Make SensitiveConditionBypass use new API

owen-mc · owen-mc · commit 9b19cde8ab7f · 2023-08-10T15:49:42.000+01:00
diff --git a/go/ql/src/experimental/CWE-807/SensitiveConditionBypass.ql b/go/ql/src/experimental/CWE-807/SensitiveConditionBypass.ql
@@ -17,13 +17,13 @@ import SensitiveConditionBypass
 
 from
   ControlFlow::ConditionGuardNode guard, DataFlow::Node sensitiveSink,
-  SensitiveExpr::Classification classification, Configuration config, DataFlow::PathNode source,
-  DataFlow::PathNode operand, ComparisonExpr comp
+  SensitiveExpr::Classification classification, DataFlow::Node source, DataFlow::Node operand,
+  ComparisonExpr comp
 where
   // there should be a flow between source and the operand sink
-  config.hasFlowPath(source, operand) and
+  Flow::flow(source, operand) and
   // both the operand should belong to the same comparison expression
-  operand.getNode().asExpr() = comp.getAnOperand() and
+  operand.asExpr() = comp.getAnOperand() and
   // get the ConditionGuardNode corresponding to the comparison expr.
   guard.getCondition() = comp and
   // the sink `sensitiveSink` should be sensitive,
diff --git a/go/ql/src/experimental/CWE-807/SensitiveConditionBypass.qll b/go/ql/src/experimental/CWE-807/SensitiveConditionBypass.qll
@@ -43,10 +43,12 @@ private class ConstComparisonExpr extends ComparisonExpr {
 }
 
 /**
+ * DEPRECATED: Use `Flow` instead.
+ *
  * A data-flow configuration for reasoning about
  * user-controlled bypassing of sensitive actions.
  */
-class Configuration extends TaintTracking::Configuration {
+deprecated class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "Condtional Expression Check Bypass" }
 
   override predicate isSource(DataFlow::Node source) {
@@ -66,3 +68,24 @@ class Configuration extends TaintTracking::Configuration {
     )
   }
 }
+
+private module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source instanceof UntrustedFlowSource
+    or
+    exists(DataFlow::FieldReadNode f |
+      f.getField().hasQualifiedName("net/http", "Request", "Host")
+    |
+      source = f
+    )
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(ConstComparisonExpr c |
+      c.getAnOperand() = sink.asExpr() and
+      not c.isPotentialFalsePositive()
+    )
+  }
+}
+
+module Flow = TaintTracking::Global<Config>;
