Update Go Path Injection Sanitizer and Sink #20064
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates the Go path injection query to improve sanitization detection and removes a false positive. The changes account for os.PathSeparator as a valid path sanitizer alongside hardcoded "/" and remove CreateTemp from path injection sinks due to proper built-in sanitization.
- Updates path injection sanitizers to recognize
os.PathSeparatorusage - Removes
CreateTempfrom path injection sinks in theospackage model - Adds test coverage for the new sanitizer pattern
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go/ql/test/query-tests/Security/CWE-022/TaintedPath.go | Adds test case for os.PathSeparator sanitization pattern |
| go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected | Updates expected test results for line number changes |
| go/ql/lib/ext/os.model.yml | Removes CreateTemp from path injection sinks |
| go/ql/lib/change-notes/2025-07-15-path-injection-sanitizers.md | Documents the changes in release notes |
Click to show differences in coveragegoGenerated file changes for go
- `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,609,104
+ `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``, ``weak``",52,609,103
- Totals,,688,1069,1557
+ Totals,,688,1069,1556
- os,29,12,6,3,,,,,26,,,,,,,,,,,1,,7,3,,1,6,
+ os,28,12,6,3,,,,,25,,,,,,,,,,,1,,7,3,,1,6, |
|
Sorry, I somehow forgot to add the actual CodeQL change. |
| concatNode.getOperand(0).asExpr().(StringLit).getValue() = "/" | ||
| or | ||
| exists(DeclaredConstant dc | | ||
| dc.hasQualifiedName("os", "PathSeparator") and | ||
| dc.getAReference() = concatNode.getOperand(0).asExpr().getAChildExpr*() | ||
| ) |
There was a problem hiding this comment.
If we use getStringValue on any reference of os.PathSeparator then we'll get its actual string value (the compiler knows what value a constant has). On Windows of course this is "\". So we can simplify this to:
| concatNode.getOperand(0).asExpr().(StringLit).getValue() = "/" | |
| or | |
| exists(DeclaredConstant dc | | |
| dc.hasQualifiedName("os", "PathSeparator") and | |
| dc.getAReference() = concatNode.getOperand(0).asExpr().getAChildExpr*() | |
| ) | |
| concatNode.getOperand(0).getStringValue() = ["/", "\"] |
The above code allows using the string literal "\" as well, which seems sensible for any code which is written to only be run on Windows. What do you think?
Account for os.PathSeparator in Go sanitizer and remove CreateTemp from valid sinks