Merge pull request github#539 from gagliardetto/fiber

Add web framework: github.com/gofiber/fiber

Author: smowton

ql/src/experimental/frameworks/Fiber.json

@@ -0,0 +1,55 @@
+import go
+import TestUtilities.InlineExpectationsTest
+import experimental.frameworks.Fiber
+
+class HttpHeaderWriteTest extends InlineExpectationsTest {
+  HttpHeaderWriteTest() { this = "HttpHeaderWriteTest" }
+
+  override string getARelevantTag() {
+    result = ["headerKeyNode", "headerValNode", "headerKey", "headerVal"]
+  }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    // Dynamic key-value header:
+    exists(HTTP::HeaderWrite hw |
+      hw.hasLocationInfo(file, line, _, _, _) and
+      (
+        element = hw.getName().toString() and
+        value = hw.getName().toString() and
+        tag = "headerKeyNode"
+        or
+        element = hw.getValue().toString() and
+        value = hw.getValue().toString() and
+        tag = "headerValNode"
+      )
+    )
+    or
+    // Static key, dynamic value header:
+    exists(HTTP::HeaderWrite hw |
+      hw.hasLocationInfo(file, line, _, _, _) and
+      (
+        element = hw.getHeaderName().toString() and
+        value = hw.getHeaderName() and
+        tag = "headerKey"
+        or
+        element = hw.getValue().toString() and
+        value = hw.getValue().toString() and
+        tag = "headerValNode"
+      )
+    )
+    or
+    // Static key, static value header:
+    exists(HTTP::HeaderWrite hw |
+      hw.hasLocationInfo(file, line, _, _, _) and
+      (
+        element = hw.getHeaderName().toString() and
+        value = hw.getHeaderName() and
+        tag = "headerKey"
+        or
+        element = hw.getHeaderValue().toString() and
+        value = hw.getHeaderValue() and
+        tag = "headerVal"
+      )
+    )
+  }
+}

ql/src/experimental/frameworks/Fiber.qll

@@ -0,0 +1,18 @@
+import go
+import TestUtilities.InlineExpectationsTest
+import experimental.frameworks.Fiber
+
+class HttpRedirectTest extends InlineExpectationsTest {
+  HttpRedirectTest() { this = "HttpRedirectTest" }
+
+  override string getARelevantTag() { result = "redirectUrl" }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    tag = "redirectUrl" and
+    exists(HTTP::Redirect rd |
+      rd.hasLocationInfo(file, line, _, _, _) and
+      element = rd.getUrl().toString() and
+      value = rd.getUrl().toString()
+    )
+  }
+}

ql/test/experimental/frameworks/Fiber/HeaderWrite.expected

@@ -0,0 +1,24 @@
+import go
+import TestUtilities.InlineExpectationsTest
+import experimental.frameworks.Fiber
+
+class HttpResponseBodyTest extends InlineExpectationsTest {
+  HttpResponseBodyTest() { this = "HttpResponseBodyTest" }
+
+  override string getARelevantTag() { result = ["contentType", "responseBody"] }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    exists(HTTP::ResponseBody rd |
+      rd.hasLocationInfo(file, line, _, _, _) and
+      (
+        element = rd.getAContentType().toString() and
+        value = rd.getAContentType().toString() and
+        tag = "contentType"
+        or
+        element = rd.toString() and
+        value = rd.toString() and
+        tag = "responseBody"
+      )
+    )
+  }
+}

ql/test/experimental/frameworks/Fiber/HeaderWrite.go

@@ -0,0 +1,30 @@
+import go
+import TestUtilities.InlineExpectationsTest
+import experimental.frameworks.Fiber
+
+class Configuration extends TaintTracking::Configuration {
+  Configuration() { this = "test-configuration" }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(Function fn | fn.hasQualifiedName(_, "source") | source = fn.getACall().getResult())
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(Function fn | fn.hasQualifiedName(_, "sink") | sink = fn.getACall().getAnArgument())
+  }
+}
+
+class TaintTrackingTest extends InlineExpectationsTest {
+  TaintTrackingTest() { this = "TaintTrackingTest" }
+
+  override string getARelevantTag() { result = "taintSink" }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    tag = "taintSink" and
+    exists(DataFlow::Node sink | any(Configuration c).hasFlow(_, sink) |
+      element = sink.toString() and
+      value = "" and
+      sink.hasLocationInfo(file, line, _, _, _)
+    )
+  }
+}