f.getASuccessor*() = call.getArgument(2)
51+
|
52+
pred = call.getArgument(0) and
53+
succ = f.getParameter([0, 1])
54+
)
55+
}
56+
}
57+
58+
private class MethodModels extends TaintTracking::FunctionModel, Method {
59+
FunctionInput inp;
60+
FunctionOutput outp;
61+
62+
MethodModels() {
63+
//signature: func (DirEntry).Name() string
64+
this.implements(packagePath(), "DirEntry", "Name") and
65+
(inp.isReceiver() and outp.isResult())
66+
or
67+
//signature: func (DirEntry).Info() (FileInfo, error)
68+
this.implements(packagePath(), "DirEntry", "Info") and
69+
(inp.isReceiver() and outp.isResult(0))
70+
or
71+
//signature: func (FS).Open(name string) (File, error)
72+
this.implements(packagePath(), "FS", "Open") and
73+
(inp.isReceiver() and outp.isResult(0))
74+
or
75+
//signature: func (GlobFS).Glob(pattern string) ([]string, error)
76+
this.implements(packagePath(), "GlobFS", "Glob") and
77+
(inp.isReceiver() and outp.isResult(0))
78+
or
79+
//signature: func (ReadDirFS).ReadDir(name string) ([]DirEntry, error)
80+
this.implements(packagePath(), "ReadDirFS", "ReadDir") and
81+
(inp.isReceiver() and outp.isResult(0))
82+
or
83+
//signature: func (ReadFileFS).ReadFile(name string) ([]byte, error)
84+
this.implements(packagePath(), "ReadFileFS", "ReadFile") and
85+
(inp.isReceiver() and outp.isResult(0))
86+
or
87+
//signature: func (SubFS).Sub(dir string) (FS, error)
88+
this.implements(packagePath(), "SubFS", "Sub") and
89+
(inp.isReceiver() and outp.isResult(0))
90+
or
91+
//signature: func (File).Read([]byte) (int, error)
92+
this.implements(packagePath(), "File", "Read") and
93+
(inp.isReceiver() and outp.isParameter(0))
94+
}
95+
96+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
97+
input = inp and output = outp
98+
}
99+
}
100+
}

‎ql/src/semmle/go/frameworks/stdlib/Os.qll‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,18 @@ module Os {
5353
fn = "Symlink" and pathidx in [0 .. 1]
5454
or
5555
fn = "Truncate" and pathidx = 0
56+
or
57+
fn = "DirFS" and pathidx = 0
58+
or
59+
fn = "ReadDir" and pathidx = 0
60+
or
61+
fn = "ReadFile" and pathidx = 0
62+
or
63+
fn = "MkdirTemp" and pathidx in [0 .. 1]
64+
or
65+
fn = "CreateTemp" and pathidx in [0 .. 1]
66+
or
67+
fn = "WriteFile" and pathidx = 0
5668
)
5769
}
5870

‎ql/src/semmle/go/security/StoredXssCustomizations.qll‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,13 @@ module StoredXss {
4242
class FileNameSource extends Source {
4343
FileNameSource() {
4444
// the second parameter to a filepath.Walk function
45-
exists(DataFlow::ParameterNode prm, DataFlow::FunctionNode f, DataFlow::CallNode walkCall |
46-
prm = this and
47-
f.getParameter(0) = prm
48-
|
49-
walkCall.getTarget().hasQualifiedName("path/filepath", "Walk") and
50-
walkCall.getArgument(1) = f.getASuccessor*()
45+
exists(DataFlow::FunctionNode f, Function walkFn | this = f.getParameter(0) |
46+
walkFn.hasQualifiedName("path/filepath", ["Walk", "WalkDir"]) and
47+
walkFn.getACall().getArgument(1) = f.getASuccessor*()
5148
)
5249
or
5350
// A call to os.FileInfo.Name
54-
exists(Method m | m.implements("os", "FileInfo", "Name") |
51+
exists(Method m | m.implements("io/fs", "FileInfo", "Name") |
5552
m = this.(DataFlow::CallNode).getTarget()
5653
)
5754
}

0 commit comments

Comments
 (0)