Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 81283d5

Browse files
committed
remove more unused imports, add tests for zstd, add flow steps for zstd
zstd is not finilized
1 parent 4fc971d commit 81283d5

5 files changed

Lines changed: 269 additions & 14 deletions

File tree

cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44

55
import cpp
66
import semmle.code.cpp.ir.dataflow.TaintTracking
7-
import semmle.code.cpp.commons.File
87
import DecompressionBomb
98

109
/**

cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
import cpp
1515
import semmle.code.cpp.ir.dataflow.TaintTracking
1616
import semmle.code.cpp.security.FlowSources
17-
import semmle.code.cpp.commons.File
1817
import DecompressionBomb
1918

2019
module DecompressionTaintConfig implements DataFlow::ConfigSig {

cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,44 +9,63 @@ import DecompressionBomb
99
/**
1010
* The `ZSTD_decompress` function is used in flow sink.
1111
*/
12-
class ZSTDDecompressFunction extends DecompressionFunction {
13-
ZSTDDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
12+
class ZstdDecompressFunction extends DecompressionFunction {
13+
ZstdDecompressFunction() { this.hasGlobalName(["ZSTD_decompress"]) }
1414

1515
override int getArchiveParameterIndex() { result = 2 }
1616
}
1717

1818
/**
1919
* The `ZSTD_decompressDCtx` function is used in flow sink.
2020
*/
21-
class ZSTDDecompressDCtxFunction extends DecompressionFunction {
22-
ZSTDDecompressDCtxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
21+
class ZstdDecompressDctxFunction extends DecompressionFunction {
22+
ZstdDecompressDctxFunction() { this.hasGlobalName(["ZSTD_decompressDCtx"]) }
2323

2424
override int getArchiveParameterIndex() { result = 3 }
2525
}
2626

2727
/**
2828
* The `ZSTD_decompressStream` function is used in flow sink.
2929
*/
30-
class ZSTDDecompressStreamFunction extends DecompressionFunction {
31-
ZSTDDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
30+
class ZstdDecompressStreamFunction extends DecompressionFunction {
31+
ZstdDecompressStreamFunction() { this.hasGlobalName(["ZSTD_decompressStream"]) }
3232

3333
override int getArchiveParameterIndex() { result = 2 }
3434
}
3535

3636
/**
3737
* The `ZSTD_decompress_usingDDict` function is used in flow sink.
3838
*/
39-
class ZSTDDecompressUsingDictFunction extends DecompressionFunction {
40-
ZSTDDecompressUsingDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
39+
class ZstdDecompressUsingDdictFunction extends DecompressionFunction {
40+
ZstdDecompressUsingDdictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
4141

4242
override int getArchiveParameterIndex() { result = 3 }
4343
}
4444

4545
/**
46-
* The `ZSTD_decompress_usingDDict` function is used in flow sink.
46+
* The `fopen_orDie` function as a flow step.
4747
*/
48-
class ZSTDDecompressUsingDDictFunction extends DecompressionFunction {
49-
ZSTDDecompressUsingDDictFunction() { this.hasGlobalName(["ZSTD_decompress_usingDDict"]) }
48+
class FopenOrDieFunction extends DecompressionFlowStep {
49+
FopenOrDieFunction() { this.hasGlobalName("fopen_orDie") }
5050

51-
override int getArchiveParameterIndex() { result = 3 }
51+
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
52+
exists(FunctionCall fc | fc.getTarget() = this |
53+
node1.asIndirectExpr() = fc.getArgument(0) and
54+
node2.asExpr() = fc
55+
)
56+
}
57+
}
58+
59+
/**
60+
* The `fread_orDie` function as a flow step.
61+
*/
62+
class FreadOrDieFunction extends DecompressionFlowStep {
63+
FreadOrDieFunction() { this.hasGlobalName("fread_orDie") }
64+
65+
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
66+
exists(FunctionCall fc | fc.getTarget() = this |
67+
node1.asIndirectExpr() = fc.getArgument(2) and
68+
node2.asIndirectExpr() = fc.getArgument(0)
69+
)
70+
}
5271
}

0 commit comments

Comments
 (0)