Skip to content

Commit 2024747

Browse files
smowtonsmowton
committed
Add missing tests for html.Node taint propagators
The TaintTracking::FunctionModels for these appeared broken, so I suspect they had never worked.
1 parent 8f45673 commit 2024747

3 files changed

Lines changed: 70 additions & 0 deletions

File tree

‎go/ql/lib/ext/golang.org.x.net.html.model.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ extensions:
1111
- ["golang.org/x/net/html", "", False, "ParseWithOptions", "", "", "Argument[0]", "ReturnValue[0]", "taint", "manual"]
1212
- ["golang.org/x/net/html", "", False, "Render", "", "", "Argument[1]", "Argument[0]", "taint", "manual"]
1313
- ["golang.org/x/net/html", "", False, "UnescapeString", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
14+
- ["golang.org/x/net/html", "Node", True, "AppendChild", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
15+
- ["golang.org/x/net/html", "Node", True, "InsertBefore", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
1416
- ["golang.org/x/net/html", "Tokenizer", True, "Buffered", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
1517
- ["golang.org/x/net/html", "Tokenizer", True, "Raw", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
1618
- ["golang.org/x/net/html", "Tokenizer", True, "TagAttr", "", "", "Argument[-1]", "ReturnValue[1]", "taint", "manual"]

‎go/ql/test/library-tests/semmle/go/frameworks/XNetHtml/ReflectedXss.expected‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
edges
2+
| file://:0:0:0:0 | parameter 0 of AppendChild | file://:0:0:0:0 | [summary] to write: argument -1 in AppendChild |
3+
| file://:0:0:0:0 | parameter 0 of InsertBefore | file://:0:0:0:0 | [summary] to write: argument -1 in InsertBefore |
24
| file://:0:0:0:0 | parameter 0 of NewTokenizer | file://:0:0:0:0 | [summary] to write: return (return[0]) in NewTokenizer |
35
| file://:0:0:0:0 | parameter 0 of NewTokenizerFragment | file://:0:0:0:0 | [summary] to write: return (return[0]) in NewTokenizerFragment |
46
| file://:0:0:0:0 | parameter 0 of Parse | file://:0:0:0:0 | [summary] to write: return (return[0]) in Parse |
@@ -52,7 +54,39 @@ edges
5254
| test.go:38:49:38:60 | selection of Body | test.go:38:23:38:77 | call to NewTokenizerFragment |
5355
| test.go:39:15:39:31 | tokenizerFragment | file://:0:0:0:0 | parameter -1 of Buffered |
5456
| test.go:39:15:39:31 | tokenizerFragment | test.go:39:15:39:42 | call to Buffered |
57+
| test.go:41:6:41:14 | definition of cleanNode | test.go:44:22:44:31 | &... |
58+
| test.go:41:6:41:14 | definition of cleanNode | test.go:44:22:44:31 | &... |
59+
| test.go:41:6:41:14 | definition of cleanNode | test.go:44:23:44:31 | cleanNode |
60+
| test.go:42:2:42:43 | ... := ...[0] | test.go:43:24:43:34 | taintedNode |
61+
| test.go:42:31:42:42 | selection of Body | file://:0:0:0:0 | parameter 0 of Parse |
62+
| test.go:42:31:42:42 | selection of Body | test.go:42:2:42:43 | ... := ...[0] |
63+
| test.go:43:24:43:34 | taintedNode | file://:0:0:0:0 | parameter 0 of AppendChild |
64+
| test.go:43:24:43:34 | taintedNode | test.go:41:6:41:14 | definition of cleanNode |
65+
| test.go:44:22:44:31 | &... | test.go:44:22:44:31 | &... |
66+
| test.go:44:22:44:31 | &... | test.go:44:22:44:31 | &... |
67+
| test.go:44:22:44:31 | &... | test.go:44:23:44:31 | cleanNode |
68+
| test.go:44:22:44:31 | &... [pointer] | test.go:44:22:44:31 | &... |
69+
| test.go:44:22:44:31 | &... [pointer] | test.go:44:22:44:31 | &... |
70+
| test.go:44:22:44:31 | &... [pointer] | test.go:44:23:44:31 | cleanNode |
71+
| test.go:44:23:44:31 | cleanNode | test.go:44:22:44:31 | &... [pointer] |
72+
| test.go:46:6:46:15 | definition of cleanNode2 | test.go:49:22:49:32 | &... |
73+
| test.go:46:6:46:15 | definition of cleanNode2 | test.go:49:22:49:32 | &... |
74+
| test.go:46:6:46:15 | definition of cleanNode2 | test.go:49:23:49:32 | cleanNode2 |
75+
| test.go:47:2:47:44 | ... := ...[0] | test.go:48:26:48:37 | taintedNode2 |
76+
| test.go:47:32:47:43 | selection of Body | file://:0:0:0:0 | parameter 0 of Parse |
77+
| test.go:47:32:47:43 | selection of Body | test.go:47:2:47:44 | ... := ...[0] |
78+
| test.go:48:26:48:37 | taintedNode2 | file://:0:0:0:0 | parameter 0 of InsertBefore |
79+
| test.go:48:26:48:37 | taintedNode2 | test.go:46:6:46:15 | definition of cleanNode2 |
80+
| test.go:49:22:49:32 | &... | test.go:49:22:49:32 | &... |
81+
| test.go:49:22:49:32 | &... | test.go:49:22:49:32 | &... |
82+
| test.go:49:22:49:32 | &... | test.go:49:23:49:32 | cleanNode2 |
83+
| test.go:49:22:49:32 | &... [pointer] | test.go:49:22:49:32 | &... |
84+
| test.go:49:22:49:32 | &... [pointer] | test.go:49:22:49:32 | &... |
85+
| test.go:49:22:49:32 | &... [pointer] | test.go:49:23:49:32 | cleanNode2 |
86+
| test.go:49:23:49:32 | cleanNode2 | test.go:49:22:49:32 | &... [pointer] |
5587
nodes
88+
| file://:0:0:0:0 | [summary] to write: argument -1 in AppendChild | semmle.label | [summary] to write: argument -1 in AppendChild |
89+
| file://:0:0:0:0 | [summary] to write: argument -1 in InsertBefore | semmle.label | [summary] to write: argument -1 in InsertBefore |
5690
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Buffered | semmle.label | [summary] to write: return (return[0]) in Buffered |
5791
| file://:0:0:0:0 | [summary] to write: return (return[0]) in NewTokenizer | semmle.label | [summary] to write: return (return[0]) in NewTokenizer |
5892
| file://:0:0:0:0 | [summary] to write: return (return[0]) in NewTokenizerFragment | semmle.label | [summary] to write: return (return[0]) in NewTokenizerFragment |
@@ -65,6 +99,8 @@ nodes
6599
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Token | semmle.label | [summary] to write: return (return[0]) in Token |
66100
| file://:0:0:0:0 | [summary] to write: return (return[0]) in UnescapeString | semmle.label | [summary] to write: return (return[0]) in UnescapeString |
67101
| file://:0:0:0:0 | [summary] to write: return (return[1]) in TagAttr | semmle.label | [summary] to write: return (return[1]) in TagAttr |
102+
| file://:0:0:0:0 | parameter 0 of AppendChild | semmle.label | parameter 0 of AppendChild |
103+
| file://:0:0:0:0 | parameter 0 of InsertBefore | semmle.label | parameter 0 of InsertBefore |
68104
| file://:0:0:0:0 | parameter 0 of NewTokenizer | semmle.label | parameter 0 of NewTokenizer |
69105
| file://:0:0:0:0 | parameter 0 of NewTokenizerFragment | semmle.label | parameter 0 of NewTokenizerFragment |
70106
| file://:0:0:0:0 | parameter 0 of Parse | semmle.label | parameter 0 of Parse |
@@ -112,6 +148,22 @@ nodes
112148
| test.go:38:49:38:60 | selection of Body | semmle.label | selection of Body |
113149
| test.go:39:15:39:31 | tokenizerFragment | semmle.label | tokenizerFragment |
114150
| test.go:39:15:39:42 | call to Buffered | semmle.label | call to Buffered |
151+
| test.go:41:6:41:14 | definition of cleanNode | semmle.label | definition of cleanNode |
152+
| test.go:42:2:42:43 | ... := ...[0] | semmle.label | ... := ...[0] |
153+
| test.go:42:31:42:42 | selection of Body | semmle.label | selection of Body |
154+
| test.go:43:24:43:34 | taintedNode | semmle.label | taintedNode |
155+
| test.go:44:22:44:31 | &... | semmle.label | &... |
156+
| test.go:44:22:44:31 | &... | semmle.label | &... |
157+
| test.go:44:22:44:31 | &... [pointer] | semmle.label | &... [pointer] |
158+
| test.go:44:23:44:31 | cleanNode | semmle.label | cleanNode |
159+
| test.go:46:6:46:15 | definition of cleanNode2 | semmle.label | definition of cleanNode2 |
160+
| test.go:47:2:47:44 | ... := ...[0] | semmle.label | ... := ...[0] |
161+
| test.go:47:32:47:43 | selection of Body | semmle.label | selection of Body |
162+
| test.go:48:26:48:37 | taintedNode2 | semmle.label | taintedNode2 |
163+
| test.go:49:22:49:32 | &... | semmle.label | &... |
164+
| test.go:49:22:49:32 | &... | semmle.label | &... |
165+
| test.go:49:22:49:32 | &... [pointer] | semmle.label | &... [pointer] |
166+
| test.go:49:23:49:32 | cleanNode2 | semmle.label | cleanNode2 |
115167
subpaths
116168
| test.go:14:42:14:53 | selection of Value | file://:0:0:0:0 | parameter 0 of UnescapeString | file://:0:0:0:0 | [summary] to write: return (return[0]) in UnescapeString | test.go:14:22:14:54 | call to UnescapeString |
117169
| test.go:16:24:16:35 | selection of Body | file://:0:0:0:0 | parameter 0 of Parse | file://:0:0:0:0 | [summary] to write: return (return[0]) in Parse | test.go:16:2:16:36 | ... := ...[0] |
@@ -126,6 +178,10 @@ subpaths
126178
| test.go:36:22:36:30 | tokenizer | file://:0:0:0:0 | parameter -1 of Token | file://:0:0:0:0 | [summary] to write: return (return[0]) in Token | test.go:36:22:36:38 | call to Token |
127179
| test.go:38:49:38:60 | selection of Body | file://:0:0:0:0 | parameter 0 of NewTokenizerFragment | file://:0:0:0:0 | [summary] to write: return (return[0]) in NewTokenizerFragment | test.go:38:23:38:77 | call to NewTokenizerFragment |
128180
| test.go:39:15:39:31 | tokenizerFragment | file://:0:0:0:0 | parameter -1 of Buffered | file://:0:0:0:0 | [summary] to write: return (return[0]) in Buffered | test.go:39:15:39:42 | call to Buffered |
181+
| test.go:42:31:42:42 | selection of Body | file://:0:0:0:0 | parameter 0 of Parse | file://:0:0:0:0 | [summary] to write: return (return[0]) in Parse | test.go:42:2:42:43 | ... := ...[0] |
182+
| test.go:43:24:43:34 | taintedNode | file://:0:0:0:0 | parameter 0 of AppendChild | file://:0:0:0:0 | [summary] to write: argument -1 in AppendChild | test.go:41:6:41:14 | definition of cleanNode |
183+
| test.go:47:32:47:43 | selection of Body | file://:0:0:0:0 | parameter 0 of Parse | file://:0:0:0:0 | [summary] to write: return (return[0]) in Parse | test.go:47:2:47:44 | ... := ...[0] |
184+
| test.go:48:26:48:37 | taintedNode2 | file://:0:0:0:0 | parameter 0 of InsertBefore | file://:0:0:0:0 | [summary] to write: argument -1 in InsertBefore | test.go:46:6:46:15 | definition of cleanNode2 |
129185
#select
130186
| test.go:14:15:14:55 | type conversion | test.go:10:2:10:42 | ... := ...[0] | test.go:14:15:14:55 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:10:2:10:42 | ... := ...[0] | user-provided value | test.go:0:0:0:0 | test.go | |
131187
| test.go:17:15:17:31 | type conversion | test.go:16:24:16:35 | selection of Body | test.go:17:15:17:31 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:16:24:16:35 | selection of Body | user-provided value | test.go:0:0:0:0 | test.go | |
@@ -139,3 +195,5 @@ subpaths
139195
| test.go:35:15:35:30 | call to Text | test.go:30:33:30:44 | selection of Body | test.go:35:15:35:30 | call to Text | Cross-site scripting vulnerability due to $@. | test.go:30:33:30:44 | selection of Body | user-provided value | test.go:0:0:0:0 | test.go | |
140196
| test.go:36:15:36:44 | type conversion | test.go:30:33:30:44 | selection of Body | test.go:36:15:36:44 | type conversion | Cross-site scripting vulnerability due to $@. | test.go:30:33:30:44 | selection of Body | user-provided value | test.go:0:0:0:0 | test.go | |
141197
| test.go:39:15:39:42 | call to Buffered | test.go:38:49:38:60 | selection of Body | test.go:39:15:39:42 | call to Buffered | Cross-site scripting vulnerability due to $@. | test.go:38:49:38:60 | selection of Body | user-provided value | test.go:0:0:0:0 | test.go | |
198+
| test.go:44:22:44:31 | &... | test.go:42:31:42:42 | selection of Body | test.go:44:22:44:31 | &... | Cross-site scripting vulnerability due to $@. | test.go:42:31:42:42 | selection of Body | user-provided value | test.go:0:0:0:0 | test.go | |
199+
| test.go:49:22:49:32 | &... | test.go:47:32:47:43 | selection of Body | test.go:49:22:49:32 | &... | Cross-site scripting vulnerability due to $@. | test.go:47:32:47:43 | selection of Body | user-provided value | test.go:0:0:0:0 | test.go | |

‎go/ql/test/library-tests/semmle/go/frameworks/XNetHtml/test.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,14 @@ func test(request *http.Request, writer http.ResponseWriter) {
3838
tokenizerFragment := html.NewTokenizerFragment(request.Body, "some context")
3939
writer.Write(tokenizerFragment.Buffered()) // BAD: writing unescaped HTML data
4040

41+
var cleanNode html.Node
42+
taintedNode, _ := html.Parse(request.Body)
43+
cleanNode.AppendChild(taintedNode)
44+
html.Render(writer, &cleanNode) // BAD: writing unescaped HTML data
45+
46+
var cleanNode2 html.Node
47+
taintedNode2, _ := html.Parse(request.Body)
48+
cleanNode2.InsertBefore(taintedNode2, &cleanNode2)
49+
html.Render(writer, &cleanNode2) // BAD: writing unescaped HTML data
50+
4151
}

0 commit comments

Comments
 (0)