Make LDAPInjection use new API

owen-mc · owen-mc · commit a53da376d15d · 2023-08-10T15:49:29.000+01:00
diff --git a/go/ql/src/experimental/CWE-090/LDAPInjection.ql b/go/ql/src/experimental/CWE-090/LDAPInjection.ql
@@ -12,9 +12,9 @@
 
 import go
 import LDAPInjection
-import DataFlow::PathGraph
+import LdapInjectionFlow::PathGraph
 
-from LdapInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
-where config.hasFlowPath(source, sink)
+from LdapInjectionFlow::PathNode source, LdapInjectionFlow::PathNode sink
+where LdapInjectionFlow::flowPath(source, sink)
 select sink.getNode(), source, sink, "LDAP query parameter depends on a $@.", source.getNode(),
   "user-provided value"
diff --git a/go/ql/src/experimental/CWE-090/LDAPInjection.qll b/go/ql/src/experimental/CWE-090/LDAPInjection.qll
@@ -1,5 +1,4 @@
 import go
-import DataFlow::PathGraph
 
 /**
  * A sanitizer function that prevents LDAP injection attacks.
@@ -97,10 +96,12 @@ private class LdapClientDNSink extends LdapSink {
 }
 
 /**
+ * DEPRECATED: Use `LdapInjectionFlow` instead.
+ *
  * A taint-tracking configuration for reasoning about when an `UntrustedFlowSource`
  * flows into an argument or field that is vulnerable to LDAP injection.
  */
-class LdapInjectionConfiguration extends TaintTracking::Configuration {
+deprecated class LdapInjectionConfiguration extends TaintTracking::Configuration {
   LdapInjectionConfiguration() { this = "Ldap injection" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
@@ -109,3 +110,13 @@ class LdapInjectionConfiguration extends TaintTracking::Configuration {
 
   override predicate isSanitizer(DataFlow::Node sanitizer) { sanitizer instanceof LdapSanitizer }
 }
+
+private module LdapInjectionConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
+
+  predicate isSink(DataFlow::Node sink) { sink instanceof LdapSink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof LdapSanitizer }
+}
+
+module LdapInjectionFlow = TaintTracking::Global<LdapInjectionConfig>;
