Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 28932e8

Browse files
raulgarciamsftraulgarciamsft
committed
Fixing the code based on PR feedback.
1 parent 0531602 commit 28932e8

10 files changed

Lines changed: 150 additions & 77 deletions

File tree

cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyInConditional.cpp renamed to cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.cpp

File renamed without changes.

cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyInConditional.qhelp renamed to cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.qhelp

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,19 @@ and that do not have a return value reserved to indicate an error.</p>
99

1010
<p>The rule flags occurrences using such string copy functions as the conditional of an <code>if</code> statement, either directly, as part of an equality operator or a logical operator.</p>
1111

12-
<p>The string copy functions that the rule takes into consideration are:
13-
<li>strcpy</li>
14-
<li>wcscpy</li>
15-
<li>_mbscpy</li>
16-
<li>strncpy</li>
17-
<li>_strncpy_l</li>
18-
<li>wcsncpy</li>
19-
<li>_wcsncpy_l</li>
20-
<li>_mbsncpy</li>
21-
<li>_mbsncpy_l</li>
22-
</p>
23-
12+
<p>The string copy functions that the rule takes into consideration are: </p>
13+
<ul>
14+
<li>strcpy</li>
15+
<li>wcscpy</li>
16+
<li>_mbscpy</li>
17+
<li>strncpy</li>
18+
<li>_strncpy_l</li>
19+
<li>wcsncpy</li>
20+
<li>_wcsncpy_l</li>
21+
<li>_mbsncpy</li>
22+
<li>_mbsncpy_l</li>
23+
</ul>
24+
2425
<p>NOTE: It is highly recommended to consider using a more secure version of string manipulation functions suchas as <code>strcpy_s</code>.</p>
2526

2627
</overview>
@@ -30,7 +31,7 @@ and that do not have a return value reserved to indicate an error.</p>
3031
<p>If a string copy is really intended, very likely a secure version of the string copy function such as <code>strcpy_s</code> was intended instead of the insecure version of the string copy function.</p>
3132

3233
</recommendation>
33-
<example><sample src="UsingStrcpyInConditional.cpp" />
34+
<example><sample src="UsingStrcpyAsBoolean.cpp" />
3435
</example>
3536

3637
<references>

‎cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.ql‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
/**
2+
* @name Using the return value of a strcpy or related string copy function as a boolean operator
3+
* @description The return value for strcpy, strncpy, or related string copy functions have no reserved return value to indicate an error.
4+
* Using the return values of these functions as boolean function .
5+
* Either the intent was to use a more secure version of a string copy function (such as strcpy_s), or a string compare function (such as strcmp).
6+
* @kind problem
7+
* @problem.severity error
8+
* @precision high
9+
* @id cpp/string-copy-return-value-as-boolean
10+
* @tags external/microsoft/C6324
11+
*/
12+
13+
import cpp
14+
import semmle.code.cpp.dataflow.DataFlow
15+
16+
predicate isStringComparisonFunction(string functionName) {
17+
functionName = "strcpy"
18+
or functionName = "wcscpy"
19+
or functionName = "_mbscpy"
20+
or functionName = "strncpy"
21+
or functionName = "_strncpy_l"
22+
or functionName = "wcsncpy"
23+
or functionName = "_wcsncpy_l"
24+
or functionName = "_mbsncpy"
25+
or functionName = "_mbsncpy_l"
26+
}
27+
28+
predicate isBoolean( Expr e1 )
29+
{
30+
exists ( Type t1 |
31+
t1 = e1.getType() and
32+
(t1.hasName("bool") or t1.hasName("BOOL") or t1.hasName("_Bool"))
33+
)
34+
}
35+
36+
class StringCopyToBooleanConfiguration extends DataFlow::Configuration {
37+
StringCopyToBooleanConfiguration() {
38+
this = "StringCopyToBooleanConfiguration"
39+
}
40+
41+
override predicate isSource(DataFlow::Node source) {
42+
exists( FunctionCall func |
43+
func = source.asExpr()
44+
and isStringComparisonFunction( func.getTarget().getQualifiedName())
45+
)
46+
}
47+
48+
override predicate isSink(DataFlow::Node sink) {
49+
exists( Expr expr1 |
50+
expr1 = sink.asExpr()
51+
and isBoolean( expr1.getConversion*())
52+
)
53+
}
54+
}
55+
56+
predicate isStringCopyCastedAsBoolean( FunctionCall func, Expr expr1, string msg ) {
57+
exists( StringCopyToBooleanConfiguration modeConfig |
58+
modeConfig.hasFlow(DataFlow::exprNode(func), DataFlow::exprNode(expr1))
59+
and msg = "Return Value of " + func.getTarget().getQualifiedName() + " used as boolean."
60+
)
61+
}
62+
63+
predicate isStringCopyUsedInCondition( FunctionCall func, Expr expr1, string msg ) {
64+
exists( ConditionalStmt condstmt |
65+
condstmt.getAChild() = expr1 |
66+
isStringComparisonFunction( func.getTarget().getQualifiedName() )
67+
and (
68+
// The string copy function is used directly as the conditional expression
69+
func = condstmt.getChild(0)
70+
// ... or it is being used in an equality or logical operation
71+
or exists( EqualityOperation eop |
72+
eop = expr1
73+
and func = eop.getAChild()
74+
)
75+
or exists( UnaryLogicalOperation ule |
76+
expr1 = ule
77+
and func = ule.getAChild()
78+
)
79+
or exists( BinaryLogicalOperation ble |
80+
expr1 = ble
81+
and func = ble.getAChild()
82+
)
83+
)
84+
and msg = "Return Value of " + func.getTarget().getQualifiedName() + " used in a conditional."
85+
)
86+
}
87+
88+
from FunctionCall func, Expr expr1, string msg
89+
where
90+
isStringCopyCastedAsBoolean(func, expr1, msg)
91+
or isStringCopyUsedInCondition(func, expr1, msg)
92+
select expr1, msg

‎cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyInConditional.ql‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/UsingStrcpyAsBoolean.expected‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
| test.c:33:9:33:14 | call to strcpy | Return Value of strcpy used in a conditional. |
2+
| test.c:37:9:37:31 | ! ... | Return Value of strcpy used in a conditional. |
3+
| test.c:41:9:41:35 | ... == ... | Return Value of strcpy used in a conditional. |
4+
| test.c:45:9:45:48 | ... && ... | Return Value of strcpy used in a conditional. |
5+
| test.c:49:9:49:15 | call to strncpy | Return Value of strncpy used in a conditional. |
6+
| test.c:53:6:53:34 | ! ... | Return Value of strncpy used in a conditional. |
7+
| test.cpp:75:9:75:14 | call to strcpy | Return Value of strcpy used as boolean. |
8+
| test.cpp:75:9:75:14 | call to strcpy | Return Value of strcpy used in a conditional. |
9+
| test.cpp:79:9:79:31 | ! ... | Return Value of strcpy used in a conditional. |
10+
| test.cpp:79:10:79:15 | call to strcpy | Return Value of strcpy used as boolean. |
11+
| test.cpp:83:9:83:35 | ... == ... | Return Value of strcpy used in a conditional. |
12+
| test.cpp:87:9:87:48 | ... && ... | Return Value of strcpy used in a conditional. |
13+
| test.cpp:87:27:87:32 | call to strcpy | Return Value of strcpy used as boolean. |
14+
| test.cpp:91:9:91:37 | call to wcscpy | Return Value of wcscpy used as boolean. |
15+
| test.cpp:91:9:91:37 | call to wcscpy | Return Value of wcscpy used in a conditional. |
16+
| test.cpp:95:9:95:14 | call to wcscpy | Return Value of wcscpy used as boolean. |
17+
| test.cpp:95:9:95:14 | call to wcscpy | Return Value of wcscpy used in a conditional. |
18+
| test.cpp:99:9:99:15 | call to _mbscpy | Return Value of _mbscpy used as boolean. |
19+
| test.cpp:99:9:99:15 | call to _mbscpy | Return Value of _mbscpy used in a conditional. |
20+
| test.cpp:103:9:103:15 | call to strncpy | Return Value of strncpy used as boolean. |
21+
| test.cpp:103:9:103:15 | call to strncpy | Return Value of strncpy used in a conditional. |
22+
| test.cpp:107:9:107:15 | call to wcsncpy | Return Value of wcsncpy used as boolean. |
23+
| test.cpp:107:9:107:15 | call to wcsncpy | Return Value of wcsncpy used in a conditional. |
24+
| test.cpp:111:9:111:16 | call to _mbsncpy | Return Value of _mbsncpy used as boolean. |
25+
| test.cpp:111:9:111:16 | call to _mbsncpy | Return Value of _mbsncpy used in a conditional. |
26+
| test.cpp:115:9:115:18 | call to _strncpy_l | Return Value of _strncpy_l used as boolean. |
27+
| test.cpp:115:9:115:18 | call to _strncpy_l | Return Value of _strncpy_l used in a conditional. |
28+
| test.cpp:119:9:119:18 | call to _wcsncpy_l | Return Value of _wcsncpy_l used as boolean. |
29+
| test.cpp:119:9:119:18 | call to _wcsncpy_l | Return Value of _wcsncpy_l used in a conditional. |
30+
| test.cpp:123:9:123:18 | call to _mbsncpy_l | Return Value of _mbsncpy_l used as boolean. |
31+
| test.cpp:123:9:123:18 | call to _mbsncpy_l | Return Value of _mbsncpy_l used in a conditional. |
32+
| test.cpp:127:6:127:34 | ! ... | Return Value of strncpy used in a conditional. |
33+
| test.cpp:127:7:127:13 | call to strncpy | Return Value of strncpy used as boolean. |
34+
| test.cpp:131:11:131:17 | call to strncpy | Return Value of strncpy used as boolean. |

‎cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/UsingStrcpyAsBoolean.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.ql

cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyInConditional/test.c renamed to cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,10 @@ void PositiveCases()
4949
if (strncpy(szbuf1, "test", 100)) // Bug
5050
{
5151
}
52+
53+
if (!strncpy(szbuf1, "test", 100)) // Bug
54+
{
55+
}
5256
}
5357

5458
void NegativeCases()

cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyInConditional/test.cpp renamed to cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,11 @@ void PositiveCases()
124124
{
125125
}
126126

127+
if (!strncpy(szbuf1, "test", 100)) // Bug
128+
{
129+
}
130+
131+
bool b = strncpy(szbuf1, "test", 100);
127132
}
128133

129134
void NegativeCases()

‎cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyInConditional/UsingStrcpyInConditional.expected‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyInConditional/UsingStrcpyInConditional.qlref‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)