Merge pull request #475 from sauyon/yaml

Add models for gopkg.in/yaml

Author: Sauyon Lee

change-notes/2021-02-10-yaml.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for the [gopkg.in/yaml](https://pkg.go.dev/gopkg.in/yaml.v3) package, which may lead to more results from the security queries.

ql/src/go.qll

@@ -58,5 +58,6 @@ import semmle.go.frameworks.Testing
 import semmle.go.frameworks.WebSocket
 import semmle.go.frameworks.XNetHtml
 import semmle.go.frameworks.XPath
+import semmle.go.frameworks.Yaml
 import semmle.go.frameworks.Zap
 import semmle.go.security.FlowSources

ql/src/semmle/go/frameworks/Yaml.qll

@@ -0,0 +1,70 @@
+/**
+ * Provides classes for working with the [gopkg.in/yaml](https://pkg.go.dev/gopkg.in/yaml.v3) package.
+ */
+
+import go
+
+/**
+ * Provides classes for working with the [gopkg.in/yaml](https://pkg.go.dev/gopkg.in/yaml.v3) package.
+ */
+module Yaml {
+  /** Gets a package path for the Yaml package. */
+  bindingset[result]
+  string packagePath() { result = package("gopkg.in/yaml", "") }
+
+  private class MarshalFunction extends TaintTracking::FunctionModel, MarshalingFunction::Range {
+    MarshalFunction() { this.hasQualifiedName(packagePath(), "Marshal") }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = this.getAnInput() and output = this.getOutput()
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isResult(0) }
+
+    override string getFormat() { result = "yaml" }
+  }
+
+  private class UnmarshalFunction extends TaintTracking::FunctionModel, UnmarshalingFunction::Range {
+    UnmarshalFunction() { this.hasQualifiedName(packagePath(), ["Unmarshal", "UnmarshalStrict"]) }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = this.getAnInput() and output = this.getOutput()
+    }
+
+    override DataFlow::FunctionInput getAnInput() { result.isParameter(0) }
+
+    override DataFlow::FunctionOutput getOutput() { result.isParameter(1) }
+
+    override string getFormat() { result = "yaml" }
+  }
+
+  private class FunctionModels extends TaintTracking::FunctionModel {
+    FunctionInput inp;
+    FunctionOutput outp;
+
+    FunctionModels() {
+      this.hasQualifiedName(packagePath(), "NewDecoder") and
+      (inp.isParameter(0) and outp.isResult())
+      or
+      this.hasQualifiedName(packagePath(), "NewEncoder") and
+      (inp.isResult() and outp.isParameter(0))
+      or
+      exists(Method m | this = m |
+        m.hasQualifiedName(packagePath(), ["Decoder", "Node"], "Decode") and
+        (inp.isReceiver() and outp.isParameter(0))
+        or
+        m.hasQualifiedName(packagePath(), ["Encoder", "Node"], "Encode") and
+        (inp.isParameter(0) and outp.isReceiver())
+        or
+        m.hasQualifiedName(packagePath(), "Node", "SetString") and
+        (inp.isParameter(0) and outp.isReceiver())
+      )
+    }
+
+    override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+      input = inp and output = outp
+    }
+  }
+}

ql/test/library-tests/semmle/go/frameworks/Yaml/go.mod

@@ -0,0 +1,9 @@
+module codeql-go-tests/frameworks/Yaml
+
+go 1.15
+
+require (
+	gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0
+	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+)

ql/test/library-tests/semmle/go/frameworks/Yaml/tests.expected

@@ -0,0 +1,49 @@
+import go
+import TestUtilities.InlineExpectationsTest
+
+class TaintFunctionModelTest extends InlineExpectationsTest {
+  TaintFunctionModelTest() { this = "TaintFunctionModelTest" }
+
+  override string getARelevantTag() { result = "ttfnmodelstep" }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    tag = "ttfnmodelstep" and
+    exists(TaintTracking::FunctionModel model, DataFlow::CallNode call | call = model.getACall() |
+      call.hasLocationInfo(file, line, _, _, _) and
+      element = call.toString() and
+      value = model.getAnInputNode(call) + " -> " + model.getAnOutputNode(call)
+    )
+  }
+}
+
+class MarshalerTest extends InlineExpectationsTest {
+  MarshalerTest() { this = "MarshalerTest" }
+
+  override string getARelevantTag() { result = "marshaler" }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    tag = "marshaler" and
+    exists(MarshalingFunction m, DataFlow::CallNode call | call = m.getACall() |
+      call.hasLocationInfo(file, line, _, _, _) and
+      element = call.toString() and
+      value =
+        m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " + m.getOutput().getNode(call)
+    )
+  }
+}
+
+class UnmarshalerTest extends InlineExpectationsTest {
+  UnmarshalerTest() { this = "UnmarshalerTest" }
+
+  override string getARelevantTag() { result = "unmarshaler" }
+
+  override predicate hasActualResult(string file, int line, string element, string tag, string value) {
+    tag = "unmarshaler" and
+    exists(UnmarshalingFunction m, DataFlow::CallNode call | call = m.getACall() |
+      call.hasLocationInfo(file, line, _, _, _) and
+      element = call.toString() and
+      value =
+        m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " + m.getOutput().getNode(call)
+    )
+  }
+}

ql/test/library-tests/semmle/go/frameworks/Yaml/tests.ql

@@ -0,0 +1,9 @@
+# gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0
+## explicit
+gopkg.in/yaml.v1
+# gopkg.in/yaml.v2 v2.4.0
+## explicit
+gopkg.in/yaml.v2
+# gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+## explicit
+gopkg.in/yaml.v3