@@ -2,7 +2,7 @@ Modeling data flow in Go libraries
2
2
==================================
3
3
4
4
When analyzing a Go program, CodeQL does not examine the source code for
5
- external packages. To track the flow of untrusted data through a library you
5
+ external packages. To track the flow of untrusted data through a library, you
6
6
can create a model of the library.
7
7
8
8
You can find existing models in the ``ql/src/semmle/go/frameworks/ `` folder of the
@@ -20,9 +20,9 @@ example from ``Mux.qll``.
20
20
21
21
.. code-block :: ql
22
22
23
- class RequestVars extends DataFlow::UntrustedFlowSource::Range, DataFlow::CallNode {
24
- RequestVars() { this.getTarget().hasQualifiedName("github.com/gorilla/mux", "Vars") }
25
- }
23
+ class RequestVars extends DataFlow::UntrustedFlowSource::Range, DataFlow::CallNode {
24
+ RequestVars() { this.getTarget().hasQualifiedName("github.com/gorilla/mux", "Vars") }
25
+ }
26
26
27
27
This has the effect that all calls to `the function Vars from the
28
28
package mux <http://www.gorillatoolkit.org/pkg/mux#Vars> `__ are
@@ -68,7 +68,7 @@ outputs to a function. The options are:
68
68
* one of the parameters (``outp.isParameter(i) ``)
69
69
* one of the results (``outp.isResult(i) ``, or ``outp.isResult `` if there is only one result)
70
70
71
- Here is an example from ``Gin.qll ``, slightly modified for brevity .
71
+ Here is an example from ``Gin.qll ``, which has been slightly simplified .
72
72
73
73
.. code-block :: ql
74
74
@@ -89,8 +89,8 @@ the receiver to the first result. In other words, if ``p`` has type
89
89
Sanitizers
90
90
----------
91
91
92
- It is not necessary to indicate that library functions are sanitizers -
93
- because their bodies are not analyzed it is assumed that data does not
92
+ It is not necessary to indicate that library functions are sanitizers.
93
+ Their bodies are not analyzed, so it is assumed that data does not
94
94
flow through them.
95
95
96
96
Sinks
@@ -101,13 +101,12 @@ However, you can use library models to indicate when functions belong to
101
101
special categories. Queries can then use these categories when specifying
102
102
sinks. Classes representing these special categories are contained in
103
103
``ql/src/semmle/go/Concepts.qll `` in the `CodeQL for Go repository
104
- <https://github.com/github/codeql-go/blob/main/ql/src/semmle/go/Concepts.qll> `__,
105
- including classes for logger mechanisms,
104
+ <https://github.com/github/codeql-go/blob/main/ql/src/semmle/go/Concepts.qll> `__.
105
+ `` Concepts.qll `` includes classes for logger mechanisms,
106
106
HTTP response writers, HTTP redirects, and marshaling and unmarshaling
107
107
functions.
108
108
109
- Here is a short example from ``Stdlib.qll ``, slightly modified for
110
- brevity.
109
+ Here is a short example from ``Stdlib.qll ``, which has been slightly simplified.
111
110
112
111
.. code-block :: ql
113
112
@@ -120,4 +119,4 @@ brevity.
120
119
This has the effect that any call to ``Print ``, ``Printf ``, or
121
120
``Println `` in the package ``fmt `` is recognized as a logger call.
122
121
Any query that uses logger calls as a sink will then identify when tainted data
123
- has been passed as an argument to ``Print ``, ``Printf ``, or ``Println ``.
122
+ has been passed as an argument to ``Print ``, ``Printf ``, or ``Println ``.
0 commit comments