Go: Improve incorrect integer conversion #13949

owen-mc · 2023-08-11T15:29:56Z

All tests pass, including some that we weren't able to spot before (parse uint32 and then assign to int32, for example). Things left to do:

fix treatment of architecture-dependent types. New idea: have two flow states at an architecture-dependent source and encode in the flow state that the int-size has been assumed to be 32 or 64 bit, then try to refer to that when doing calculations later. This will make the two flow state branches more similar and hopefully make it clearer what's going on in various places.
Add more qldoc, make variable names more consistent.
check if we recover any of the results lost when we switched the backend of the data flow library to the new API.
Consider whether to do lower bounds as well as upper bounds. Separate query? Could the logic be shared somehow, e.g. making it into a parameterized module?

This has one problem: we aren't able to properly set sinks to be barriers, to avoid the issue that we get flows from a source A to sink1, and also from A to sink1 and then on to sink2, and so on. These are seen in SPURIOUS results in: go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.go

go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll

@@ -17,11 +17,12 @@
 * Get the size of `int` or `uint` in `file`, or 0 if it is
 * architecture-specific.
 */
-int getIntTypeBitSize(File file) {
+bindingset[architectureSpecificBitSize]
+int getIntTypeBitSize(File file, int architectureSpecificBitSize) {


owen-mc added 6 commits August 11, 2023 10:52

Add isSigned to IntegerParsers

cd63598

Always use getters for FlowState

f536274

WIP refactor github#2

38c9c18

Refactor github#2

3d0229a

More tweaks

b596a81

github-actions bot added the Go label Aug 11, 2023

github-code-scanning bot found potential problems Aug 11, 2023

View reviewed changes

Go: Improve incorrect integer conversion #13949

Are you sure you want to change the base?

Go: Improve incorrect integer conversion #13949

Conversation

owen-mc commented Aug 11, 2023