Skip to content

Go: Promote non-httponly cookie query, and add insecure cookie query #20762

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joefarebrother merged 17 commits into from
Nov 25, 2025
Merged

Go: Promote non-httponly cookie query, and add insecure cookie query #20762

Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
7d76619
Implement cookie write concepts and httponly query
joefarebrother Nov 3, 2025
74c424d
Fixes, add secure query
joefarebrother Nov 5, 2025
5094784
Add modeling for gin
joefarebrother Nov 5, 2025
8d544e5
Add tests
joefarebrother Nov 6, 2025
2b1cd84
Fixes and doc updates
joefarebrother Nov 6, 2025
fa30041
Add qhelp & fix tests
joefarebrother Nov 9, 2025
536e885
Remove experimental query
joefarebrother Nov 10, 2025
d633120
Update integration tests
joefarebrother Nov 10, 2025
ed483dd
Add change note
joefarebrother Nov 10, 2025
a25861d
Update integration test
joefarebrother Nov 10, 2025
6282c34
Update formatting
joefarebrother Nov 10, 2025
1bd5005
Fix typos
joefarebrother Nov 10, 2025
03d63de
Address reviews - rename and update doc comments
joefarebrother Nov 17, 2025
5b702d9
Refactor parts of SensitiveCookieNameConfig
joefarebrother Nov 17, 2025
c6110ed
Split SecureCookies into query specific files
joefarebrother Nov 17, 2025
c7b16a0
Address reviews - update comments, remove unneeded stubs
joefarebrother Nov 19, 2025
cece73b
Remove references to gorilla
joefarebrother Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add modeling for gin
  • Loading branch information
@joefarebrother
joefarebrother committed Nov 25, 2025
commit 5094784a4bf33c83ac78e35c984fd6c3e1e3833c
24 changes: 24 additions & 0 deletions go/ql/lib/semmle/go/frameworks/Gin.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
/**
* Provides classes for modeling the `github.com/gin-gonic/gin` package.
*/

import go
import semmle.go.concepts.HTTP

/** Provides models for the `gin-gonic/gin` package. */
module Gin {
/** Gets the package name `github.com/gin-gonic/gin`. */
string packagePath() { result = package("github.com/gin-gonic/gin", "") }

private class GinCookieWrite extends Http::CookieWrite::Range, DataFlow::MethodCallNode {
GinCookieWrite() { this.getTarget().hasQualifiedName(packagePath(), "Context", "SetCookie") }

override DataFlow::Node getName() { result = this.getArgument(0) }

override DataFlow::Node getValue() { result = this.getArgument(1) }

override DataFlow::Node getSecure() { result = this.getArgument(5) }

override DataFlow::Node getHttpOnly() { result = this.getArgument(6) }
}
}