Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5d1ef49

Browse files
geoffw0geoffw0
committed
C++: Add support for enum constants.
1 parent e4d2c7c commit 5d1ef49

3 files changed

Lines changed: 30 additions & 3 deletions

File tree

‎cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,20 @@ Macro getAdditionalEvidenceMacro() {
5151
exists(result.getAnInvocation())
5252
}
5353

54+
/**
55+
* An enum constant which may relate to an insecure encryption algorithm.
56+
*/
57+
EnumConstant getAnInsecureEncryptionEnumConst() {
58+
isInsecureEncryption(result.getName())
59+
}
60+
61+
/**
62+
* An enum constant with additional evidence it is related to encryption.
63+
*/
64+
EnumConstant getAdditionalEvidenceEnumConst() {
65+
isEncryptionAdditionalEvidence(result.getName())
66+
}
67+
5468
/**
5569
* A function call we have a high confidence is related to use of an insecure
5670
* encryption algorithm.
@@ -65,6 +79,11 @@ class InsecureFunctionCall extends FunctionCall {
6579
mi.getAGeneratedElement() = this.getAChild*() and
6680
mi.getMacro() = getAnInsecureEncryptionMacro()
6781
)
82+
or
83+
exists(EnumConstantAccess ec |
84+
ec = this.getAChild*() and
85+
ec.getTarget() = getAnInsecureEncryptionEnumConst()
86+
)
6887
) and
6988
// find additional evidence that this function is related to encryption.
7089
(
@@ -74,6 +93,11 @@ class InsecureFunctionCall extends FunctionCall {
7493
mi.getAGeneratedElement() = this.getAChild*() and
7594
mi.getMacro() = getAdditionalEvidenceMacro()
7695
)
96+
or
97+
exists(EnumConstantAccess ec |
98+
ec = this.getAChild*() and
99+
ec.getTarget() = getAdditionalEvidenceEnumConst()
100+
)
77101
)
78102
}
79103

‎cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
| test2.cpp:49:4:49:24 | call to my_des_implementation | This function call specifies a broken or weak cryptographic algorithm. |
22
| test2.cpp:62:2:62:12 | call to encrypt_bad | This function call specifies a broken or weak cryptographic algorithm. |
33
| test2.cpp:124:4:124:24 | call to my_des_implementation | This function call specifies a broken or weak cryptographic algorithm. |
4+
| test2.cpp:144:22:144:30 | call to MyBadEncryptor | This function call specifies a broken or weak cryptographic algorithm. |
45
| test2.cpp:172:2:172:26 | call to set_encryption_algorithm1 | This function call specifies a broken or weak cryptographic algorithm. |
6+
| test2.cpp:175:2:175:26 | call to set_encryption_algorithm2 | This function call specifies a broken or weak cryptographic algorithm. |
57
| test2.cpp:182:2:182:17 | call to encryption_with1 | This function call specifies a broken or weak cryptographic algorithm. |
8+
| test2.cpp:185:2:185:17 | call to encryption_with2 | This function call specifies a broken or weak cryptographic algorithm. |
69
| test.cpp:38:2:38:31 | call to my_implementation1 | This function call specifies a broken or weak cryptographic algorithm. |
710
| test.cpp:39:2:39:31 | call to my_implementation2 | This function call specifies a broken or weak cryptographic algorithm. |
811
| test.cpp:51:2:51:32 | call to my_implementation1 | This function call specifies a broken or weak cryptographic algorithm. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ void do_class_encrypts(char *data, size_t amount, keytype key)
141141
}
142142

143143
{
144-
MyBadEncryptor mbe(key, DES); // BAD [NOT DETECTED]
144+
MyBadEncryptor mbe(key, DES); // BAD
145145

146146
mbe.encrypt(data, amount);
147147
}
@@ -172,7 +172,7 @@ void do_unseen_encrypts(char *data, size_t amount, keytype key)
172172
set_encryption_algorithm1(ALGO_DES); // BAD
173173
set_encryption_algorithm1(ALGO_AES); // GOOD
174174

175-
set_encryption_algorithm2(USE_DES); // BAD [NOT DETECTED]
175+
set_encryption_algorithm2(USE_DES); // BAD
176176
set_encryption_algorithm2(USE_AES); // GOOD
177177

178178
set_encryption_algorithm3("DES"); // BAD [NOT DETECTED]
@@ -182,7 +182,7 @@ void do_unseen_encrypts(char *data, size_t amount, keytype key)
182182
encryption_with1(data, amount, key, ALGO_DES); // BAD
183183
encryption_with1(data, amount, key, ALGO_AES); // GOOD
184184

185-
encryption_with2(data, amount, key, USE_DES); // BAD [NOT DETECTED]
185+
encryption_with2(data, amount, key, USE_DES); // BAD
186186
encryption_with2(data, amount, key, USE_AES); // GOOD
187187

188188
encryption_with3(data, amount, key, "DES"); // BAD [NOT DETECTED]

0 commit comments

Comments
 (0)