Make XPathInjection use new API

owen-mc · owen-mc · commit 7341b6156dac · 2023-08-10T15:49:21.000+01:00
diff --git a/go/ql/lib/semmle/go/security/XPathInjection.qll b/go/ql/lib/semmle/go/security/XPathInjection.qll
@@ -14,9 +14,11 @@ module XPathInjection {
   import XPathInjectionCustomizations::XPathInjection
 
   /**
+   * DEPRECATED: Use `Flow` instead.
+   *
    * A taint-tracking configuration for reasoning about untrusted user input used in an XPath expression.
    */
-  class Configuration extends TaintTracking::Configuration {
+  deprecated class Configuration extends TaintTracking::Configuration {
     Configuration() { this = "XPathInjection" }
 
     override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -32,4 +34,14 @@ module XPathInjection {
       guard instanceof SanitizerGuard
     }
   }
+
+  private module Config implements DataFlow::ConfigSig {
+    predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+  }
+
+  module Flow = TaintTracking::Global<Config>;
 }
diff --git a/go/ql/src/Security/CWE-643/XPathInjection.ql b/go/ql/src/Security/CWE-643/XPathInjection.ql
@@ -12,17 +12,17 @@
  */
 
 import go
-import semmle.go.security.XPathInjection::XPathInjection
-import DataFlow::PathGraph
+import semmle.go.security.XPathInjection
+import XPathInjection::Flow::PathGraph
 
 /** Holds if `node` is either a string or a byte slice */
-predicate isStringOrByte(DataFlow::PathNode node) {
+predicate isStringOrByte(XPathInjection::Flow::PathNode node) {
   exists(Type t | t = node.getNode().getType().getUnderlyingType() |
     t instanceof StringType or t instanceof ByteSliceType
   )
 }
 
-from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
-where config.hasFlowPath(source, sink) and isStringOrByte(sink)
+from XPathInjection::Flow::PathNode source, XPathInjection::Flow::PathNode sink
+where XPathInjection::Flow::flowPath(source, sink) and isStringOrByte(sink)
 select sink.getNode(), source, sink, "XPath expression depends on a $@.", source.getNode(),
   "user-provided value"
