fix the rule issues

go/ql/src/experimental/CWE-525/WebCacheDeception.ql

@@ -17,13 +17,9 @@ from
   Method get
 where
   httpHandleFuncCall.getTarget().hasQualifiedName("net/http", "HandleFunc") and
-  httpHandleFuncCall.getNumArgument() > 1 and
-  httpHandleFuncCall.getArgument(0).getType().getUnderlyingType() = StringType and
-  httpHandleFuncCall.getArgument(0).getStringValue().matches("%/\"") and
-  // Trace the second argument's data flow to its predecessor
-  predecessor = httpHandleFuncCall.getArgument(1).getAPredecessor() and
-  // Find the corresponding expression for the predecessor
+  httpHandleFuncCall.getArgument(0).getType().getUnderlyingType() instanceof StringType and
+  httpHandleFuncCall.getArgument(0).getStringValue().matches("%/") and
   get.hasQualifiedName("net/http", "Header", "Set") and
   call = get.getACall() and
-  call.getArgument(0).getStringValue() = "\"Cache-Control\""
+  call.getArgument(0).getStringValue() = "Cache-Control"
 select httpHandleFuncCall.getArgument(0), call.getArgument(0)

go/ql/src/experimental/CWE-525/WebCacheDeceptionGood.go

@@ -1,88 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"html/template"
-	"log"
-	"net/http"
-	"os/exec"
-	"strings"
-	"sync"
-)
-
-var sessionMap = make(map[string]string)
-
-var (
-	templateCache = make(map[string]*template.Template)
-	mutex         = &sync.Mutex{}
-)
-
-type Lists struct {
-	Uid       string
-	UserName  string
-	UserLists []string
-	ReadFile  func(filename string) string
-}
-
-func parseTemplateFile(templateName string, tmplFile string) (*template.Template, error) {
-	mutex.Lock()
-	defer mutex.Unlock()
-
-	// Check if the template is already cached
-	if cachedTemplate, ok := templateCache[templateName]; ok {
-		fmt.Println("cached")
-		return cachedTemplate, nil
-	}
-
-	// Parse and store the template in the cache
-	parsedTemplate, _ := template.ParseFiles(tmplFile)
-	fmt.Println("not cached")
-
-	templateCache[templateName] = parsedTemplate
-	return parsedTemplate, nil
-}
-
-func ShowAdminPageCache(w http.ResponseWriter, r *http.Request) {
-
-	if r.Method == "GET" {
-		fmt.Println("cache called")
-		sessionMap[r.RequestURI] = "admin"
-
-		// Check if a session value exists
-		if _, ok := sessionMap[r.RequestURI]; ok {
-			cmd := "mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in (\"" + "admin" + "\");'"
-
-			// mysql -h mysql -u root -prootwolf -e 'select id,name,mail,age,created_at,updated_at from vulnapp.user where name not in ("test");--';echo");'
-			fmt.Println(cmd)
-
-			res, err := exec.Command("sh", "-c", cmd).Output()
-			if err != nil {
-				fmt.Println("err : ", err)
-			}
-
-			splitedRes := strings.Split(string(res), "\n")
-
-			p := Lists{Uid: "1", UserName: "admin", UserLists: splitedRes}
-
-			parsedTemplate, _ := parseTemplateFile("page", "./views/admin/userlists.gtpl")
-			w.Header().Set("Cache-Control", "no-store, no-cache")
-			err = parsedTemplate.Execute(w, p)
-		}
-	} else {
-		http.NotFound(w, nil)
-	}
-
-}
-
-func main() {
-
-	fmt.Println("Vulnapp server listening : 1337")
-
-	http.Handle("/assets/", http.StripPrefix("/assets/", http.FileServer(http.Dir("assets/"))))
-	http.HandleFunc("/adminusers", ShowAdminPageCache)
-
-	err := http.ListenAndServe(":1337", nil)
-	if err != nil {
-		log.Fatal("ListenAndServe: ", err)
-	}
-}

go/ql/src/experimental/CWE-525/wcd/baseline-info.json

@@ -0,0 +1 @@
+{"languages":{"go":{"displayName":"Go","files":["WebCacheDeceptionBad.go"],"linesOfCode":63,"name":"go"}}}

go/ql/src/experimental/CWE-525/wcd/codeql-database.yml

@@ -0,0 +1,10 @@
+---
+sourceLocationPrefix: /Users/yunus.aydin/Research/codeql-fork/go/ql/src/experimental/CWE-525
+baselineLinesOfCode: 63
+unicodeNewlines: false
+columnKind: utf8
+primaryLanguage: go
+creationMetadata:
+  cliVersion: 2.15.2
+  creationTime: 2023-11-15T12:38:41.355081Z
+finalised: true