Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Go: Add Log Injection query (CWE-117) #609

Merged
atorralba merged 5 commits into from
Nov 24, 2021
Merged

Go: Add Log Injection query (CWE-117) #609

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c886d10
Add Log Injection query
atorralba Nov 19, 2021
d4a20f1
Autoformat
atorralba Nov 19, 2021
c9332cd
Fix *Depth log levels in glog and klog
atorralba Nov 22, 2021
f2017b6
Fix stubs
atorralba Nov 22, 2021
cc8d9bd
Update ql/src/Security/CWE-117/LogInjection.qhelp
atorralba Nov 24, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
Prev Previous commit
Next Next commit
Fix stubs
  • Loading branch information
@atorralba
atorralba committed Nov 22, 2021
commit f2017b626e4cdcbcdd024ba832f3804f9c6525f3
36 changes: 16 additions & 20 deletions ql/test/query-tests/Security/CWE-117/LogInjection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
package main

//go:generate depstubber -vendor k8s.io/klog Verbose Info,Infof,Infoln,Error,Errorf,Errorln,Fatal,Fatalf,Fatalln,Exit,Exitf,Exitln
//go:generate depstubber -vendor k8s.io/klog Verbose Info,Infof,Infoln,Error,Errorf,Errorln,Fatal,Fatalf,Fatalln,Exit,Exitf,Exitln,V
//go:generate depstubber -vendor github.com/astaxie/beego "" Alert,Critical,Debug,Emergency,Error,Info,Informational,Notice,Trace,Warn,Warning
//go:generate depstubber -vendor github.com/astaxie/beego/logs "" NewLogger,Alert,Critical,Debug,Emergency,Error,Info,Informational,Notice,Trace,Warn,Warning
//go:generate depstubber -vendor github.com/astaxie/beego/utils "" Display
Expand Down Expand Up @@ -77,25 +77,21 @@ func handler(req *http.Request, ctx *goproxy.ProxyCtx) {
// k8s.io/klog
{
verbose := klog.V(0)
verbose.Info(username) // $ hasTaintFlow="username"
verbose.Infof(username) // $ hasTaintFlow="username"
verbose.Infoln(username) // $ hasTaintFlow="username"
klog.Info(username) // $ hasTaintFlow="username"
klog.InfoDepth(0, username) // $ hasTaintFlow="username"
klog.Infof(username) // $ hasTaintFlow="username"
klog.Infoln(username) // $ hasTaintFlow="username"
klog.Error(username) // $ hasTaintFlow="username"
klog.ErrorDepth(0, username) // $ hasTaintFlow="username"
klog.Errorf(username) // $ hasTaintFlow="username"
klog.Errorln(username) // $ hasTaintFlow="username"
klog.Fatal(username) // $ hasTaintFlow="username"
klog.FatalDepth(0, username) // $ hasTaintFlow="username"
klog.Fatalf(username) // $ hasTaintFlow="username"
klog.Fatalln(username) // $ hasTaintFlow="username"
klog.Exit(username) // $ hasTaintFlow="username"
klog.ExitDepth(0, username) // $ hasTaintFlow="username"
klog.Exitf(username) // $ hasTaintFlow="username"
klog.Exitln(username) // $ hasTaintFlow="username"
verbose.Info(username) // $ hasTaintFlow="username"
verbose.Infof(username) // $ hasTaintFlow="username"
verbose.Infoln(username) // $ hasTaintFlow="username"
klog.Info(username) // $ hasTaintFlow="username"
klog.Infof(username) // $ hasTaintFlow="username"
klog.Infoln(username) // $ hasTaintFlow="username"
klog.Error(username) // $ hasTaintFlow="username"
klog.Errorf(username) // $ hasTaintFlow="username"
klog.Errorln(username) // $ hasTaintFlow="username"
klog.Fatal(username) // $ hasTaintFlow="username"
klog.Fatalf(username) // $ hasTaintFlow="username"
klog.Fatalln(username) // $ hasTaintFlow="username"
klog.Exit(username) // $ hasTaintFlow="username"
klog.Exitf(username) // $ hasTaintFlow="username"
klog.Exitln(username) // $ hasTaintFlow="username"
}
// astaxie/beego
{
Expand Down
6 changes: 0 additions & 6 deletions ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/.gitignore
View file
Open in desktop

This file was deleted.

73 changes: 0 additions & 73 deletions ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/.travis.yml
View file
Open in desktop

This file was deleted.

52 changes: 0 additions & 52 deletions ...st/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/CONTRIBUTING.md
View file
Open in desktop

This file was deleted.

13 changes: 0 additions & 13 deletions ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/LICENSE
View file
Open in desktop

This file was deleted.

73 changes: 0 additions & 73 deletions ql/test/query-tests/Security/CWE-117/vendor/github.com/astaxie/beego/README.md
View file
Open in desktop

This file was deleted.

Loading