util

Documentation

Overview

Package util implements underlying functionality for building and traversing call graphs, configuraing and building analyzers and generating findings

Index

• Variables
• func CleanupModule(dir string) error
• func CloneModule(dir string, url string, branch string, keyFile string, quiet bool) error
• func GrabSourceCode(filename string, lineNumber int) string
• func InitConfig(globals bool, sarif bool, json bool, verbose bool, debug bool, ...)
• func InitSarifReporting()
• func IsValidFinding(finding Finding) bool
• func LoadScanConfig()
• func OutputFinding(finding Finding, outputColor bool)
• func OutputFindingMetadata(results []Finding, outputColor bool)
• func SSAvalToHash(val *ssa.Value) uint64
• func SarifPrintReport()
• func SarifRecordFinding(type_ string, message string, filename string, lineNumber int)
• func StripArguments(parentFunction string) string
• type Analyzer
• type CGRelation
• type CallGraph
  • func (cg CallGraph) AnalyzeFunctionO(fn *ssa.Function)
  • func (cg CallGraph) ResolveParam(p *ssa.Parameter) []*ssa.Value
• type ConfigFile
• type ConfigType
• type Finding
  • func MakeFinding(message string, vulnerable_function TaintedCode, ...) Finding
• type MapData
• type ReturnSet
  • func ReturnValues(fn *ssa.Function) []ReturnSet
• type Sources
• type TaintAnalyzer
  • func CreateTaintAnalyzer(pass *analysis.Pass, location token.Pos) TaintAnalyzer
  • func (ta *TaintAnalyzer) ContainsTaint(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph) bool
  • func (ta *TaintAnalyzer) ContainsTaintRecurse(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph, depth int, ...) bool
  • func (ta TaintAnalyzer) Memoize(val *ssa.Value, vulnerable bool)
• type TaintedCode
  • func GenerateTaintedCode(pass *analysis.Pass, parent *ssa.Function, position token.Pos) TaintedCode

Variables

var (
	FilesFound         = 0
	VulnGlobalVars     map[string][]string
	VulnGlobalFuncs    map[string][]string
	FiltersGlobalFuncs map[string][]string
	VulnTypes          map[string][]string
	//go:embed analyzers.yml
	DefaultAnalyzersContent []byte
)

var (
	Config     ConfigType
	ScanConfig ConfigFile
)

var AESFlat bool

var CallFlat bool

var Cwelist = map[string]bool{}

var Cwelist map[string]bool

var DESFlat bool

var SarifReport *sarif.Report

var SarifRun *sarif.Run

var StringFlat bool

Functions

func CleanupModule

func CleanupModule(dir string) error

CleanupModule attempts to delete a directory.

func CloneModule

func CloneModule(dir string, url string, branch string, keyFile string, quiet bool) error

CloneModule clones a remote git repository An optional keyfile may be specified for use in ssh authentication If quiet is true, don't print clone progress to stdout

func GrabSourceCode

func GrabSourceCode(filename string, lineNumber int) string

GrabSourceCode retrieves the specified line of source code from the specified file

func InitConfig

func InitConfig(globals bool, sarif bool, json bool, verbose bool, debug bool, output_path string, yml string, exitCode bool)

InitConfig() parses the flags and sets the corresponding Config variables

func InitSarifReporting

func InitSarifReporting()

func IsValidFinding

func IsValidFinding(finding Finding) bool

returns true if the finding was valid and false if the finding had the same source and sink

func LoadScanConfig

func LoadScanConfig()

func OutputFinding

func OutputFinding(finding Finding, outputColor bool)

prints out a finding

func OutputFindingMetadata

func OutputFindingMetadata(results []Finding, outputColor bool)

func SSAvalToHash

func SSAvalToHash(val *ssa.Value) uint64

SSAvalToHash returns the hash of an ssa.Value to be used in the Taint Map

func SarifPrintReport

func SarifPrintReport()

func SarifRecordFinding

func SarifRecordFinding(type_ string, message string, filename string, lineNumber int)

func StripArguments

func StripArguments(parentFunction string) string

Types

type Analyzer

type Analyzer struct {
	Doc       string              `yaml:"doc"`
	Message   string              `yaml:"message"`
	VulnCalls map[string][]string `yaml:"vuln_calls"`
}

Analyzer stores an analyzer parsed from the configuration file

type CGRelation

type CGRelation struct {
	Instr *ssa.Call
	Fn    *ssa.Function
}

CGRelation is a struct that contains information about an instruction and a function in the call graph

type CallGraph

type CallGraph map[string][]CGRelation

func (CallGraph) AnalyzeFunctionO

func (cg CallGraph) AnalyzeFunctionO(fn *ssa.Function)

AnalyzeFunction updates the CallGraph to contain relations between callee and caller functions. This should be called once on every function in a local package

func (CallGraph) ResolveParam

func (cg CallGraph) ResolveParam(p *ssa.Parameter) []*ssa.Value

ResolveParam returns the caller nodes of a parameter. This is used for tracing parameters back to their source.

type ConfigFile

type ConfigFile struct {
	Analyzers map[string]Analyzer `yaml:"analyzers"`
	Sources   Sources             `yaml:"sources"`
}

ConfigFile stores the values parsed from the configuration file

type ConfigType

type ConfigType struct {
	GlobalsSafe bool
	OutputSarif bool
	OutputJSON  bool
	Debug       bool
	Verbose     bool
	ExitCode    bool
	YMLPath     string
	OutputPath  string
}

ConfigType stores booleans for CryptoGo analysis configuration

type Finding

type Finding struct {
	Vulnerable_Function TaintedCode
	Untrusted_Source    []TaintedCode
	Type                string
	// contains filtered or unexported fields
}

Finding represents a single vulnerability

func MakeFinding

func MakeFinding(message string, vulnerable_function TaintedCode, untrusted_source []TaintedCode, finding_type string) Finding

Create a finding object

type MapData

type MapData struct {
	Mapped     bool // whether a hash has already been mapped
	Vulnerable bool // whether a hash has been found vulnerable
	Count      int  // the number of times a hash has been visited
}

MapData is a struct that contains information about each hash

type ReturnSet

type ReturnSet = []ssa.Value

func ReturnValues

func ReturnValues(fn *ssa.Function) []ReturnSet

ReturnValues returns a set of the return values of the function

type Sources

type Sources struct {
	Variables map[string][]string `yaml:"variables"`
	Functions map[string][]string `yaml:"functions"`
	Types     map[string][]string `yaml:"types"`
	// For compatibility with older analyzer.yml format
	OldSrcs *Sources `yaml:"sources"`
}

Sources stores the untrusted sources parsed from the configuration file

type TaintAnalyzer

type TaintAnalyzer struct {
	TaintSource []TaintedCode
	// contains filtered or unexported fields
}

TaintAnalyzer is a struct that contains information about each taint analyzer

func CreateTaintAnalyzer

func CreateTaintAnalyzer(pass *analysis.Pass, location token.Pos) TaintAnalyzer

CreateTaintAnalyzer returns a new TaintAnalyzer struct

func (*TaintAnalyzer) ContainsTaint

func (ta *TaintAnalyzer) ContainsTaint(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph) bool

ContainsTaint analyzes the ssa.Value, recursively traces the value to all possible sources, and returns True if any of the sources are vulnerable. It returns False otherwise.

func (*TaintAnalyzer) ContainsTaintRecurse

func (ta *TaintAnalyzer) ContainsTaintRecurse(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph, depth int, visitedMutable []ssa.Value) bool

func (TaintAnalyzer) Memoize

func (ta TaintAnalyzer) Memoize(val *ssa.Value, vulnerable bool)

Memoize hashes an ssa.Value and then adds it to the Taint Map while updating the metadata

type TaintedCode

type TaintedCode struct {
	SourceCode     string
	SourceFilename string
	SourceLineNum  int
	ParentFunction string
}

TaintedCode is a struct that contains information about the vulnerable line of code

func GenerateTaintedCode

func GenerateTaintedCode(pass *analysis.Pass, parent *ssa.Function, position token.Pos) TaintedCode

GenerateTaintedCode returns a TaintedCode struct that stores information (source code, filename, linenumber) for a line of code