Convert XPath injection sinks to MaD

owen-mc · owen-mc · commit a6cb511ed721 · 2024-07-25T12:56:06.000+01:00
diff --git a/go/ql/lib/ext/github.com.antchfx.htmlquery.model.yml b/go/ql/lib/ext/github.com.antchfx.htmlquery.model.yml
@@ -0,0 +1,9 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/antchfx/htmlquery", "", True, "Find", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/htmlquery", "", True, "FindOne", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/htmlquery", "", True, "Query", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/htmlquery", "", True, "QueryAll", "", "", "Argument[1]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.antchfx.jsonquery.model.yml b/go/ql/lib/ext/github.com.antchfx.jsonquery.model.yml
@@ -0,0 +1,9 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/antchfx/jsonquery", "", True, "Find", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/jsonquery", "", True, "FindOne", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/jsonquery", "", True, "Query", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/jsonquery", "", True, "QueryAll", "", "", "Argument[1]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.antchfx.xmlquery.model.yml b/go/ql/lib/ext/github.com.antchfx.xmlquery.model.yml
@@ -0,0 +1,13 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/antchfx/xmlquery", "", True, "Find", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "", True, "FindOne", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "", True, "FindEach", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "", True, "FindEachWithBreak", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "", True, "Query", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "", True, "QueryAll", "", "", "Argument[1]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "Node", True, "SelectElement", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xmlquery", "Node", True, "SelectElements", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.antchfx.xpath.model.yml b/go/ql/lib/ext/github.com.antchfx.xpath.model.yml
@@ -0,0 +1,9 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/antchfx/xpath", "", True, "Compile", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xpath", "", True, "CompileWithNS", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xpath", "", True, "MustCompile", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/antchfx/xpath", "", True, "Select", "", "", "Argument[1]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.christrenkamp.goxpath.model.yml b/go/ql/lib/ext/github.com.christrenkamp.goxpath.model.yml
@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/ChrisTrenkamp/goxpath", "", True, "MustParse", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/ChrisTrenkamp/goxpath", "", True, "Parse", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/ChrisTrenkamp/goxpath", "", True, "ParseExec", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.go-xmlpath.xmlpath.model.yml b/go/ql/lib/ext/github.com.go-xmlpath.xmlpath.model.yml
@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/go-xmlpath/xmlpath", "", True, "Compile", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/go-xmlpath/xmlpath", "", True, "MustCompile", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.jbowtie.gokogiri.model.yml b/go/ql/lib/ext/github.com.jbowtie.gokogiri.model.yml
@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/jbowtie/gokogiri/xpath", "", True, "Compile", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.jbowtie.gokogiri.xml.model.yml b/go/ql/lib/ext/github.com.jbowtie.gokogiri.xml.model.yml
@@ -0,0 +1,9 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/jbowtie/gokogiri/xml", "Node", True, "Search", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/jbowtie/gokogiri/xml", "Node", True, "SearchWithVariables", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/jbowtie/gokogiri/xml", "Node", True, "EvalXPath", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/jbowtie/gokogiri/xml", "Node", True, "EvalXPathAsBoolean", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.lestrrat-go.libxml2.parser.model.yml b/go/ql/lib/ext/github.com.lestrrat-go.libxml2.parser.model.yml
@@ -0,0 +1,8 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/lestrrat-go/libxml2/parser", "Parser", True, "Parse", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/lestrrat-go/libxml2/parser", "Parser", True, "ParseReader", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/lestrrat-go/libxml2/parser", "Parser", True, "ParseString", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/ext/github.com.santhosh-tekuri.xpathparser.model.yml b/go/ql/lib/ext/github.com.santhosh-tekuri.xpathparser.model.yml
@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/go-all
+      extensible: sinkModel
+    data:
+      - ["github.com/santhosh-tekuri/xpathparser", "", True, "Parse", "", "", "Argument[0]", "xpath-injection", "manual"]
+      - ["github.com/santhosh-tekuri/xpathparser", "", True, "MustParse", "", "", "Argument[0]", "xpath-injection", "manual"]
diff --git a/go/ql/lib/semmle/go/frameworks/XPath.qll b/go/ql/lib/semmle/go/frameworks/XPath.qll
@@ -3,6 +3,7 @@
  */
 
 import go
+import semmle.go.dataflow.ExternalFlow
 
 /** Provides classes for working with XPath-related APIs. */
 module XPath {
@@ -24,186 +25,24 @@ module XPath {
      */
     abstract class Range extends DataFlow::Node { }
 
-    /**
-     * An XPath expression string used in an API function of the
-     * [XPath](https://github.com/antchfx/xpath) package.
-     */
-    private class AntchfxXpathXPathExpressionString extends Range {
-      AntchfxXpathXPathExpressionString() {
-        exists(Function f, string name | name.matches("Compile%") |
-          f.hasQualifiedName(package("github.com/antchfx/xpath", ""), name) and
-          this = f.getACall().getArgument(0)
-        )
-        or
-        exists(Function f, string name | name.matches("MustCompile%") |
-          f.hasQualifiedName(package("github.com/antchfx/xpath", ""), name) and
-          this = f.getACall().getArgument(0)
-        )
-        or
-        exists(Function f, string name | name.matches("Select%") |
-          f.hasQualifiedName(package("github.com/antchfx/xpath", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [htmlquery](https://github.com/antchfx/htmlquery) package.
-     */
-    private class AntchfxHtmlqueryXPathExpressionString extends Range {
-      AntchfxHtmlqueryXPathExpressionString() {
-        exists(Function f, string name | name.matches("Find%") |
-          f.hasQualifiedName(package("github.com/antchfx/htmlquery", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-        or
-        exists(Function f, string name | name.matches("Query%") |
-          f.hasQualifiedName(package("github.com/antchfx/htmlquery", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [xmlquery](https://github.com/antchfx/xmlquery) package.
-     */
-    private class AntchfxXmlqueryXPathExpressionString extends Range {
-      AntchfxXmlqueryXPathExpressionString() {
-        exists(Function f, string name | name.matches("Find%") |
-          f.hasQualifiedName(package("github.com/antchfx/xmlquery", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-        or
-        exists(Function f, string name | name.matches("Query%") |
-          f.hasQualifiedName(package("github.com/antchfx/xmlquery", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-        or
-        exists(Method m, string name | name.matches("Select%") |
-          m.hasQualifiedName(package("github.com/antchfx/xmlquery", ""), "Node", name) and
-          this = m.getACall().getArgument(0)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [jsonquery](https://github.com/antchfx/jsonquery) package.
-     */
-    private class AntchfxJsonqueryXPathExpressionString extends Range {
-      AntchfxJsonqueryXPathExpressionString() {
-        exists(Function f, string name | name.matches("Find%") |
-          f.hasQualifiedName(package("github.com/antchfx/jsonquery", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-        or
-        exists(Function f, string name | name.matches("Query%") |
-          f.hasQualifiedName(package("github.com/antchfx/jsonquery", ""), name) and
-          this = f.getACall().getArgument(1)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [xmlpath](https://github.com/go-xmlpath/xmlpath) package.
-     */
-    private class GoXmlpathXmlpathXPathExpressionString extends Range {
-      GoXmlpathXmlpathXPathExpressionString() {
-        exists(Function f, string name | name.matches("Compile%") |
-          f.hasQualifiedName(XmlPath::packagePath(), name) and
-          this = f.getACall().getArgument(0)
-        )
-        or
-        exists(Function f, string name | name.matches("MustCompile%") |
-          f.hasQualifiedName(XmlPath::packagePath(), name) and
-          this = f.getACall().getArgument(0)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [goxpath](https://github.com/ChrisTrenkamp/goxpath) package.
-     */
-    private class ChrisTrenkampGoxpathXPathExpressionString extends Range {
-      ChrisTrenkampGoxpathXPathExpressionString() {
-        exists(Function f, string name | name.matches("Parse%") |
-          f.hasQualifiedName(package("github.com/ChrisTrenkamp/goxpath", ""), name) and
-          this = f.getACall().getArgument(0)
-        )
-        or
-        exists(Function f, string name | name.matches("MustParse%") |
-          f.hasQualifiedName(package("github.com/ChrisTrenkamp/goxpath", ""), name) and
-          this = f.getACall().getArgument(0)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [lestrrat-go/libxml2](https://github.com/lestrrat-go/libxml2) package.
-     */
-    private class LestratGoLibxml2XPathExpressionString extends Range {
-      LestratGoLibxml2XPathExpressionString() {
-        exists(Method m, string name | name.matches("Parse%") |
-          m.hasQualifiedName(package("github.com/lestrrat-go/libxml2", "parser"), "Parser", name) and
-          this = m.getACall().getArgument(0)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [xpathparser](https://github.com/santhosh-tekuri/xpathparser) package.
-     */
-    private class SanthoshTekuriXpathparserXPathExpressionString extends Range {
-      SanthoshTekuriXpathparserXPathExpressionString() {
-        exists(Function f, string name | name.matches("Parse%") |
-          f.hasQualifiedName(package("github.com/santhosh-tekuri/xpathparser", ""), name) and
-          this = f.getACall().getArgument(0)
-        )
-        or
-        exists(Function f, string name | name.matches("MustParse%") |
-          f.hasQualifiedName(package("github.com/santhosh-tekuri/xpathparser", ""), name) and
-          this = f.getACall().getArgument(0)
-        )
-      }
-    }
-
-    /**
-     * An XPath expression string used in an API function of the
-     * [gokogiri]https://github.com/jbowtie/gokogiri) package.
-     */
-    private class JbowtieGokogiriXPathExpressionString extends Range {
-      JbowtieGokogiriXPathExpressionString() {
-        exists(Function f, string name | name.matches("Compile%") |
-          f.hasQualifiedName(package("github.com/jbowtie/gokogiri", "xpath"), name) and
-          this = f.getACall().getArgument(0)
-        )
-        or
-        exists(Method m, string name | name.matches("Search%") |
-          m.hasQualifiedName(package("github.com/jbowtie/gokogiri", "xml"), "Node", name) and
-          this = m.getACall().getArgument(0)
-        )
-        or
-        exists(Method m, string name | name.matches("EvalXPath%") |
-          m.hasQualifiedName(package("github.com/jbowtie/gokogiri", "xml"), "Node", name) and
-          this = m.getACall().getArgument(0)
-        )
-      }
+    private class DefaultXPathExpressionString extends Range {
+      DefaultXPathExpressionString() { sinkNode(this, "xpath-injection") }
     }
   }
 }
 
 /**
+ * DEPRECATED
+ *
  * Provides classes for working with the [xmlpath](https://gopkg.in/xmlpath.v2) package.
  */
-module XmlPath {
-  /** Gets the package name `github.com/go-xmlpath/xmlpath` or `gopkg.in/xmlpath`. */
-  string packagePath() {
+deprecated module XmlPath {
+  /**
+   * DEPRECATED
+   *
+   * Gets the package name `github.com/go-xmlpath/xmlpath` or `gopkg.in/xmlpath`.
+   */
+  deprecated string packagePath() {
     result = package(["github.com/go-xmlpath/xmlpath", "gopkg.in/xmlpath"], "")
   }
 }
diff --git a/go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected b/go/ql/test/query-tests/Security/CWE-643/XPathInjection.expected
