Make BadRedirectCheck use new API

owen-mc · owen-mc · commit 6c0c8d6963b5 · 2023-08-10T15:49:45.000+01:00
diff --git a/go/ql/src/Security/CWE-601/BadRedirectCheck.ql b/go/ql/src/Security/CWE-601/BadRedirectCheck.ql
@@ -14,7 +14,6 @@
 
 import go
 import semmle.go.security.OpenUrlRedirectCustomizations
-import DataFlow::PathGraph
 
 StringOps::HasPrefix checkForLeadingSlash(SsaWithFields v) {
   exists(DataFlow::Node substr |
@@ -91,29 +90,27 @@ predicate urlPath(DataFlow::Node nd) {
   )
 }
 
-class Configuration extends TaintTracking::Configuration {
-  Configuration() { this = "BadRedirectCheck" }
-
-  override predicate isSource(DataFlow::Node source) { this.isCheckedSource(source, _) }
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { isCheckedSource(source, _) }
 
   /**
    * Holds if `source` is the first node that flows into a use of a variable that is checked by a
    * bad redirect check `check`..
    */
-  predicate isCheckedSource(DataFlow::Node source, DataFlow::Node check) {
+  additional predicate isCheckedSource(DataFlow::Node source, DataFlow::Node check) {
     exists(SsaWithFields v |
       DataFlow::localFlow(source, v.getAUse()) and
       not exists(source.getAPredecessor()) and
       isBadRedirectCheckOrWrapper(check, v)
     )
   }
 
-  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     // this is very over-approximate, because most filtering is done by the isSource predicate
-    exists(Write w | w.writesField(succ, _, pred))
+    exists(Write w | w.writesField(node2, _, node1))
   }
 
-  override predicate isSanitizerOut(DataFlow::Node node) {
+  predicate isBarrierOut(DataFlow::Node node) {
     // assume this value is safe if something is prepended to it.
     exists(StringOps::Concatenation conc, int i, int j | i < j |
       node = conc.getOperand(j) and
@@ -125,9 +122,11 @@ class Configuration extends TaintTracking::Configuration {
     )
   }
 
-  override predicate isSink(DataFlow::Node sink) { sink instanceof OpenUrlRedirect::Sink }
+  predicate isSink(DataFlow::Node sink) { sink instanceof OpenUrlRedirect::Sink }
 }
 
+module Flow = TaintTracking::Global<Config>;
+
 /**
  * Holds there is a check `check` that is a bad redirect check, and `v` is either
  * checked directly by `check` or checked by a function that contains `check`.
@@ -168,10 +167,12 @@ predicate isBadRedirectCheckWrapper(DataFlow::Node check, FuncDef f, FunctionInp
   )
 }
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node check
+import Flow::PathGraph
+
+from Flow::PathNode source, Flow::PathNode sink, DataFlow::Node check
 where
-  cfg.isCheckedSource(source.getNode(), check) and
-  cfg.hasFlowPath(source, sink)
+  Config::isCheckedSource(source.getNode(), check) and
+  Flow::flowPath(source, sink)
 select check, source, sink,
   "This is a check that $@, which flows into a $@, has a leading slash, but not that it does not have '/' or '\\' in its second position.",
   source.getNode(), "this value", sink.getNode(), "redirect"
