Write a package for data flow analysis

[ccojocar]

Summary

Write a package which implements various primitives for data flow analysis. This package can be used by the rules to perform taint analysis, or other security checks.

godoctor/analysis has already some data flow analysis on which can be built as a starting point.

I will be very interested to get more suggestions for you. What do you think are the basic requirements?

cc @gcmurphy @coredefend

[wileystar]

Very excited to see this package in a discussion. Here are some basic requirements:

• check for variable modified before reaching sink. a light check here that would help rate the severity
• once a vuln is identified, it might make sense to trace the path from sink back to the source to validate the finding and thereby reduce false positive rate
• some parameter values might be constructed with a combination of static string and user input. it might make sense to provide a feature that can identify this. For example, with file inclusion bugs, if the ../ sequence is appended to a hardcoded string (e.g, "test" + userInput -> "test../blah.txt"), there might no be vuln there.

I'll think more thru this and provide some basic requirements.

[dgryski]

I think @dominikh has looked at data flow analysis for staticcheck.

[gcmurphy]

Think this makes a lot of sense and I've wanted to explore this for a while. We may be able to leverage some functionality from here as well:

"golang.org/x/tools/go/callgraph"
"golang.org/x/tools/go/loader"
"golang.org/x/tools/go/pointer"
"golang.org/x/tools/go/ssa"
"golang.org/x/tools/go/ssa/ssautil"

[ccojocar]

I believe using also the SSA representation in addition to AST, it would make such an analysis achievable.
Some pointers:

• https://golang-ssaview.herokuapp.com/
• https://github.com/golang/tools/blob/master/go/ssa/ssautil/load.go
• https://blog.trailofbits.com/2020/05/22/emerging-talent-winternship-2020-highlights/ (See Go SSA based scanner)

[Jeeppler]

SSA refers to: https://pkg.go.dev/golang.org/x/tools/go/ssa.

[yunwei37]

Hi! Is there anyone working on this issue now? If not, I'd like to contribute to this. Maybe I can start from improving the taint analysis using dataflow analysis with go SSA?

[ccojocar]

@yunwei37 Please feel free to work on this, this will be a really valuable contribution. If you have any questions, don't hesitate to raise them here. Thanks!

[ccojocar]

gosec supports now Analysers and SSA code representation.