Make ZipSlip use new API

owen-mc · owen-mc · commit b5ac0c94c6a7 · 2023-08-10T15:49:23.000+01:00
diff --git a/go/ql/lib/semmle/go/security/ZipSlip.qll b/go/ql/lib/semmle/go/security/ZipSlip.qll
@@ -12,9 +12,11 @@ module ZipSlip {
   import ZipSlipCustomizations::ZipSlip
 
   /**
+   * DEPRECATED: Use `Flow` instead.
+   *
    * A taint-tracking configuration for reasoning about zip-slip vulnerabilities.
    */
-  class Configuration extends TaintTracking::Configuration {
+  deprecated class Configuration extends TaintTracking::Configuration {
     Configuration() { this = "ZipSlip" }
 
     override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -30,4 +32,14 @@ module ZipSlip {
       guard instanceof SanitizerGuard
     }
   }
+
+  private module Config implements DataFlow::ConfigSig {
+    predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+  }
+
+  module Flow = TaintTracking::Global<Config>;
 }
diff --git a/go/ql/src/Security/CWE-022/ZipSlip.ql b/go/ql/src/Security/CWE-022/ZipSlip.ql
@@ -13,11 +13,11 @@
  */
 
 import go
-import semmle.go.security.ZipSlip::ZipSlip
-import DataFlow::PathGraph
+import semmle.go.security.ZipSlip
+import ZipSlip::Flow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
-where cfg.hasFlowPath(source, sink)
+from ZipSlip::Flow::PathNode source, ZipSlip::Flow::PathNode sink
+where ZipSlip::Flow::flowPath(source, sink)
 select source.getNode(), source, sink,
   "Unsanitized archive entry, which may contain '..', is used in a $@.", sink.getNode(),
   "file system operation"
