Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not propagate taint through a channel that is tainted in one select branch and read from in another branch #211

Open
mlevesquedion opened this issue Dec 3, 2020 · 0 comments
Labels
bug Something isn't working

Comments

@mlevesquedion
Copy link
Contributor

mlevesquedion commented Dec 3, 2020

Consider the following test case:

func TestTaintedAndSinkedInDifferentBranches(objects chan interface{}) {
	select {
	case objects <- core.Source{}:
	case s := <-objects:
		// TODO(211) want no report here, because objects is only tainted if the
		// other branch is taken, and only one branch can be taken
		core.Sink(s) // want "a source has reached a sink"
	}
}

Given the semantics of select, one of two things can happen:

  1. We put a source on the objects channel
  2. We get an interface{} value from the objects channel and we sink it

As indicated by the TODO, it is therefore not possible that the channel be tainted and that a tainted value is obtained from it in the same call to this function.

However, this code may still be unsafe, because the fact that one of the cases puts a source on the channel indicates that the channel may contain sources in general. Consider e.g. a case where this function is called concurrently in two different goroutines. Such a case would be unsafe code. Handling this behavior in full generality within the scope of a single function would require us to model every interaction with the channel. Alternatively, this could be handled via interprocedural analysis (#99).

This issue is somewhat related to #161 and #210, in the sense that it is related to a behavior where we may want to leverage

@mlevesquedion mlevesquedion added the bug Something isn't working label Dec 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant