Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit 3b2e16e

Browse files
committed
Move text/template classes to TextTemplate module inside stdlib.
1 parent 0d5c7e3 commit 3b2e16e

2 files changed

Lines changed: 39 additions & 42 deletions

File tree

ql/src/semmle/go/frameworks/Stdlib.qll

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -578,48 +578,6 @@ module Strings {
578578
}
579579
}
580580

581-
/** Provides models of commonly used functions in the `text/template` package. */
582-
module Template {
583-
private class TemplateEscape extends EscapeFunction::Range {
584-
string kind;
585-
586-
TemplateEscape() {
587-
exists(string fn |
588-
fn.matches("HTMLEscape%") and kind = "html"
589-
or
590-
fn.matches("JSEscape%") and kind = "js"
591-
or
592-
fn.matches("URLQueryEscape%") and kind = "url"
593-
|
594-
this.hasQualifiedName("text/template", fn)
595-
or
596-
this.hasQualifiedName("html/template", fn)
597-
)
598-
}
599-
600-
override string kind() { result = kind }
601-
}
602-
603-
private class TextTemplateInstantiation extends TemplateInstantiation::Range,
604-
DataFlow::MethodCallNode {
605-
int dataArg;
606-
607-
TextTemplateInstantiation() {
608-
exists(string m | getTarget().hasQualifiedName("text/template", "Template", m) |
609-
m = "Execute" and
610-
dataArg = 1
611-
or
612-
m = "ExecuteTemplate" and
613-
dataArg = 2
614-
)
615-
}
616-
617-
override DataFlow::Node getTemplateArgument() { result = this.getReceiver() }
618-
619-
override DataFlow::Node getADataArgument() { result = this.getArgument(dataArg) }
620-
}
621-
}
622-
623581
/** Provides models of commonly used functions in the `net/url` package. */
624582
module URL {
625583
/** The `PathEscape` or `QueryEscape` function. */

ql/src/semmle/go/frameworks/stdlib/TextTemplate.qll

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,45 @@ import go
66

77
/** Provides models of commonly used functions in the `text/template` package. */
88
module TextTemplate {
9+
private class TemplateEscape extends EscapeFunction::Range {
10+
string kind;
11+
12+
TemplateEscape() {
13+
exists(string fn |
14+
fn.matches("HTMLEscape%") and kind = "html"
15+
or
16+
fn.matches("JSEscape%") and kind = "js"
17+
or
18+
fn.matches("URLQueryEscape%") and kind = "url"
19+
|
20+
this.hasQualifiedName("text/template", fn)
21+
or
22+
this.hasQualifiedName("html/template", fn)
23+
)
24+
}
25+
26+
override string kind() { result = kind }
27+
}
28+
29+
private class TextTemplateInstantiation extends TemplateInstantiation::Range,
30+
DataFlow::MethodCallNode {
31+
int dataArg;
32+
33+
TextTemplateInstantiation() {
34+
exists(string m | getTarget().hasQualifiedName("text/template", "Template", m) |
35+
m = "Execute" and
36+
dataArg = 1
37+
or
38+
m = "ExecuteTemplate" and
39+
dataArg = 2
40+
)
41+
}
42+
43+
override DataFlow::Node getTemplateArgument() { result = this.getReceiver() }
44+
45+
override DataFlow::Node getADataArgument() { result = this.getArgument(dataArg) }
46+
}
47+
948
private class FunctionModels extends TaintTracking::FunctionModel {
1049
FunctionInput inp;
1150
FunctionOutput outp;

0 commit comments

Comments
 (0)