Make UntrustedDataToUnknownExternalAPI use new API

mbg · owen-mc · commit 957757c271fb · 2023-08-10T15:48:47.000+01:00
diff --git a/go/ql/lib/semmle/go/security/ExternalAPIs.qll b/go/ql/lib/semmle/go/security/ExternalAPIs.qll
@@ -212,8 +212,12 @@ module UntrustedDataToExternalApiFlow = DataFlow::Global<UntrustedDataConfig>;
 /** DEPRECATED: Alias for UntrustedDataToExternalApiConfig */
 deprecated class UntrustedDataToExternalAPIConfig = UntrustedDataToExternalApiConfig;
 
-/** A configuration for tracking flow from `RemoteFlowSource`s to `UnknownExternalApiDataNode`s. */
-class UntrustedDataToUnknownExternalApiConfig extends TaintTracking::Configuration {
+/**
+ * DEPRECATED: Use `UntrustedDataToUnknownExternalApiFlow` instead.
+ *
+ * A configuration for tracking flow from `RemoteFlowSource`s to `UnknownExternalApiDataNode`s.
+ */
+deprecated class UntrustedDataToUnknownExternalApiConfig extends TaintTracking::Configuration {
   UntrustedDataToUnknownExternalApiConfig() { this = "UntrustedDataToUnknownExternalAPIConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
@@ -224,6 +228,15 @@ class UntrustedDataToUnknownExternalApiConfig extends TaintTracking::Configurati
 /** DEPRECATED: Alias for UntrustedDataToUnknownExternalApiConfig */
 deprecated class UntrustedDataToUnknownExternalAPIConfig = UntrustedDataToUnknownExternalApiConfig;
 
+private module UntrustedDataToUnknownExternalApiConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof UnknownExternalApiDataNode }
+}
+
+module UntrustedDataToUnknownExternalApiFlow =
+  DataFlow::Global<UntrustedDataToUnknownExternalApiConfig>;
+
 /** A node representing untrusted data being passed to an external API. */
 class UntrustedExternalApiDataNode extends ExternalApiDataNode {
   UntrustedExternalApiDataNode() { UntrustedDataToExternalApiFlow::flow(_, this) }
diff --git a/go/ql/src/Security/CWE-020/UntrustedDataToUnknownExternalAPI.ql b/go/ql/src/Security/CWE-020/UntrustedDataToUnknownExternalAPI.ql
@@ -11,11 +11,12 @@
 
 import go
 import semmle.go.security.ExternalAPIs
-import DataFlow::PathGraph
+import UntrustedDataToUnknownExternalApiFlow::PathGraph
 
 from
-  UntrustedDataToUnknownExternalApiConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
-where config.hasFlowPath(source, sink)
+  UntrustedDataToUnknownExternalApiFlow::PathNode source,
+  UntrustedDataToUnknownExternalApiFlow::PathNode sink
+where UntrustedDataToUnknownExternalApiFlow::flowPath(source, sink)
 select sink, source, sink,
   "Call to " + sink.getNode().(UnknownExternalApiDataNode).getFunctionDescription() +
     " with untrusted data from $@.", source, source.toString()
