Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Add taint-tracking for errors, expvar, database/sql, database/sql/driver packages#342

Merged
smowton merged 7 commits intogithub:mainfrom
gagliardetto:standard-lib-pt-9
Sep 23, 2020
Merged

Add taint-tracking for errors, expvar, database/sql, database/sql/driver packages#342
smowton merged 7 commits intogithub:mainfrom
gagliardetto:standard-lib-pt-9

Conversation

@gagliardetto
Copy link
Contributor

@gagliardetto gagliardetto commented Sep 15, 2020 •
edited
Loading

codebox commands:

codebox --out-dir=./generated/latest --pkg=/usr/local/go/src/errors --http
codebox --out-dir=./generated/latest --pkg=/usr/local/go/src/expvar --http

codebox --out-dir=./generated/latest --pkg=/usr/local/go/src/database/sql --http
codebox --out-dir=./generated/latest --pkg=/usr/local/go/src/database/sql/driver --http

Part of #167

@gagliardetto gagliardetto mentioned this pull request Sep 15, 2020
Closed
@smowton
Copy link
Contributor

smowton commented Sep 17, 2020 •
edited
Loading

I evaluated this third tranche of stdlib improvements and found mostly new true positives (around 10-15 of them), all due to fmt.Errorf propagating taint. There were also a small number of new false positives, but these were due to existing weaknesses of taint tracking, not due to the added models.

smowton
smowton reviewed Sep 17, 2020
View reviewed changes
@gagliardetto gagliardetto mentioned this pull request Sep 22, 2020
Merged
smowton added a commit that referenced this pull request Sep 23, 2020
@smowton
Merge pull request #349 from gagliardetto/stdlib-339-340-342-346-347
a094ddb 
Merge #339 #340 #342 #346 #347
@smowton smowton merged commit 3155140 into github:main Sep 23, 2020
@smowton smowton mentioned this pull request Sep 23, 2020
Merged
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

1 more reviewer

@smowton smowton smowton approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

no-change-note-required

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@gagliardetto @smowton

Comments