diff --git a/dhscanner-kbgen.cabal b/dhscanner-kbgen.cabal --- a/dhscanner-kbgen.cabal +++ b/dhscanner-kbgen.cabal @@ -33,7 +33,7 @@ * explain in plain English your query's purpose * et voilà ! -version: 1.0.25 +version: 1.0.26 license: GPL-3.0-only license-file: LICENSE author: OrenGitHub @@ -59,8 +59,8 @@ aeson < 2.3, base >= 4.18 && < 4.19, containers < 0.7, - dhscanner-ast >= 1.1.4, - dhscanner-bitcode >= 1.0.14 + dhscanner-ast >= 1.1.5, + dhscanner-bitcode >= 1.0.16 hs-source-dirs: src diff --git a/src/Kbgen.hs b/src/Kbgen.hs --- a/src/Kbgen.hs +++ b/src/Kbgen.hs @@ -55,10 +55,11 @@ KeywordArgForCall(..), ParamResolvedType(..), ClassDef(..), + FuncDef(..), + Call1stPartyFuncDefinedInDir(..), ParamName(..), CallMethodOfClass(..), ConstString(..), - ArgForCall(..), MethodOfClass(..), ClassHas1stPartySuper(..), ClassHas3rdPartySuper(..), @@ -82,10 +83,13 @@ Resolved(..), ArgIndex(..), ParamIndex(..), + FuncName(..), MethodName(..), ResolvedType(..), CallResolved(..), ResolvedSuper(..), + FuncDefinedInFile(..), + FuncDefinedInDir(..), ClassDefinedInFile(..), SuperDefinedInFile(..), SuperQualifiedName(..), @@ -235,6 +239,116 @@ -- | -- +-- __Name__ +-- +-- This is how the fact will look inside the Prolog file +-- +-- @ +-- kb_func_def( Func, Name, DefinedInFile ). +-- @ +-- +-- __When should I use this fact__ ( motivation: [CVE-2024-29028](https://nvd.nist.gov/vuln/detail/CVE-2024-29028) ) +-- +-- @ +-- # http_getter.go +-- g.GET("/get/httpmeta", func(c echo.Context) error { +-- urlStr := c.QueryParam("url") +-- ... +-- getter.GetHTMLMeta(urlStr) +-- +-- # html_meta.go +-- func GetHTMLMeta(urlStr string) (*HTMLMeta, error) { +-- ... +-- http.Get(urlStr) +-- @ +-- +-- See complete source example [here](https://github.com/usememos/memos/blob/v0.14.0/api/v1/http_getter.go#L23), +-- and [here](https://github.com/usememos/memos/blob/v0.14.0/plugin/http-getter/html_meta.go#L24) +-- +-- __Writing a predicate with this fact and others__ ( motivation: [CVE-2024-29028](https://nvd.nist.gov/vuln/detail/CVE-2024-29028) ) +-- +-- @ +-- suspected_ssrf_sink( Func ) :- +-- kb_resolved_call( Call, \'net/http.Get\' ), +-- kb_arg_i_for_call( Arg, 0, Call ), +-- utils_dataflow_path( Param, Arg ), +-- kb_param_has_resolved_type( Param, \'string\' ), +-- kb_param_i_of_callable( Param, _, Func ), +-- kb_func_def( Func, Name, _, FuncDefinedInDir ), +-- kb_call_1st_party_func_defined_in_dir( _, Name, FuncDefinedInDir ). +-- @ +-- +-- Other facts combined in this predicate: +-- +-- * 'CallResolved' +-- * 'ArgiForCall' +-- * 'ParamResolvedType' +-- * 'ParamiOfCallable' +-- * 'Call1stPartyFuncDefinedInDir' +-- +data FuncDef = FuncDef + Func -- ^ + Token.FuncName -- ^ + FuncDefinedInFile -- ^ + FuncDefinedInDir -- ^ + deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) + +-- | +-- +-- __Name__ +-- +-- This is how the fact will look inside the Prolog file +-- +-- @ +-- kb_call_1st_party_func_defined_in_dir( Call, Name, DefinedInDir ). +-- @ +-- +-- __When should I use this fact__ ( motivation: [CVE-2024-29028](https://nvd.nist.gov/vuln/detail/CVE-2024-29028) ) +-- +-- @ +-- # http_getter.go +-- g.GET("/get/httpmeta", func(c echo.Context) error { +-- urlStr := c.QueryParam("url") +-- ... +-- getter.GetHTMLMeta(urlStr) +-- +-- # html_meta.go +-- func GetHTMLMeta(urlStr string) (*HTMLMeta, error) { +-- ... +-- http.Get(urlStr) +-- @ +-- +-- See complete source example [here](https://github.com/usememos/memos/blob/v0.14.0/api/v1/http_getter.go#L23), +-- and [here](https://github.com/usememos/memos/blob/v0.14.0/plugin/http-getter/html_meta.go#L24) +-- +-- __Writing a predicate with this fact and others__ ( motivation: [CVE-2024-29028](https://nvd.nist.gov/vuln/detail/CVE-2024-29028) ) +-- +-- @ +-- suspected_ssrf_sink( Func ) :- +-- kb_resolved_call( Call, \'net/http.Get\' ), +-- kb_arg_i_for_call( Arg, 0, Call ), +-- utils_dataflow_path( Param, Arg ), +-- kb_param_has_resolved_type( Param, \'string\' ), +-- kb_param_i_of_callable( Param, _, Func ), +-- kb_func_def( Func, Name, _, FuncDefinedInDir ), +-- kb_call_1st_party_func_from_dir( _, Name, FuncDefinedInDir ). +-- @ +-- +-- Other facts combined in this predicate: +-- +-- * 'CallResolved' +-- * 'ArgiForCall' +-- * 'ParamResolvedType' +-- * 'ParamiOfCallable' +-- +data Call1stPartyFuncDefinedInDir = Call1stPartyFuncDefinedInDir + Call -- ^ + FuncName -- ^ + FuncDefinedInDir -- ^ + deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) + +-- | +-- -- __Description:__ -- -- Input parameter of some callable ( method, function, lambda ) has the specified name @@ -555,8 +669,12 @@ -- -- ==== __Tip 💡__ -- --- sometimes the exact index is irrelevant, see 'ArgForCall' +-- When the exact index is irrelevant, use: -- +-- @ +-- kb_arg_i_for_call( Arg, _, Call ). +-- @ +-- data ArgiForCall = ArgiForCall Arg -- ^ ArgIndex -- ^ @@ -565,39 +683,73 @@ -- | -- --- Usage: +-- __Name__ -- +-- This is how the fact will look inside the Prolog file +-- -- @ --- arg_for_call( Arg, Call ). +-- kb_param_i_of_callable( Param, Index, Callable ). -- @ -- --- ==== __Tip 💡__ +-- __When should I use this fact__ ( motivation: [CVE-2024-29028](https://nvd.nist.gov/vuln/detail/CVE-2024-29028) ) -- --- sometimes the exact index is irrelevant, see 'ArgForCall' +-- @ +-- # http_getter.go +-- g.GET("/get/httpmeta", func(c echo.Context) error { +-- urlStr := c.QueryParam("url") +-- ... +-- getter.GetHTMLMeta(urlStr) -- -data ArgForCall = ArgForCall - Arg -- ^ - Call -- ^ - deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) - --- | +-- # html_meta.go +-- func GetHTMLMeta(urlStr string) (*HTMLMeta, error) { +-- ... +-- http.Get(urlStr) +-- @ -- --- Usage: +-- See complete source example [here](https://github.com/usememos/memos/blob/v0.14.0/api/v1/http_getter.go#L23), +-- and [here](https://github.com/usememos/memos/blob/v0.14.0/plugin/http-getter/html_meta.go#L24) -- +-- __Writing a predicate with this fact and others__ ( motivation: [CVE-2024-29028](https://nvd.nist.gov/vuln/detail/CVE-2024-29028) ) +-- -- @ --- ParamiOfCallable( Param, Index, Callable ). +-- suspected_ssrf_sink( Func ) :- +-- kb_resolved_call( Call, \'net/http.Get\' ), +-- kb_arg_i_for_call( Arg, 0, Call ), +-- utils_dataflow_path( Param, Arg ), +-- kb_param_has_resolved_type( Param, \'string\' ), +-- kb_param_i_of_callable( Param, _, Func ), +-- kb_func_def( Func, Name, _, FuncDefinedInDir ), +-- kb_call_1st_party_func_defined_in_dir( _, Name, FuncDefinedInDir ). -- @ -- +-- Other facts combined in this predicate: +-- +-- * 'CallResolved' +-- * 'ArgiForCall' +-- * 'ParamResolvedType' +-- * 'FuncDef' +-- * 'Call1stPartyFuncDefinedInDir' +-- -- ==== __Tip 💡__ -- --- sometimes the exact index is irrelevant, see 'Arg_for_Call' +-- When the _exact index_ is _irrelevant_, use: -- +-- @ +-- kb_param_i_of_callable( Param, _, Callable ). +-- @ +-- data ParamiOfCallable = ParamiOfCallable Param -- ^ ParamIndex -- ^ 0-based Callable -- ^ deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) +data CallResolved = CallResolved + Call -- ^ + Resolved -- ^ + deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) + + -- | -- -- Usage: @@ -635,13 +787,9 @@ data Param = Param Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data Class = Class Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) -data CallResolved = CallResolved - Call -- ^ - Resolved -- ^ - deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) - data To = To Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data From = From Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) +data Func = Func Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data Method = Method Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data Callable = Callable Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data ConstStr = ConstStr Location deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) @@ -652,10 +800,13 @@ data Resolved = Resolved Fqn.Fqn deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data ArgIndex = ArgIndex Word deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data ParamIndex = ParamIndex Word deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) +data FuncName = FuncName String deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data MethodName = MethodName String deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data ConstStrValue = ConstStrValue String deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data SuperQualifiedName = SuperQualifiedName Fqn.Fqn deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) +data FuncDefinedInDir = FuncDefinedInDir FilePath deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) +data FuncDefinedInFile = FuncDefinedInFile FilePath deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data ClassDefinedInFile = ClassDefinedInFile FilePath deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) data SuperDefinedInFile = SuperDefinedInFile FilePath deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON ) @@ -674,7 +825,6 @@ data Fact = ClassDefCtor ClassDef | ParamNameCtor ParamName - | ArgForCallCtor ArgForCall | ArgiForCallCtor ArgiForCall | ConstStringCtor ConstString | DataflowEdgeCtor DataflowEdge @@ -704,7 +854,6 @@ prologify :: Fact -> String prologify (ParamNameCtor content) = prologify_ParamName content prologify (ClassDefCtor content) = prologify_ClassDef content -prologify (ArgForCallCtor content) = prologifyArgForCall content prologify (ArgiForCallCtor content) = prologifyArgiForCall content prologify (ConstStringCtor content) = prologify_ConstString content prologify (DataflowEdgeCtor content) = prologify_DataflowEdge content @@ -775,12 +924,6 @@ prologify_ConstBoolTrue :: ConstBoolTrue -> String prologify_ConstBoolTrue (ConstBoolTrue trueValue) = prologify_ConstBoolTrue' trueValue - -prologifyArgForCall' :: Location -> Location -> String -prologifyArgForCall' a c = printf "kb_arg_for_call( %s, %s )." (locationify a) (locationify c) - -prologifyArgForCall :: ArgForCall -> String -prologifyArgForCall (ArgForCall (Arg a) (Call c)) = prologifyArgForCall' a c prologify_MethodOfClass' :: Location -> Location -> String prologify_MethodOfClass' m c = printf "kb_method_of_class( %s, %s )." (locationify m) (locationify c)