Make InsecureRandomness use new API

owen-mc · owen-mc · commit 3d9f8d50bce5 · 2023-08-10T15:48:50.000+01:00
diff --git a/go/ql/lib/semmle/go/security/InsecureRandomness.qll b/go/ql/lib/semmle/go/security/InsecureRandomness.qll
@@ -17,10 +17,12 @@ module InsecureRandomness {
   import InsecureRandomnessCustomizations::InsecureRandomness
 
   /**
+   * DEPRECATED: Use `Flow` instead.
+   *
    * A taint-tracking configuration for reasoning about random values that are
    * not cryptographically secure.
    */
-  class Configuration extends TaintTracking::Configuration {
+  deprecated class Configuration extends TaintTracking::Configuration {
     Configuration() { this = "InsecureRandomness" }
 
     override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -32,4 +34,17 @@ module InsecureRandomness {
 
     override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
   }
+
+  /** Holds if `sink` is a sink for this configuration with kind `kind`. */
+  predicate isSinkWithKind(Sink sink, string kind) { kind = sink.getKind() }
+
+  private module Config implements DataFlow::ConfigSig {
+    predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    predicate isSink(DataFlow::Node sink) { isSinkWithKind(sink, _) }
+
+    predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+  }
+
+  module Flow = TaintTracking::Global<Config>;
 }
diff --git a/go/ql/src/Security/CWE-338/InsecureRandomness.ql b/go/ql/src/Security/CWE-338/InsecureRandomness.ql
@@ -11,19 +11,19 @@
  */
 
 import go
-import semmle.go.security.InsecureRandomness::InsecureRandomness
-import DataFlow::PathGraph
+import semmle.go.security.InsecureRandomness
+import InsecureRandomness::Flow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, string kind
+from InsecureRandomness::Flow::PathNode source, InsecureRandomness::Flow::PathNode sink, string kind
 where
-  cfg.hasFlowPath(source, sink) and
-  cfg.isSinkWithKind(sink.getNode(), kind) and
+  InsecureRandomness::Flow::flowPath(source, sink) and
+  InsecureRandomness::isSinkWithKind(sink.getNode(), kind) and
   (
     kind != "A password-related function"
     or
     sink =
-      min(DataFlow::PathNode sink2, int line |
-        cfg.hasFlowPath(_, sink2) and
+      min(InsecureRandomness::Flow::PathNode sink2, int line |
+        InsecureRandomness::Flow::flowPath(_, sink2) and
         sink2.getNode().getRoot() = sink.getNode().getRoot() and
         sink2.hasLocationInfo(_, line, _, _, _)
       |
