Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 1b49bcc

Browse files
owen-mcowen-mc
committed
Put code snippets from qhelp in test folder
1 parent 336eba1 commit 1b49bcc

4 files changed

Lines changed: 73 additions & 55 deletions

File tree

‎ql/test/query-tests/Security/CWE-640/EmailBad.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package main
2+
3+
import (
4+
"net/http"
5+
"net/smtp"
6+
)
7+
8+
func mail(w http.ResponseWriter, r *http.Request) {
9+
host := r.Header.Get("Host")
10+
token := backend.getUserSecretResetToken(email)
11+
body := "Click to reset password: " + host + "/" + token
12+
smtp.SendMail("test.test", nil, "from@from.com", nil, []byte(body))
13+
}

‎ql/test/query-tests/Security/CWE-640/EmailGood.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package main
2+
3+
import (
4+
"net/http"
5+
"net/smtp"
6+
)
7+
8+
func mailGood(w http.ResponseWriter, r *http.Request) {
9+
host := config["Host"]
10+
token := backend.getUserSecretResetToken(email)
11+
body := "Click to reset password: " + host + "/" + token
12+
smtp.SendMail("test.test", nil, "from@from.com", nil, []byte(body))
13+
}

‎ql/test/query-tests/Security/CWE-640/EmailInjection.expected‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,43 @@
11
edges
2-
| email.go:24:10:24:17 | selection of Header : Header | email.go:27:56:27:67 | type conversion |
3-
| email.go:34:21:34:31 | call to Referer : string | email.go:36:57:36:78 | type conversion |
4-
| email.go:42:21:42:31 | call to Referer : string | email.go:45:3:45:7 | definition of write |
5-
| email.go:51:21:51:31 | call to Referer : string | email.go:57:46:57:59 | untrustedInput |
6-
| email.go:51:21:51:31 | call to Referer : string | email.go:58:52:58:65 | untrustedInput |
7-
| email.go:63:21:63:31 | call to Referer : string | email.go:68:16:68:22 | content |
8-
| email.go:73:21:73:31 | call to Referer : string | email.go:81:50:81:56 | content |
9-
| email.go:73:21:73:31 | call to Referer : string | email.go:81:59:81:65 | content |
10-
| email.go:73:21:73:31 | call to Referer : string | email.go:82:16:82:22 | content |
11-
| email.go:87:21:87:31 | call to Referer : string | email.go:94:37:94:50 | untrustedInput |
12-
| email.go:87:21:87:31 | call to Referer : string | email.go:98:16:98:23 | content2 |
2+
| EmailBad.go:9:10:9:17 | selection of Header : Header | EmailBad.go:12:56:12:67 | type conversion |
3+
| main.go:26:21:26:31 | call to Referer : string | main.go:28:57:28:78 | type conversion |
4+
| main.go:34:21:34:31 | call to Referer : string | main.go:37:3:37:7 | definition of write |
5+
| main.go:43:21:43:31 | call to Referer : string | main.go:49:46:49:59 | untrustedInput |
6+
| main.go:43:21:43:31 | call to Referer : string | main.go:50:52:50:65 | untrustedInput |
7+
| main.go:55:21:55:31 | call to Referer : string | main.go:60:16:60:22 | content |
8+
| main.go:65:21:65:31 | call to Referer : string | main.go:73:50:73:56 | content |
9+
| main.go:65:21:65:31 | call to Referer : string | main.go:73:59:73:65 | content |
10+
| main.go:65:21:65:31 | call to Referer : string | main.go:74:16:74:22 | content |
11+
| main.go:79:21:79:31 | call to Referer : string | main.go:86:37:86:50 | untrustedInput |
12+
| main.go:79:21:79:31 | call to Referer : string | main.go:90:16:90:23 | content2 |
1313
nodes
14-
| email.go:24:10:24:17 | selection of Header : Header | semmle.label | selection of Header : Header |
15-
| email.go:27:56:27:67 | type conversion | semmle.label | type conversion |
16-
| email.go:34:21:34:31 | call to Referer : string | semmle.label | call to Referer : string |
17-
| email.go:36:57:36:78 | type conversion | semmle.label | type conversion |
18-
| email.go:42:21:42:31 | call to Referer : string | semmle.label | call to Referer : string |
19-
| email.go:45:3:45:7 | definition of write | semmle.label | definition of write |
20-
| email.go:51:21:51:31 | call to Referer : string | semmle.label | call to Referer : string |
21-
| email.go:57:46:57:59 | untrustedInput | semmle.label | untrustedInput |
22-
| email.go:58:52:58:65 | untrustedInput | semmle.label | untrustedInput |
23-
| email.go:63:21:63:31 | call to Referer : string | semmle.label | call to Referer : string |
24-
| email.go:68:16:68:22 | content | semmle.label | content |
25-
| email.go:73:21:73:31 | call to Referer : string | semmle.label | call to Referer : string |
26-
| email.go:81:50:81:56 | content | semmle.label | content |
27-
| email.go:81:59:81:65 | content | semmle.label | content |
28-
| email.go:82:16:82:22 | content | semmle.label | content |
29-
| email.go:87:21:87:31 | call to Referer : string | semmle.label | call to Referer : string |
30-
| email.go:94:37:94:50 | untrustedInput | semmle.label | untrustedInput |
31-
| email.go:98:16:98:23 | content2 | semmle.label | content2 |
14+
| EmailBad.go:9:10:9:17 | selection of Header : Header | semmle.label | selection of Header : Header |
15+
| EmailBad.go:12:56:12:67 | type conversion | semmle.label | type conversion |
16+
| main.go:26:21:26:31 | call to Referer : string | semmle.label | call to Referer : string |
17+
| main.go:28:57:28:78 | type conversion | semmle.label | type conversion |
18+
| main.go:34:21:34:31 | call to Referer : string | semmle.label | call to Referer : string |
19+
| main.go:37:3:37:7 | definition of write | semmle.label | definition of write |
20+
| main.go:43:21:43:31 | call to Referer : string | semmle.label | call to Referer : string |
21+
| main.go:49:46:49:59 | untrustedInput | semmle.label | untrustedInput |
22+
| main.go:50:52:50:65 | untrustedInput | semmle.label | untrustedInput |
23+
| main.go:55:21:55:31 | call to Referer : string | semmle.label | call to Referer : string |
24+
| main.go:60:16:60:22 | content | semmle.label | content |
25+
| main.go:65:21:65:31 | call to Referer : string | semmle.label | call to Referer : string |
26+
| main.go:73:50:73:56 | content | semmle.label | content |
27+
| main.go:73:59:73:65 | content | semmle.label | content |
28+
| main.go:74:16:74:22 | content | semmle.label | content |
29+
| main.go:79:21:79:31 | call to Referer : string | semmle.label | call to Referer : string |
30+
| main.go:86:37:86:50 | untrustedInput | semmle.label | untrustedInput |
31+
| main.go:90:16:90:23 | content2 | semmle.label | content2 |
3232
#select
33-
| email.go:27:56:27:67 | type conversion | email.go:24:10:24:17 | selection of Header : Header | email.go:27:56:27:67 | type conversion | Email content may contain $@. | email.go:24:10:24:17 | selection of Header | untrusted input |
34-
| email.go:36:57:36:78 | type conversion | email.go:34:21:34:31 | call to Referer : string | email.go:36:57:36:78 | type conversion | Email content may contain $@. | email.go:34:21:34:31 | call to Referer | untrusted input |
35-
| email.go:45:3:45:7 | definition of write | email.go:42:21:42:31 | call to Referer : string | email.go:45:3:45:7 | definition of write | Email content may contain $@. | email.go:42:21:42:31 | call to Referer | untrusted input |
36-
| email.go:57:46:57:59 | untrustedInput | email.go:51:21:51:31 | call to Referer : string | email.go:57:46:57:59 | untrustedInput | Email content may contain $@. | email.go:51:21:51:31 | call to Referer | untrusted input |
37-
| email.go:58:52:58:65 | untrustedInput | email.go:51:21:51:31 | call to Referer : string | email.go:58:52:58:65 | untrustedInput | Email content may contain $@. | email.go:51:21:51:31 | call to Referer | untrusted input |
38-
| email.go:68:16:68:22 | content | email.go:63:21:63:31 | call to Referer : string | email.go:68:16:68:22 | content | Email content may contain $@. | email.go:63:21:63:31 | call to Referer | untrusted input |
39-
| email.go:81:50:81:56 | content | email.go:73:21:73:31 | call to Referer : string | email.go:81:50:81:56 | content | Email content may contain $@. | email.go:73:21:73:31 | call to Referer | untrusted input |
40-
| email.go:81:59:81:65 | content | email.go:73:21:73:31 | call to Referer : string | email.go:81:59:81:65 | content | Email content may contain $@. | email.go:73:21:73:31 | call to Referer | untrusted input |
41-
| email.go:82:16:82:22 | content | email.go:73:21:73:31 | call to Referer : string | email.go:82:16:82:22 | content | Email content may contain $@. | email.go:73:21:73:31 | call to Referer | untrusted input |
42-
| email.go:94:37:94:50 | untrustedInput | email.go:87:21:87:31 | call to Referer : string | email.go:94:37:94:50 | untrustedInput | Email content may contain $@. | email.go:87:21:87:31 | call to Referer | untrusted input |
43-
| email.go:98:16:98:23 | content2 | email.go:87:21:87:31 | call to Referer : string | email.go:98:16:98:23 | content2 | Email content may contain $@. | email.go:87:21:87:31 | call to Referer | untrusted input |
33+
| EmailBad.go:12:56:12:67 | type conversion | EmailBad.go:9:10:9:17 | selection of Header : Header | EmailBad.go:12:56:12:67 | type conversion | Email content may contain $@. | EmailBad.go:9:10:9:17 | selection of Header | untrusted input |
34+
| main.go:28:57:28:78 | type conversion | main.go:26:21:26:31 | call to Referer : string | main.go:28:57:28:78 | type conversion | Email content may contain $@. | main.go:26:21:26:31 | call to Referer | untrusted input |
35+
| main.go:37:3:37:7 | definition of write | main.go:34:21:34:31 | call to Referer : string | main.go:37:3:37:7 | definition of write | Email content may contain $@. | main.go:34:21:34:31 | call to Referer | untrusted input |
36+
| main.go:49:46:49:59 | untrustedInput | main.go:43:21:43:31 | call to Referer : string | main.go:49:46:49:59 | untrustedInput | Email content may contain $@. | main.go:43:21:43:31 | call to Referer | untrusted input |
37+
| main.go:50:52:50:65 | untrustedInput | main.go:43:21:43:31 | call to Referer : string | main.go:50:52:50:65 | untrustedInput | Email content may contain $@. | main.go:43:21:43:31 | call to Referer | untrusted input |
38+
| main.go:60:16:60:22 | content | main.go:55:21:55:31 | call to Referer : string | main.go:60:16:60:22 | content | Email content may contain $@. | main.go:55:21:55:31 | call to Referer | untrusted input |
39+
| main.go:73:50:73:56 | content | main.go:65:21:65:31 | call to Referer : string | main.go:73:50:73:56 | content | Email content may contain $@. | main.go:65:21:65:31 | call to Referer | untrusted input |
40+
| main.go:73:59:73:65 | content | main.go:65:21:65:31 | call to Referer : string | main.go:73:59:73:65 | content | Email content may contain $@. | main.go:65:21:65:31 | call to Referer | untrusted input |
41+
| main.go:74:16:74:22 | content | main.go:65:21:65:31 | call to Referer : string | main.go:74:16:74:22 | content | Email content may contain $@. | main.go:65:21:65:31 | call to Referer | untrusted input |
42+
| main.go:86:37:86:50 | untrustedInput | main.go:79:21:79:31 | call to Referer : string | main.go:86:37:86:50 | untrustedInput | Email content may contain $@. | main.go:79:21:79:31 | call to Referer | untrusted input |
43+
| main.go:90:16:90:23 | content2 | main.go:79:21:79:31 | call to Referer : string | main.go:90:16:90:23 | content2 | Email content may contain $@. | main.go:79:21:79:31 | call to Referer | untrusted input |

ql/test/query-tests/Security/CWE-640/email.go renamed to ql/test/query-tests/Security/CWE-640/main.go

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,15 @@ import (
1111
sendgrid "github.com/sendgrid/sendgrid-go/helpers/mail"
1212
)
1313

14-
// OK
15-
func mailGood(w http.ResponseWriter, r *http.Request) {
16-
host := config["Host"]
17-
token := backend.getUserSecretResetToken(email)
18-
body := "Click to reset password: " + host + "/" + token
19-
smtp.SendMail("test.test", nil, "from@from.com", nil, []byte(body))
20-
}
14+
func main() {
15+
var w http.ResponseWriter
16+
var r *http.Request
2117

22-
// Not OK
23-
func mail(w http.ResponseWriter, r *http.Request) {
24-
host := r.Header.Get("Host")
25-
token := backend.getUserSecretResetToken(email)
26-
body := "Click to reset password: " + host + "/" + token
27-
smtp.SendMail("test.test", nil, "from@from.com", nil, []byte(body))
28-
}
18+
// Not OK
19+
mail(w, r)
2920

30-
func main() {
21+
// OK
22+
mailGood(w, r)
3123

3224
// Not OK
3325
http.HandleFunc("/ex0", func(w http.ResponseWriter, r *http.Request) {

0 commit comments

Comments
 (0)