Add taint models for go 1.19's new fmt.Append functions

smowton · smowton · commit 6068f63e9ed2 · 2022-08-19T10:29:45.000+01:00
diff --git a/go/ql/lib/semmle/go/frameworks/stdlib/Fmt.qll b/go/ql/lib/semmle/go/frameworks/stdlib/Fmt.qll
@@ -6,24 +6,20 @@ import go
 
 /** Provides models of commonly used functions in the `fmt` package. */
 module Fmt {
-  /** The `Sprint` function or one of its variants. */
-  class Sprinter extends TaintTracking::FunctionModel {
-    Sprinter() {
-      // signature: func Sprint(a ...interface{}) string
-      this.hasQualifiedName("fmt", "Sprint")
-      or
-      // signature: func Sprintf(format string, a ...interface{}) string
-      this.hasQualifiedName("fmt", "Sprintf")
-      or
-      // signature: func Sprintln(a ...interface{}) string
-      this.hasQualifiedName("fmt", "Sprintln")
-    }
+  /** The `Sprint` or `Append` functions or one of their variants. */
+  class AppenderOrSprinter extends TaintTracking::FunctionModel {
+    AppenderOrSprinter() { this.hasQualifiedName("fmt", ["Append", "Sprint"] + ["", "f", "ln"]) }
 
     override predicate hasTaintFlow(FunctionInput inp, FunctionOutput outp) {
       inp.isParameter(_) and outp.isResult()
     }
   }
 
+  /** The `Sprint` function or one of its variants. */
+  class Sprinter extends AppenderOrSprinter {
+    Sprinter() { this.getName().matches("Sprint%") }
+  }
+
   /** The `Print` function or one of its variants. */
   class Printer extends Function {
     Printer() { this.hasQualifiedName("fmt", ["Print", "Printf", "Println"]) }
diff --git a/go/ql/src/Security/CWE-352/ConstantOauth2State.ql b/go/ql/src/Security/CWE-352/ConstantOauth2State.ql
@@ -106,7 +106,7 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {
     TaintTracking::referenceStep(pred, succ)
     or
     // Propagate across Sprintf and similar calls
-    any(Fmt::Sprinter s).taintStep(pred, succ)
+    any(Fmt::AppenderOrSprinter s).taintStep(pred, succ)
   }
 
   predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {
diff --git a/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go b/go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow/Fmt.go

Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ class PrivateUrlFlowsToAuthCodeUrlCall extends DataFlow::Configuration {`
`106`	`106`	`TaintTracking::referenceStep(pred, succ)`
`107`	`107`	`or`
`108`	`108`	`// Propagate across Sprintf and similar calls`
`109`		`- any(Fmt::Sprinter s).taintStep(pred, succ)`
	`109`	`+ any(Fmt::AppenderOrSprinter s).taintStep(pred, succ)`
`110`	`110`	`}`
`111`	`111`
`112`	`112`	`predicate isSink(DataFlow::Node sink, DataFlow::CallNode call) {`