util

Documentation

Overview

Package util implements underlying functionality for building and traversing call graphs, configuraing and building analyzers and generating findings

Index

• Variables
• func CleanupModule(dir string) error
• func CloneModule(dir string, url string) error
• func GrabSourceCode(filename string, lineNumber int) string
• func InitConfig(globals bool, sarif bool, verbose bool, debug bool, output_path string, ...)
• func InitSarifReporting()
• func IsValidFinding(finding Finding) bool
• func LoadScanConfig()
• func OutputFinding(finding Finding)
• func ParseModuleName(mn string) (string, error)
• func SSAvalToHash(val *ssa.Value) uint64
• func SarifPrintReport()
• func SarifRecordFinding(type_ string, message string, filename string, lineNumber int)
• func StripArguments(parentFunction string) string
• type Analyzer
• type CGRelation
• type CallGraph
  • func (cg CallGraph) AnalyzeFunction(fn *ssa.Function)
  • func (cg CallGraph) ResolveParam(p *ssa.Parameter) []*ssa.Value
• type ConfigFile
• type ConfigType
• type Finding
  • func MakeFinding(message string, vulnerable_function TaintedCode, ...) Finding
• type MapData
• type ReturnSet
  • func ReturnValues(fn *ssa.Function) []ReturnSet
• type Sources
• type TaintAnalyzer
  • func CreateTaintAnalyzer(pass *analysis.Pass, location token.Pos) TaintAnalyzer
  • func (ta *TaintAnalyzer) ContainsTaint(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph) bool
  • func (ta *TaintAnalyzer) ContainsTaintRecurse(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph, depth int, ...) bool
  • func (ta TaintAnalyzer) Memoize(val *ssa.Value, vulnerable bool)
• type TaintedCode
  • func GenerateTaintedCode(pass *analysis.Pass, parent *ssa.Function, position token.Pos) TaintedCode

Variables

var (
	FilesFound      = 0
	VulnGlobalVars  map[string][]string
	VulnGlobalFuncs map[string][]string
	VulnTypes       map[string][]string
	//go:embed analyzers.yml
	DefaultAnalyzersContent []byte
)

var (
	Config     ConfigType
	ScanConfig ConfigFile
)

var SarifReport *sarif.Report

var SarifRun *sarif.Run

Functions

func CleanupModule

func CleanupModule(dir string) error

CleanupModule attempts to delete a directory.

func CloneModule

func CloneModule(dir string, url string) error

CloneModule clones a remote git repository over HTTP.

func GrabSourceCode

func GrabSourceCode(filename string, lineNumber int) string

GrabSourceCode retrieves the specified line of source code from the specified file

func InitConfig

func InitConfig(globals bool, sarif bool, verbose bool, debug bool, output_path string, yml string)

InitConfig() parses the flags and sets the corresponding Config variables

func InitSarifReporting

func InitSarifReporting()

func IsValidFinding

func IsValidFinding(finding Finding) bool

returns true if the finding was valid and false if the finding had the same source and sink

func LoadScanConfig

func LoadScanConfig()

func OutputFinding

func OutputFinding(finding Finding)

prints out a finding

func ParseModuleName

func ParseModuleName(mn string) (string, error)

ParseModuleName returns a directory from a module path

func SSAvalToHash

func SSAvalToHash(val *ssa.Value) uint64

SSAvalToHash returns the hash of an ssa.Value to be used in the Taint Map

func SarifPrintReport

func SarifPrintReport()

func SarifRecordFinding

func SarifRecordFinding(type_ string, message string, filename string, lineNumber int)

func StripArguments

func StripArguments(parentFunction string) string

Types

type Analyzer

type Analyzer struct {
	Doc       string              `yaml:"doc"`
	Message   string              `yaml:"message"`
	VulnCalls map[string][]string `yaml:"vuln_calls"`
}

Analyzer stores an analyzer parsed from the configuration file

type CGRelation

type CGRelation struct {
	Instr *ssa.Call
	Fn    *ssa.Function
}

CGRelation is a struct that contains information about an instruction and a function in the call graph

type CallGraph

type CallGraph map[string][]CGRelation

func (CallGraph) AnalyzeFunction

func (cg CallGraph) AnalyzeFunction(fn *ssa.Function)

AnalyzeFunction updates the CallGraph to contain relations between callee and caller functions. This should be called once on every function in a local package

func (CallGraph) ResolveParam

func (cg CallGraph) ResolveParam(p *ssa.Parameter) []*ssa.Value

ResolveParam returns the caller nodes of a parameter. This is used for tracing parameters back to their source.

type ConfigFile

type ConfigFile struct {
	Analyzers map[string]Analyzer `yaml:"analyzers"`
	Sources   Sources             `yaml:"sources"`
}

ConfigFile stores the values parsed from the configuration file

type ConfigType

type ConfigType struct {
	GlobalsSafe bool
	OutputSarif bool
	Debug       bool
	Verbose     bool
	YMLPath     string
	OutputPath  string
}

ConfigType stores booleans for GoKart analysis configuration

type Finding

type Finding struct {
	Vulnerable_Function TaintedCode
	Untrusted_Source    []TaintedCode
	Type                string
	// contains filtered or unexported fields
}

Finding represents a single vulnerability

func MakeFinding

func MakeFinding(message string, vulnerable_function TaintedCode, untrusted_source []TaintedCode, finding_type string) Finding

Create a finding object

type MapData

type MapData struct {
	Mapped     bool // whether a hash has already been mapped
	Vulnerable bool // whether a hash has been found vulnerable
	Count      int  // the number of times a hash has been visited
}

MapData is a struct that contains information about each hash

type ReturnSet

type ReturnSet = []ssa.Value

func ReturnValues

func ReturnValues(fn *ssa.Function) []ReturnSet

ReturnValues returns a set of the return values of the function

type Sources

type Sources struct {
	Variables map[string][]string `yaml:"variables"`
	Functions map[string][]string `yaml:"functions"`
	Types     map[string][]string `yaml:"types"`
	// For compatibility with older analyzer.yml format
	OldSrcs *Sources `yaml:"sources"`
}

Sources stores the untrusted sources parsed from the configuration file

type TaintAnalyzer

type TaintAnalyzer struct {
	TaintSource []TaintedCode
	// contains filtered or unexported fields
}

TaintAnalyzer is a struct that contains information about each taint analyzer

func CreateTaintAnalyzer

func CreateTaintAnalyzer(pass *analysis.Pass, location token.Pos) TaintAnalyzer

CreateTaintAnalyzer returns a new TaintAnalyzer struct

func (*TaintAnalyzer) ContainsTaint

func (ta *TaintAnalyzer) ContainsTaint(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph) bool

ContainsTaint analyzes the ssa.Value, recursively traces the value to all possible sources, and returns True if any of the sources are vulnerable. It returns False otherwise.

func (*TaintAnalyzer) ContainsTaintRecurse

func (ta *TaintAnalyzer) ContainsTaintRecurse(startCall *ssa.CallCommon, val *ssa.Value, cg CallGraph, depth int, visitedMutable []ssa.Value) bool

func (TaintAnalyzer) Memoize

func (ta TaintAnalyzer) Memoize(val *ssa.Value, vulnerable bool)

Memoize hashes an ssa.Value and then adds it to the Taint Map while updating the metadata

type TaintedCode

type TaintedCode struct {
	SourceCode     string
	SourceFilename string
	SourceLineNum  int
	ParentFunction string
}

TaintedCode is a struct that contains information about the vulnerable line of code

func GenerateTaintedCode

func GenerateTaintedCode(pass *analysis.Pass, parent *ssa.Function, position token.Pos) TaintedCode

GenerateTaintedCode returns a TaintedCode struct that stores information (source code, filename, linenumber) for a line of code