Skip to content

Commit aa9cf16

Browse files
owen-mcowen-mc
committed
Use new import path in test
1 parent 1d24db1 commit aa9cf16

6 files changed

Lines changed: 154 additions & 43 deletions

File tree

‎go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected‎

Lines changed: 47 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -13,25 +13,26 @@
1313
| reflectedxsstest.go:54:11:54:21 | type conversion | reflectedxsstest.go:51:14:51:18 | selection of URL | reflectedxsstest.go:54:11:54:21 | type conversion | Cross-site scripting vulnerability due to $@. | reflectedxsstest.go:51:14:51:18 | selection of URL | user-provided value | reflectedxsstest.go:0:0:0:0 | reflectedxsstest.go | |
1414
| tst.go:18:12:18:39 | type conversion | tst.go:14:15:14:20 | selection of Form | tst.go:18:12:18:39 | type conversion | Cross-site scripting vulnerability due to $@. | tst.go:14:15:14:20 | selection of Form | user-provided value | tst.go:0:0:0:0 | tst.go | |
1515
| tst.go:53:12:53:26 | type conversion | tst.go:48:14:48:19 | selection of Form | tst.go:53:12:53:26 | type conversion | Cross-site scripting vulnerability due to $@. | tst.go:48:14:48:19 | selection of Form | user-provided value | tst.go:0:0:0:0 | tst.go | |
16-
| websocketXss.go:32:24:32:27 | xnet | websocketXss.go:31:11:31:14 | xnet [postupdate] | websocketXss.go:32:24:32:27 | xnet | Cross-site scripting vulnerability due to $@. | websocketXss.go:31:11:31:14 | xnet [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
17-
| websocketXss.go:36:24:36:28 | xnet2 | websocketXss.go:35:21:35:25 | xnet2 [postupdate] | websocketXss.go:36:24:36:28 | xnet2 | Cross-site scripting vulnerability due to $@. | websocketXss.go:35:21:35:25 | xnet2 [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
18-
| websocketXss.go:41:24:41:29 | nhooyr | websocketXss.go:40:3:40:40 | extract:1 ... := ... | websocketXss.go:41:24:41:29 | nhooyr | Cross-site scripting vulnerability due to $@. | websocketXss.go:40:3:40:40 | extract:1 ... := ... | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
19-
| websocketXss.go:48:24:48:33 | gorillaMsg | websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | websocketXss.go:48:24:48:33 | gorillaMsg | Cross-site scripting vulnerability due to $@. | websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
20-
| websocketXss.go:52:24:52:31 | gorilla2 | websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | websocketXss.go:52:24:52:31 | gorilla2 | Cross-site scripting vulnerability due to $@. | websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
21-
| websocketXss.go:55:24:55:31 | gorilla3 | websocketXss.go:54:3:54:38 | extract:1 ... := ... | websocketXss.go:55:24:55:31 | gorilla3 | Cross-site scripting vulnerability due to $@. | websocketXss.go:54:3:54:38 | extract:1 ... := ... | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
16+
| websocketXss.go:33:24:33:27 | xnet | websocketXss.go:32:11:32:14 | xnet [postupdate] | websocketXss.go:33:24:33:27 | xnet | Cross-site scripting vulnerability due to $@. | websocketXss.go:32:11:32:14 | xnet [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
17+
| websocketXss.go:37:24:37:28 | xnet2 | websocketXss.go:36:21:36:25 | xnet2 [postupdate] | websocketXss.go:37:24:37:28 | xnet2 | Cross-site scripting vulnerability due to $@. | websocketXss.go:36:21:36:25 | xnet2 [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
18+
| websocketXss.go:42:24:42:29 | nhooyr | websocketXss.go:41:3:41:40 | extract:1 ... := ... | websocketXss.go:42:24:42:29 | nhooyr | Cross-site scripting vulnerability due to $@. | websocketXss.go:41:3:41:40 | extract:1 ... := ... | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
19+
| websocketXss.go:47:24:47:31 | coderMsg | websocketXss.go:46:3:46:42 | extract:1 ... := ... | websocketXss.go:47:24:47:31 | coderMsg | Cross-site scripting vulnerability due to $@. | websocketXss.go:46:3:46:42 | extract:1 ... := ... | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
20+
| websocketXss.go:54:24:54:33 | gorillaMsg | websocketXss.go:53:26:53:35 | gorillaMsg [postupdate] | websocketXss.go:54:24:54:33 | gorillaMsg | Cross-site scripting vulnerability due to $@. | websocketXss.go:53:26:53:35 | gorillaMsg [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
21+
| websocketXss.go:58:24:58:31 | gorilla2 | websocketXss.go:57:17:57:24 | gorilla2 [postupdate] | websocketXss.go:58:24:58:31 | gorilla2 | Cross-site scripting vulnerability due to $@. | websocketXss.go:57:17:57:24 | gorilla2 [postupdate] | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
22+
| websocketXss.go:61:24:61:31 | gorilla3 | websocketXss.go:60:3:60:38 | extract:1 ... := ... | websocketXss.go:61:24:61:31 | gorilla3 | Cross-site scripting vulnerability due to $@. | websocketXss.go:60:3:60:38 | extract:1 ... := ... | user-provided value | websocketXss.go:0:0:0:0 | websocketXss.go | |
2223
edges
23-
| ReflectedXss.go:11:15:11:20 | selection of Form | ReflectedXss.go:11:15:11:36 | call to Get | provenance | Src:MaD:6 MaD:18 |
24+
| ReflectedXss.go:11:15:11:20 | selection of Form | ReflectedXss.go:11:15:11:36 | call to Get | provenance | Src:MaD:7 MaD:18 |
2425
| ReflectedXss.go:11:15:11:36 | call to Get | ReflectedXss.go:14:44:14:51 | username | provenance | |
25-
| contenttype.go:11:11:11:16 | selection of Form | contenttype.go:11:11:11:28 | call to Get | provenance | Src:MaD:6 MaD:18 |
26+
| contenttype.go:11:11:11:16 | selection of Form | contenttype.go:11:11:11:28 | call to Get | provenance | Src:MaD:7 MaD:18 |
2627
| contenttype.go:11:11:11:28 | call to Get | contenttype.go:17:11:17:22 | type conversion | provenance | |
27-
| contenttype.go:49:11:49:16 | selection of Form | contenttype.go:49:11:49:28 | call to Get | provenance | Src:MaD:6 MaD:18 |
28+
| contenttype.go:49:11:49:16 | selection of Form | contenttype.go:49:11:49:28 | call to Get | provenance | Src:MaD:7 MaD:18 |
2829
| contenttype.go:49:11:49:28 | call to Get | contenttype.go:53:34:53:37 | data | provenance | |
29-
| contenttype.go:63:10:63:28 | call to FormValue | contenttype.go:64:52:64:55 | data | provenance | Src:MaD:8 |
30-
| contenttype.go:73:10:73:28 | call to FormValue | contenttype.go:79:11:79:14 | data | provenance | Src:MaD:8 |
31-
| contenttype.go:88:10:88:28 | call to FormValue | contenttype.go:91:4:91:7 | data | provenance | Src:MaD:8 |
32-
| contenttype.go:113:10:113:28 | call to FormValue | contenttype.go:114:50:114:53 | data | provenance | Src:MaD:8 |
33-
| reflectedxsstest.go:30:2:30:44 | extract:0 ... := ... | reflectedxsstest.go:31:30:31:33 | file | provenance | Src:MaD:7 |
34-
| reflectedxsstest.go:30:2:30:44 | extract:1 ... := ... | reflectedxsstest.go:34:46:34:60 | selection of Filename | provenance | Src:MaD:7 |
30+
| contenttype.go:63:10:63:28 | call to FormValue | contenttype.go:64:52:64:55 | data | provenance | Src:MaD:9 |
31+
| contenttype.go:73:10:73:28 | call to FormValue | contenttype.go:79:11:79:14 | data | provenance | Src:MaD:9 |
32+
| contenttype.go:88:10:88:28 | call to FormValue | contenttype.go:91:4:91:7 | data | provenance | Src:MaD:9 |
33+
| contenttype.go:113:10:113:28 | call to FormValue | contenttype.go:114:50:114:53 | data | provenance | Src:MaD:9 |
34+
| reflectedxsstest.go:30:2:30:44 | extract:0 ... := ... | reflectedxsstest.go:31:30:31:33 | file | provenance | Src:MaD:8 |
35+
| reflectedxsstest.go:30:2:30:44 | extract:1 ... := ... | reflectedxsstest.go:34:46:34:60 | selection of Filename | provenance | Src:MaD:8 |
3536
| reflectedxsstest.go:31:2:31:34 | extract:0 ... := ... | reflectedxsstest.go:32:48:32:54 | content | provenance | |
3637
| reflectedxsstest.go:31:30:31:33 | file | reflectedxsstest.go:31:2:31:34 | extract:0 ... := ... | provenance | MaD:13 |
3738
| reflectedxsstest.go:32:48:32:54 | content | reflectedxsstest.go:33:49:33:55 | content | provenance | |
@@ -43,7 +44,7 @@ edges
4344
| reflectedxsstest.go:34:17:34:61 | call to Sprintf | reflectedxsstest.go:34:10:34:62 | type conversion | provenance | |
4445
| reflectedxsstest.go:34:46:34:60 | selection of Filename | reflectedxsstest.go:34:17:34:61 | []type{args} [array] | provenance | |
4546
| reflectedxsstest.go:34:46:34:60 | selection of Filename | reflectedxsstest.go:34:17:34:61 | call to Sprintf | provenance | FunctionModel |
46-
| reflectedxsstest.go:38:2:38:35 | extract:0 ... := ... | reflectedxsstest.go:39:16:39:21 | reader | provenance | Src:MaD:9 |
47+
| reflectedxsstest.go:38:2:38:35 | extract:0 ... := ... | reflectedxsstest.go:39:16:39:21 | reader | provenance | Src:MaD:10 |
4748
| reflectedxsstest.go:39:2:39:32 | extract:0 ... := ... | reflectedxsstest.go:40:14:40:17 | part | provenance | |
4849
| reflectedxsstest.go:39:2:39:32 | extract:0 ... := ... | reflectedxsstest.go:42:2:42:5 | part | provenance | |
4950
| reflectedxsstest.go:39:16:39:21 | reader | reflectedxsstest.go:39:2:39:32 | extract:0 ... := ... | provenance | MaD:16 |
@@ -55,34 +56,35 @@ edges
5556
| reflectedxsstest.go:44:17:44:54 | call to Sprintf | reflectedxsstest.go:44:10:44:55 | type conversion | provenance | |
5657
| reflectedxsstest.go:44:46:44:53 | partName | reflectedxsstest.go:44:17:44:54 | []type{args} [array] | provenance | |
5758
| reflectedxsstest.go:44:46:44:53 | partName | reflectedxsstest.go:44:17:44:54 | call to Sprintf | provenance | FunctionModel |
58-
| reflectedxsstest.go:51:14:51:18 | selection of URL | reflectedxsstest.go:51:14:51:26 | call to Query | provenance | Src:MaD:10 MaD:17 |
59+
| reflectedxsstest.go:51:14:51:18 | selection of URL | reflectedxsstest.go:51:14:51:26 | call to Query | provenance | Src:MaD:11 MaD:17 |
5960
| reflectedxsstest.go:51:14:51:26 | call to Query | reflectedxsstest.go:54:11:54:21 | type conversion | provenance | |
60-
| tst.go:14:15:14:20 | selection of Form | tst.go:14:15:14:36 | call to Get | provenance | Src:MaD:6 MaD:18 |
61+
| tst.go:14:15:14:20 | selection of Form | tst.go:14:15:14:36 | call to Get | provenance | Src:MaD:7 MaD:18 |
6162
| tst.go:14:15:14:36 | call to Get | tst.go:17:18:17:25 | username | provenance | |
6263
| tst.go:17:9:17:57 | slice literal [array] | tst.go:18:32:18:32 | a [array] | provenance | |
6364
| tst.go:17:18:17:25 | username | tst.go:17:9:17:57 | slice literal [array] | provenance | |
6465
| tst.go:18:19:18:38 | call to Join | tst.go:18:12:18:39 | type conversion | provenance | |
6566
| tst.go:18:32:18:32 | a [array] | tst.go:18:19:18:38 | call to Join | provenance | MaD:19 |
66-
| tst.go:48:14:48:19 | selection of Form | tst.go:48:14:48:34 | call to Get | provenance | Src:MaD:6 MaD:18 |
67+
| tst.go:48:14:48:19 | selection of Form | tst.go:48:14:48:34 | call to Get | provenance | Src:MaD:7 MaD:18 |
6768
| tst.go:48:14:48:34 | call to Get | tst.go:53:12:53:26 | type conversion | provenance | |
68-
| websocketXss.go:31:11:31:14 | xnet [postupdate] | websocketXss.go:32:24:32:27 | xnet | provenance | Src:MaD:5 |
69-
| websocketXss.go:35:21:35:25 | xnet2 [postupdate] | websocketXss.go:36:24:36:28 | xnet2 | provenance | Src:MaD:4 |
70-
| websocketXss.go:40:3:40:40 | extract:1 ... := ... | websocketXss.go:41:24:41:29 | nhooyr | provenance | Src:MaD:11 |
71-
| websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | websocketXss.go:48:24:48:33 | gorillaMsg | provenance | Src:MaD:1 |
72-
| websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | websocketXss.go:52:24:52:31 | gorilla2 | provenance | Src:MaD:2 |
73-
| websocketXss.go:54:3:54:38 | extract:1 ... := ... | websocketXss.go:55:24:55:31 | gorilla3 | provenance | Src:MaD:3 |
69+
| websocketXss.go:32:11:32:14 | xnet [postupdate] | websocketXss.go:33:24:33:27 | xnet | provenance | Src:MaD:5 |
70+
| websocketXss.go:36:21:36:25 | xnet2 [postupdate] | websocketXss.go:37:24:37:28 | xnet2 | provenance | Src:MaD:4 |
71+
| websocketXss.go:41:3:41:40 | extract:1 ... := ... | websocketXss.go:42:24:42:29 | nhooyr | provenance | Src:MaD:6 |
72+
| websocketXss.go:46:3:46:42 | extract:1 ... := ... | websocketXss.go:47:24:47:31 | coderMsg | provenance | Src:MaD:6 |
73+
| websocketXss.go:53:26:53:35 | gorillaMsg [postupdate] | websocketXss.go:54:24:54:33 | gorillaMsg | provenance | Src:MaD:1 |
74+
| websocketXss.go:57:17:57:24 | gorilla2 [postupdate] | websocketXss.go:58:24:58:31 | gorilla2 | provenance | Src:MaD:2 |
75+
| websocketXss.go:60:3:60:38 | extract:1 ... := ... | websocketXss.go:61:24:61:31 | gorilla3 | provenance | Src:MaD:3 |
7476
models
7577
| 1 | Source: github.com/gorilla/websocket; ; false; ReadJSON; ; ; Argument[1]; remote; manual |
7678
| 2 | Source: github.com/gorilla/websocket; Conn; true; ReadJSON; ; ; Argument[0]; remote; manual |
7779
| 3 | Source: github.com/gorilla/websocket; Conn; true; ReadMessage; ; ; ReturnValue[1]; remote; manual |
7880
| 4 | Source: golang.org/x/net/websocket; Codec; true; Receive; ; ; Argument[1]; remote; manual |
7981
| 5 | Source: golang.org/x/net/websocket; Conn; true; Read; ; ; Argument[0]; remote; manual |
80-
| 6 | Source: net/http; Request; true; Form; ; ; ; remote; manual |
81-
| 7 | Source: net/http; Request; true; FormFile; ; ; ReturnValue[0..1]; remote; manual |
82-
| 8 | Source: net/http; Request; true; FormValue; ; ; ReturnValue; remote; manual |
83-
| 9 | Source: net/http; Request; true; MultipartReader; ; ; ReturnValue[0]; remote; manual |
84-
| 10 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
85-
| 11 | Source: nhooyr.io/websocket; Conn; true; Read; ; ; ReturnValue[1]; remote; manual |
82+
| 6 | Source: group:coder/websocket; Conn; true; Read; ; ; ReturnValue[1]; remote; manual |
83+
| 7 | Source: net/http; Request; true; Form; ; ; ; remote; manual |
84+
| 8 | Source: net/http; Request; true; FormFile; ; ; ReturnValue[0..1]; remote; manual |
85+
| 9 | Source: net/http; Request; true; FormValue; ; ; ReturnValue; remote; manual |
86+
| 10 | Source: net/http; Request; true; MultipartReader; ; ; ReturnValue[0]; remote; manual |
87+
| 11 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
8688
| 12 | Summary: fmt; ; false; Sprintf; ; ; Argument[1].ArrayElement; ReturnValue; taint; manual |
8789
| 13 | Summary: io; ; false; ReadAll; ; ; Argument[0]; ReturnValue[0]; taint; manual |
8890
| 14 | Summary: io; Reader; true; Read; ; ; Argument[receiver]; Argument[0]; taint; manual |
@@ -147,16 +149,18 @@ nodes
147149
| tst.go:48:14:48:19 | selection of Form | semmle.label | selection of Form |
148150
| tst.go:48:14:48:34 | call to Get | semmle.label | call to Get |
149151
| tst.go:53:12:53:26 | type conversion | semmle.label | type conversion |
150-
| websocketXss.go:31:11:31:14 | xnet [postupdate] | semmle.label | xnet [postupdate] |
151-
| websocketXss.go:32:24:32:27 | xnet | semmle.label | xnet |
152-
| websocketXss.go:35:21:35:25 | xnet2 [postupdate] | semmle.label | xnet2 [postupdate] |
153-
| websocketXss.go:36:24:36:28 | xnet2 | semmle.label | xnet2 |
154-
| websocketXss.go:40:3:40:40 | extract:1 ... := ... | semmle.label | extract:1 ... := ... |
155-
| websocketXss.go:41:24:41:29 | nhooyr | semmle.label | nhooyr |
156-
| websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | semmle.label | gorillaMsg [postupdate] |
157-
| websocketXss.go:48:24:48:33 | gorillaMsg | semmle.label | gorillaMsg |
158-
| websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | semmle.label | gorilla2 [postupdate] |
159-
| websocketXss.go:52:24:52:31 | gorilla2 | semmle.label | gorilla2 |
160-
| websocketXss.go:54:3:54:38 | extract:1 ... := ... | semmle.label | extract:1 ... := ... |
161-
| websocketXss.go:55:24:55:31 | gorilla3 | semmle.label | gorilla3 |
152+
| websocketXss.go:32:11:32:14 | xnet [postupdate] | semmle.label | xnet [postupdate] |
153+
| websocketXss.go:33:24:33:27 | xnet | semmle.label | xnet |
154+
| websocketXss.go:36:21:36:25 | xnet2 [postupdate] | semmle.label | xnet2 [postupdate] |
155+
| websocketXss.go:37:24:37:28 | xnet2 | semmle.label | xnet2 |
156+
| websocketXss.go:41:3:41:40 | extract:1 ... := ... | semmle.label | extract:1 ... := ... |
157+
| websocketXss.go:42:24:42:29 | nhooyr | semmle.label | nhooyr |
158+
| websocketXss.go:46:3:46:42 | extract:1 ... := ... | semmle.label | extract:1 ... := ... |
159+
| websocketXss.go:47:24:47:31 | coderMsg | semmle.label | coderMsg |
160+
| websocketXss.go:53:26:53:35 | gorillaMsg [postupdate] | semmle.label | gorillaMsg [postupdate] |
161+
| websocketXss.go:54:24:54:33 | gorillaMsg | semmle.label | gorillaMsg |
162+
| websocketXss.go:57:17:57:24 | gorilla2 [postupdate] | semmle.label | gorilla2 [postupdate] |
163+
| websocketXss.go:58:24:58:31 | gorilla2 | semmle.label | gorilla2 |
164+
| websocketXss.go:60:3:60:38 | extract:1 ... := ... | semmle.label | extract:1 ... := ... |
165+
| websocketXss.go:61:24:61:31 | gorilla3 | semmle.label | gorilla3 |
162166
subpaths

‎go/ql/test/query-tests/Security/CWE-079/go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module codeql-go-tests/CWE-079
33
go 1.24
44

55
require (
6+
github.com/coder/websocket v1.8.5
67
github.com/gobwas/ws v1.0.3
78
github.com/gorilla/websocket v1.4.2
89
golang.org/x/net v0.0.0-20200505041828-1ed23360d12c

‎go/ql/test/query-tests/Security/CWE-079/vendor/github.com/coder/websocket/LICENSE‎

Lines changed: 21 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go/ql/test/query-tests/Security/CWE-079/vendor/github.com/coder/websocket/stub.go‎

Lines changed: 76 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎go/ql/test/query-tests/Security/CWE-079/vendor/modules.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# github.com/coder/websocket v1.8.5
2+
## explicit
3+
github.com/coder/websocket
14
# github.com/gobwas/ws v1.0.3
25
## explicit
36
github.com/gobwas/ws

‎go/ql/test/query-tests/Security/CWE-079/websocketXss.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"fmt"
1111
"net/http"
1212

13+
coder "github.com/coder/websocket"
1314
gorilla "github.com/gorilla/websocket"
1415
websocket "golang.org/x/net/websocket"
1516
nhooyr "nhooyr.io/websocket"
@@ -40,6 +41,11 @@ func xss(w http.ResponseWriter, r *http.Request) {
4041
_, nhooyr, _ := n.Read(context.TODO()) // $ Source[go/reflected-xss]
4142
fmt.Fprintf(w, "%v", nhooyr) // $ Alert[go/reflected-xss]
4243
}
44+
{
45+
n, _, _ := coder.Dial(context.TODO(), uri, nil)
46+
_, coderMsg, _ := n.Read(context.TODO()) // $ Source[go/reflected-xss]
47+
fmt.Fprintf(w, "%v", coderMsg) // $ Alert[go/reflected-xss]
48+
}
4349
{
4450
dialer := gorilla.Dialer{}
4551
conn, _, _ := dialer.Dial(uri, nil)

0 commit comments

Comments
 (0)