Make SSRF use new API

owen-mc · owen-mc · commit 1962aa3de42e · 2023-08-10T15:49:27.000+01:00
diff --git a/go/ql/src/experimental/CWE-918/SSRF.ql b/go/ql/src/experimental/CWE-918/SSRF.ql
@@ -12,12 +12,12 @@
 
 import go
 import SSRF
-import DataFlow::PathGraph
+import ServerSideRequestForgery::Flow::PathGraph
 
 from
-  ServerSideRequestForgery::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink,
+  ServerSideRequestForgery::Flow::PathNode source, ServerSideRequestForgery::Flow::PathNode sink,
   DataFlow::Node request
 where
-  cfg.hasFlowPath(source, sink) and
+  ServerSideRequestForgery::Flow::flowPath(source, sink) and
   request = sink.getNode().(ServerSideRequestForgery::Sink).getARequest()
 select request, source, sink, "The URL of this request depends on a user-provided value."
diff --git a/go/ql/src/experimental/CWE-918/SSRF.qll b/go/ql/src/experimental/CWE-918/SSRF.qll
@@ -17,9 +17,11 @@ module ServerSideRequestForgery {
   private import semmle.go.dataflow.Properties
 
   /**
+   * DEPRECATED: Use `Flow` instead.
+   *
    * A taint-tracking configuration for reasoning about request forgery.
    */
-  class Configuration extends TaintTracking::Configuration {
+  deprecated class Configuration extends TaintTracking::Configuration {
     Configuration() { this = "SSRF" }
 
     override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -44,6 +46,25 @@ module ServerSideRequestForgery {
     }
   }
 
+  private module Config implements DataFlow::ConfigSig {
+    predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+      // propagate to a URL when its host is assigned to
+      exists(Write w, Field f, SsaWithFields v | f.hasQualifiedName("net/url", "URL", "Host") |
+        w.writesField(v.getAUse(), f, node1) and node2 = v.getAUse()
+      )
+    }
+
+    predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+    predicate isBarrierOut(DataFlow::Node node) { node instanceof SanitizerEdge }
+  }
+
+  module Flow = TaintTracking::Global<Config>;
+
   /** A data flow source for request forgery vulnerabilities. */
   abstract class Source extends DataFlow::Node { }
 
