Go/SSRF

d10c · d10c · commit c9ece38edd48 · 2025-10-15T14:41:36.000+02:00
go/ql/src/experimental/CWE-918/SSRF.ql
diff --git a/go/ql/src/experimental/CWE-918/SSRF.qll b/go/ql/src/experimental/CWE-918/SSRF.qll
@@ -33,9 +33,9 @@ module ServerSideRequestForgery {
 
     predicate observeDiffInformedIncrementalMode() { any() }
 
-    Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
     Location getASelectedSinkLocation(DataFlow::Node sink) {
+      result = sink.(Sink).getLocation()
+      or
       result = sink.(Sink).getARequest().getLocation()
     }
   }

Original file line number	Diff line number	Diff line change
`@@ -33,9 +33,9 @@ module ServerSideRequestForgery {`
`33`	`33`
`34`	`34`	`predicate observeDiffInformedIncrementalMode() { any() }`
`35`	`35`
`36`		`- Location getASelectedSourceLocation(DataFlow::Node source) { none() }`
`37`		`-`
`38`	`36`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`37`	`+ result = sink.(Sink).getLocation()`
	`38`	`+ or`
`39`	`39`	`result = sink.(Sink).getARequest().getLocation()`
`40`	`40`	`}`
`41`	`41`	`}`