René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Go: Tainted data does not propagate data flow after append function","articleBody":"Go: v1.19.1 linux/amd64\r\nCodeQL: v2.11.0\r\n\r\nQuestion: Query the data flow results from the `input` parameter in the `source` function to the `name` parameter in the `sink` function.\r\n\r\n```go\r\npackage main\r\n\r\nimport (\r\n\t\"fmt\"\r\n)\r\n\r\ntype info struct {\r\n\tname string\r\n}\r\nfunc main() {\r\n\tsource(\"input\")\r\n}\r\n\r\nfunc source(input string) {\r\n\tvar data []info\r\n\tdata = append(data, info{\r\n\t\tname: input,\r\n\t})\r\n\tdao(data)\r\n\r\n}\r\n\r\nfunc dao(data []info) {\r\n\tfor _, item := range data {\r\n\t\tname := item.name\r\n\t\tsink(name)\r\n\t}\r\n}\r\n\r\nfunc sink(name string) {\r\n\tfmt.Println(name)\r\n}\r\n\r\n```\r\n\r\n\r\nThe following is my query statement. After execution, I did not get the expected results.\r\n\r\n\u003cimg width=\"1828\" alt=\"append_struct_result\" src=\"https://github.com/github/codeql/assets/48125429/bd01e325-adc9-4187-8e6e-1b60c7542d91\">\r\n\r\n\r\n```codeql\r\n/**\r\n * @kind path-problem\r\n */\r\n\r\nimport go\r\nimport DataFlow::PathGraph\r\n\r\nclass Configuration extends TaintTracking::Configuration {\r\n  Configuration() { this = \"Configuration\" }\r\n\r\n  override predicate isSource(DataFlow::Node source) {\r\n    exists(Function func | func.getName() = \"source\" | func.getParameter(0) = source.asParameter())\r\n  }\r\n\r\n  override predicate isSink(DataFlow::Node sink) {\r\n    exists(DataFlow::CallNode call | call.getTarget().getName() = \"sink\" |\r\n      call.getArgument(0) = sink\r\n    )\r\n  }\r\n}\r\n\r\nfrom Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink\r\nwhere cfg.hasFlowPath(source, sink)\r\nselect sink.getNode(), source, sink, \"Source: $@ , Sink: $@ .\", source.getNode(), source.toString(),\r\n  sink.getNode(), sink.toString()\r\n```\r\n\r\n\r\nWhen I debug using `DataFlow::PartialPathGraph`, it seems that the tainted data does not propagate the data flow after passing through the `append` function.\r\n\r\n\u003cimg width=\"1797\" alt=\"append_struct_partial\" src=\"https://github.com/github/codeql/assets/48125429/f2365c7b-2bff-4e0e-83ad-9c669e49cb05\">\r\n\r\n\r\n```codeql\r\n/**\r\n * @kind path-problem\r\n */\r\n\r\nimport go\r\nimport DataFlow::PartialPathGraph\r\n\r\nclass Configuration extends TaintTracking::Configuration {\r\n  Configuration() { this = \"Configuration\" }\r\n\r\n  override predicate isSource(DataFlow::Node source) {\r\n    exists(Function func | func.getName() = \"source\" | func.getParameter(0) = source.asParameter())\r\n  }\r\n\r\n  override predicate isSink(DataFlow::Node sink) {\r\n    exists(DataFlow::CallNode call | call.getTarget().getName() = \"sink\" |\r\n      call.getArgument(0) = sink\r\n    )\r\n  }\r\n\r\n  override int explorationLimit() { result = 5 }\r\n}\r\n\r\nfrom Configuration cfg, DataFlow::PartialPathNode source, DataFlow::PartialPathNode sink\r\nwhere cfg.hasPartialFlow(source, sink, _)\r\nselect sink.getNode(), source, sink, \"Source: $@ , Sink: $@ .\", source.getNode(), source.toString(), sink.getNode(), sink.toString()\r\n```\r\n\r\n\r\nHow to solve this problem?\r\n\r\n\r\n","author":{"url":"https://github.com/Jokuuy","@type":"Person","name":"Jokuuy"},"datePublished":"2023-09-01T03:42:17Z","url":"https://github.com/github/codeql/issues/14116"}