Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 11a416e

Browse files
am0o0am0o0
committed
add FlowSources as a common source for all sinks, so we don't need States anymore
1 parent 273848c commit 11a416e

2 files changed

Lines changed: 97 additions & 247 deletions

File tree

‎cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombs.ql‎

Lines changed: 97 additions & 239 deletions
Original file line numberDiff line numberDiff line change
@@ -27,298 +27,156 @@ import ZlibUncompress
2727
import ZlibInflator
2828
import Brotli
2929

30-
module DecompressionTaintConfig implements DataFlow::StateConfigSig {
31-
class FlowState = DataFlow::FlowState;
30+
module DecompressionTaintConfig implements DataFlow::ConfigSig {
31+
predicate isSource(DataFlow::Node source) { source instanceof FlowSource }
3232

33-
predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
34-
(
35-
exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction | fc = source.asExpr())
36-
or
37-
exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
38-
or
39-
source.asExpr() instanceof PointerVar
40-
or
41-
source.asExpr() instanceof Uint8Var
42-
) and
43-
state = "brotli"
33+
predicate isSink(DataFlow::Node sink) {
34+
exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
35+
fc.getArgument(2) = sink.asExpr()
36+
)
4437
or
45-
(
46-
source.asExpr() instanceof BzStreamVar
47-
or
48-
source.asExpr() instanceof BzFileVar
49-
or
50-
exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
51-
) and
52-
state = "bzip2"
38+
exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
39+
fc.getArgument(1) = sink.asExpr()
40+
)
5341
or
54-
exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_new |
55-
fc.getArgument(0) = source.asExpr()
56-
) and
57-
state = "libarchive"
42+
exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
43+
fc.getArgument(0) = sink.asExpr()
44+
)
5845
or
59-
(
60-
source.asExpr() instanceof UnsignedCharVar
61-
or
62-
source.asExpr() instanceof PointerVar
63-
or
64-
source.asExpr() instanceof CharVar
65-
or
66-
source.asExpr() instanceof MzZipArchiveVar
67-
or
68-
source.asExpr() instanceof MzStreampVar
69-
or
70-
source.asDefiningArgument() =
71-
any(Call call | call.getTarget() instanceof MzInflateInit).getArgument(0)
72-
or
73-
source.asDefiningArgument() =
74-
any(Call call | call.getTarget() instanceof MzZip).getArgument(0)
75-
) and
76-
state = "libminiz"
46+
exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
47+
fc.getArgument(1) = sink.asExpr()
48+
)
7749
or
78-
(
79-
exists(FunctionCall fc | fc.getTarget() instanceof AllocationFunction | fc = source.asExpr())
80-
or
81-
exists(FunctionCall fc | fopenCall(fc) | fc = source.asExpr())
82-
or
83-
source.asExpr() instanceof ZSTDinBufferSVar
84-
or
85-
source.asExpr() instanceof ZSTDinBufferVar
86-
) and
87-
state = "zstd"
50+
exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
51+
fc.getArgument(2) = sink.asExpr()
52+
)
8853
or
89-
(
90-
exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
91-
fc.getArgument(0) = source.asExpr()
92-
)
93-
or
94-
source.asExpr() instanceof UnzFileVar
95-
) and
96-
state = "unzFile"
54+
exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
55+
fc.getArgument(0) = sink.asExpr()
56+
)
9757
or
98-
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_create |
99-
fc = source.asExpr() and
100-
state = "mz_zip_reader"
58+
exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
59+
fc.getArgument(0) = sink.asExpr()
10160
)
10261
or
103-
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_create |
104-
fc = source.asExpr() and
105-
state = "mz_zip"
62+
exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
63+
fc.getArgument(1) = sink.asExpr()
10664
)
10765
or
108-
(
109-
source.asExpr() instanceof LzmaStreamVar
110-
or
111-
source.asExpr() instanceof Uint8Var
112-
) and
113-
state = "xz"
66+
exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
67+
fc.getArgument(0) = sink.asExpr()
68+
)
11469
or
115-
(
116-
exists(FunctionCall fc | fc.getTarget() instanceof GzopenFunction |
117-
fc.getArgument(0) = source.asExpr() and
118-
// arg 0 can be a path string which we must do following check
119-
not fc.getArgument(0).isConstant()
120-
)
121-
or
122-
exists(FunctionCall fc | fc.getTarget() instanceof GzdopenFunction |
123-
fc.getArgument(0) = source.asExpr()
124-
)
125-
or
126-
source.asExpr() instanceof GzFileVar
127-
) and
128-
state = "zlibgzopen"
70+
exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
71+
fc.getArgument(1) = sink.asExpr()
72+
)
12973
or
130-
source.asExpr() instanceof ZStreamVar and state = "zlifinflator"
74+
exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
75+
fc.getArgument(0) = sink.asExpr()
76+
)
13177
or
132-
source.asExpr() instanceof BytefVar and state = "zlibuncompress"
133-
}
134-
135-
predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
136-
(
137-
exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressStreamFunction |
138-
fc.getArgument(2) = sink.asExpr()
139-
)
140-
or
141-
exists(FunctionCall fc | fc.getTarget() instanceof BrotliDecoderDecompressFunction |
142-
fc.getArgument(1) = sink.asExpr()
143-
)
144-
) and
145-
state = "brotli"
78+
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
79+
fc.getArgument(2) = sink.asExpr()
80+
)
14681
or
147-
(
148-
exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzDecompressFunction |
149-
fc.getArgument(0) = sink.asExpr()
150-
)
151-
or
152-
exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzReadFunction |
153-
fc.getArgument(1) = sink.asExpr()
154-
)
155-
or
156-
exists(FunctionCall fc | fc.getTarget() instanceof BZ2BzBuffToBuffDecompressFunction |
157-
fc.getArgument(2) = sink.asExpr()
158-
)
159-
) and
160-
state = "bzip2"
82+
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
83+
fc.getArgument(3) = sink.asExpr()
84+
)
16185
or
162-
exists(FunctionCall fc | fc.getTarget() instanceof Archive_read_data_block |
163-
fc.getArgument(0) = sink.asExpr() and
164-
state = "libarchive"
86+
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
87+
fc.getArgument(2) = sink.asExpr()
16588
)
16689
or
167-
(
168-
exists(FunctionCall fc | fc.getTarget() instanceof MzUncompress |
169-
fc.getArgument(0) = sink.asExpr()
170-
)
171-
or
172-
exists(FunctionCall fc | fc.getTarget() instanceof MzZipReaderExtract |
173-
fc.getArgument(1) = sink.asExpr()
174-
)
175-
or
176-
exists(FunctionCall fc | fc.getTarget() instanceof MzInflate |
177-
fc.getArgument(0) = sink.asExpr()
178-
)
179-
or
180-
exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompress |
181-
fc.getArgument(1) = sink.asExpr()
182-
)
183-
or
184-
exists(FunctionCall fc | fc.getTarget() instanceof TinflDecompressMem |
185-
fc.getArgument(0) = sink.asExpr()
186-
)
187-
) and
188-
state = "libminiz"
90+
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
91+
fc.getArgument(3) = sink.asExpr()
92+
)
18993
or
190-
(
191-
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressFunction |
192-
fc.getArgument(2) = sink.asExpr()
193-
)
194-
or
195-
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressDCtxFunction |
196-
fc.getArgument(3) = sink.asExpr()
197-
)
198-
or
199-
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressStreamFunction |
200-
fc.getArgument(2) = sink.asExpr()
201-
)
202-
or
203-
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDictFunction |
204-
fc.getArgument(3) = sink.asExpr()
205-
)
206-
or
207-
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
208-
fc.getArgument(3) = sink.asExpr()
209-
)
210-
) and
211-
state = "zstd"
94+
exists(FunctionCall fc | fc.getTarget() instanceof ZSTDDecompressUsingDDictFunction |
95+
fc.getArgument(3) = sink.asExpr()
96+
)
21297
or
21398
exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
214-
fc.getArgument(0) = sink.asExpr() and
215-
state = "unzFile"
99+
fc.getArgument(0) = sink.asExpr()
216100
)
217101
or
218102
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
219-
fc.getArgument(1) = sink.asExpr() and
220-
state = "mz_zip_reader"
103+
fc.getArgument(1) = sink.asExpr()
221104
)
222105
or
223106
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
224-
fc.getArgument(1) = sink.asExpr() and
225-
state = "mz_zip"
107+
fc.getArgument(1) = sink.asExpr()
226108
)
227109
or
228-
(
229-
exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
230-
fc.getArgument(1) = sink.asExpr()
231-
)
232-
or
233-
exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
234-
fc.getArgument(0) = sink.asExpr()
235-
)
236-
) and
237-
state = "xz" and
238-
exists(FunctionCall fc2 | fc2.getTarget() instanceof LzmaDecoderFunction)
110+
exists(FunctionCall fc | fc.getTarget() instanceof LzmaStreamBufferDecodeFunction |
111+
fc.getArgument(1) = sink.asExpr()
112+
)
113+
or
114+
exists(FunctionCall fc | fc.getTarget() instanceof LzmaCodeFunction |
115+
fc.getArgument(0) = sink.asExpr()
116+
)
117+
or
118+
exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
119+
fc.getArgument(0) = sink.asExpr()
120+
)
121+
or
122+
exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
123+
sink.asExpr() = fc.getArgument(3)
124+
)
239125
or
240-
(
241-
exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
242-
fc.getArgument(0) = sink.asExpr()
243-
)
244-
or
245-
exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
246-
sink.asExpr() = fc.getArgument(3)
247-
)
248-
or
249-
exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
250-
sink.asExpr() = fc.getArgument(0)
251-
)
252-
) and
253-
state = "zlibgzopen"
126+
exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
127+
sink.asExpr() = fc.getArgument(0)
128+
)
254129
or
255130
exists(FunctionCall fc | fc.getTarget() instanceof InflateFunction |
256131
fc.getArgument(0) = sink.asExpr()
257-
) and
258-
state = "zlifinflator"
132+
)
259133
or
260134
exists(FunctionCall fc | fc.getTarget() instanceof UncompressFunction |
261135
fc.getArgument(0) = sink.asExpr()
262-
) and
263-
state = "zlibuncompress"
136+
)
264137
}
265138

266-
predicate isAdditionalFlowStep(
267-
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
268-
DataFlow::FlowState state2
269-
) {
139+
predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
270140
exists(FunctionCall fc | fc.getTarget() instanceof UnzOpenFunction |
271141
node1.asExpr() = fc.getArgument(0) and
272-
node2.asExpr() = fc and
273-
state1 = "" and
274-
state2 = "unzFile"
142+
node2.asExpr() = fc
275143
)
276144
or
277145
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
278146
node1.asExpr() = fc.getArgument(0) and
279-
node2.asExpr() = fc.getArgument(1) and
280-
state1 = "" and
281-
state2 = "mz_zip_reader"
147+
node2.asExpr() = fc.getArgument(1)
282148
)
283149
or
284150
exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
285151
node1.asExpr() = fc.getArgument(0) and
286-
node2.asExpr() = fc.getArgument(1) and
287-
state1 = "" and
288-
state2 = "mz_zip"
152+
node2.asExpr() = fc.getArgument(1)
289153
)
290154
or
291-
(
292-
exists(FunctionCall fc |
293-
fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
294-
|
295-
node1.asExpr() = fc.getArgument(0) and
296-
node2.asExpr() = fc
297-
)
298-
or
299-
exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
300-
node1.asExpr() = fc.getArgument(0) and
301-
node2.asExpr() = fc.getArgument(1)
302-
)
303-
or
304-
exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
305-
node1.asExpr() = fc.getArgument(3) and
306-
node2.asExpr() = fc.getArgument(0)
307-
)
308-
or
309-
exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
310-
node1.asExpr() = fc.getArgument(0) and
311-
node1.asExpr() = fc.getArgument(1)
312-
)
313-
) and
314-
state1 = "" and
315-
state2 = "gzopen"
155+
exists(FunctionCall fc |
156+
fc.getTarget() instanceof GzopenFunction or fc.getTarget() instanceof GzdopenFunction
157+
|
158+
node1.asExpr() = fc.getArgument(0) and
159+
node2.asExpr() = fc
160+
)
161+
or
162+
exists(FunctionCall fc | fc.getTarget() instanceof GzReadFunction |
163+
node1.asExpr() = fc.getArgument(0) and
164+
node2.asExpr() = fc.getArgument(1)
165+
)
166+
or
167+
exists(FunctionCall fc | fc.getTarget() instanceof GzFreadFunction |
168+
node1.asExpr() = fc.getArgument(3) and
169+
node2.asExpr() = fc.getArgument(0)
170+
)
171+
or
172+
exists(FunctionCall fc | fc.getTarget() instanceof GzGetsFunction |
173+
node1.asExpr() = fc.getArgument(0) and
174+
node1.asExpr() = fc.getArgument(1)
175+
)
316176
}
317-
318-
predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
319177
}
320178

321-
module DecompressionTaint = TaintTracking::GlobalWithState<DecompressionTaintConfig>;
179+
module DecompressionTaint = TaintTracking::Global<DecompressionTaintConfig>;
322180

323181
import DecompressionTaint::PathGraph
324182

0 commit comments

Comments
 (0)