Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update documentation on data flow in Go (and some small fixes for java) #18511

Open
wants to merge 14 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -172,7 +172,7 @@ Global data flow tracks data flow throughout the entire program, and is therefor
Using global data flow
~~~~~~~~~~~~~~~~~~~~~~

The global data flow library is used by implementing the signature ``DataFlow::ConfigSig`` and applying the module ``DataFlow::Global<ConfigSig>`` as follows:
We can use the global data flow library by implementing the signature ``DataFlow::ConfigSig`` and applying the module ``DataFlow::Global<ConfigSig>``:

.. code-block:: ql

Expand Down Expand Up @@ -314,7 +314,7 @@ Exercise 2: Write a query that finds all hard-coded strings used to create a ``h

Exercise 3: Write a class that represents flow sources from ``getenv``. (`Answer <#exercise-3>`__)

Exercise 4: Using the answers from 2 and 3, write a query which finds all global data flows from ``getenv`` to ``gethostbyname``. (`Answer <#exercise-4>`__)
Exercise 4: Using the answers from 2 and 3, write a query which finds all global data flow paths from ``getenv`` to ``gethostbyname``. (`Answer <#exercise-4>`__)

Answers
-------
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,7 @@ Local taint tracking extends local data flow by including non-value-preserving f

.. code-block:: csharp

var temp = x;
var y = temp + ", " + temp;
var y = "Hello " + x;

If ``x`` is a tainted string then ``y`` is also tainted.

Expand Down Expand Up @@ -104,7 +103,7 @@ Unfortunately this will only give the expression in the argument, not the values
and DataFlow::localFlow(DataFlow::exprNode(src), DataFlow::exprNode(call.getArgument(0)))
select src

Then we can make the source more specific, for example an access to a public parameter. This query finds instances where a public parameter is used to open a file:
To restrict sources to only an access to a public parameter, rather than arbitrary expressions, we can modify this query as follows:

.. code-block:: ql

Expand All @@ -117,7 +116,7 @@ Then we can make the source more specific, for example an access to a public par
and call.getEnclosingCallable().(Member).isPublic()
select p, "Opening a file from a public method."

This query finds calls to ``String.Format`` where the format string isn't hard-coded:
The following query finds calls to ``String.Format`` where the format string isn't hard-coded:

.. code-block:: ql

Expand Down Expand Up @@ -148,7 +147,7 @@ Global data flow tracks data flow throughout the entire program, and is therefor
Using global data flow
~~~~~~~~~~~~~~~~~~~~~~

The global data flow library is used by implementing the signature ``DataFlow::ConfigSig`` and applying the module ``DataFlow::Global<ConfigSig>``:
We can use the global data flow library by implementing the signature ``DataFlow::ConfigSig`` and applying the module ``DataFlow::Global<ConfigSig>``:

.. code-block:: ql

Expand All @@ -170,8 +169,8 @@ These predicates are defined in the configuration:

- ``isSource`` - defines where data may flow from.
- ``isSink`` - defines where data may flow to.
- ``isBarrier`` - optionally, restricts the data flow.
- ``isAdditionalFlowStep`` - optionally, adds additional flow steps.
- ``isBarrier`` - optional, defines where data flow is blocked.
- ``isAdditionalFlowStep`` - optional, adds additional flow steps.

The data flow analysis is performed using the predicate ``flow(DataFlow::Node source, DataFlow::Node sink)``:

Expand Down Expand Up @@ -288,7 +287,7 @@ Exercise 2: Find all hard-coded strings passed to ``System.Uri``, using global d

Exercise 3: Define a class that represents flow sources from ``System.Environment.GetEnvironmentVariable``. (`Answer <#exercise-3>`__)

Exercise 4: Using the answers from 2 and 3, write a query to find all global data flow from ``System.Environment.GetEnvironmentVariable`` to ``System.Uri``. (`Answer <#exercise-4>`__)
Exercise 4: Using the answers from 2 and 3, write a query which finds all global data flow paths from ``System.Environment.GetEnvironmentVariable`` to ``System.Uri``. (`Answer <#exercise-4>`__)

Extending library data flow
---------------------------
Expand Down
Loading