Make CorsMisconfiguration use new API

owen-mc · owen-mc · commit b00e44725cf0 · 2023-08-10T15:49:43.000+01:00
diff --git a/go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql b/go/ql/src/experimental/CWE-942/CorsMisconfiguration.ql
@@ -55,24 +55,26 @@ class AllowCredentialsHeaderWrite extends Http::HeaderWrite {
  * A taint-tracking configuration for reasoning about when an UntrustedFlowSource
  * flows to a HeaderWrite that writes an `Access-Control-Allow-Origin` header's value.
  */
-class FlowsUntrustedToAllowOriginHeader extends TaintTracking::Configuration {
-  FlowsUntrustedToAllowOriginHeader() { this = "from-untrusted-to-allow-origin-header-value" }
+module UntrustedToAllowOriginHeaderConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
-
-  predicate isSinkHW(DataFlow::Node sink, AllowOriginHeaderWrite hw) { sink = hw.getValue() }
+  additional predicate isSinkHW(DataFlow::Node sink, AllowOriginHeaderWrite hw) {
+    sink = hw.getValue()
+  }
 
-  override predicate isSanitizer(DataFlow::Node node) {
+  predicate isBarrier(DataFlow::Node node) {
     exists(ControlFlow::ConditionGuardNode cgn |
       cgn.ensures(any(AllowedFlag f).getAFlag().getANode(), _)
     |
       cgn.dominates(node.getBasicBlock())
     )
   }
 
-  override predicate isSink(DataFlow::Node sink) { this.isSinkHW(sink, _) }
+  predicate isSink(DataFlow::Node sink) { isSinkHW(sink, _) }
 }
 
+module UntrustedToAllowOriginHeaderFlow = TaintTracking::Global<UntrustedToAllowOriginHeaderConfig>;
+
 /**
  * Holds if the provided `allowOriginHW` HeaderWrite's parent ResponseWriter
  * also has another HeaderWrite that sets a `Access-Control-Allow-Credentials`
@@ -92,9 +94,9 @@ predicate allowCredentialsIsSetToTrue(AllowOriginHeaderWrite allowOriginHW) {
  * The `message` parameter is populated with the warning message to be returned by the query.
  */
 predicate flowsFromUntrustedToAllowOrigin(AllowOriginHeaderWrite allowOriginHW, string message) {
-  exists(FlowsUntrustedToAllowOriginHeader cfg, DataFlow::Node sink |
-    cfg.hasFlowTo(sink) and
-    cfg.isSinkHW(sink, allowOriginHW)
+  exists(DataFlow::Node sink |
+    UntrustedToAllowOriginHeaderFlow::flowTo(sink) and
+    UntrustedToAllowOriginHeaderConfig::isSinkHW(sink, allowOriginHW)
   |
     message =
       headerAllowOrigin() + " header is set to a user-defined value, and " +
@@ -124,14 +126,12 @@ class MapRead extends DataFlow::ElementReadNode {
  * A taint-tracking configuration for reasoning about when an UntrustedFlowSource
  * flows somewhere.
  */
-class FlowsFromUntrusted extends TaintTracking::Configuration {
-  FlowsFromUntrusted() { this = "from-untrusted" }
+module FromUntrustedConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
+  predicate isSink(DataFlow::Node sink) { isSinkCgn(sink, _) }
 
-  override predicate isSink(DataFlow::Node sink) { this.isSinkCgn(sink, _) }
-
-  predicate isSinkCgn(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn) {
+  additional predicate isSinkCgn(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn) {
     exists(IfStmt ifs |
       exists(Expr operand |
         operand = ifs.getCond().getAChildExpr*() and
@@ -165,12 +165,14 @@ class FlowsFromUntrusted extends TaintTracking::Configuration {
   }
 }
 
+module FromUntrustedFlow = TaintTracking::Global<FromUntrustedConfig>;
+
 /**
  * Holds if the provided `allowOriginHW` is also destination of a `UntrustedFlowSource`.
  */
 predicate flowsToGuardedByCheckOnUntrusted(AllowOriginHeaderWrite allowOriginHW) {
-  exists(FlowsFromUntrusted cfg, DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn |
-    cfg.hasFlowTo(sink) and cfg.isSinkCgn(sink, cgn)
+  exists(DataFlow::Node sink, ControlFlow::ConditionGuardNode cgn |
+    FromUntrustedFlow::flowTo(sink) and FromUntrustedConfig::isSinkCgn(sink, cgn)
   |
     cgn.dominates(allowOriginHW.getBasicBlock())
   )
