Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b1c7cb6

Browse files
MathiasVPMathiasVP
committed
C++: Address review comments.
1 parent 91627cb commit b1c7cb6

10 files changed

Lines changed: 43 additions & 32 deletions

File tree

‎cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
4646
UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
4747

4848
override predicate isSource(DataFlow::Node source) {
49-
exists(RemoteFlowFunction remoteFlow |
49+
exists(RemoteFlowSourceFunction remoteFlow |
5050
remoteFlow = source.asExpr().(Call).getTarget() and
5151
remoteFlow.hasRemoteFlowSource(_, _)
5252
)

‎cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import semmle.code.cpp.models.interfaces.Alias
22
import semmle.code.cpp.models.interfaces.FlowSource
33

4-
private class Fread extends AliasFunction, RemoteFlowFunction {
4+
private class Fread extends AliasFunction, RemoteFlowSourceFunction {
55
Fread() { this.hasGlobalName("fread") }
66

77
override predicate parameterNeverEscapes(int n) {

‎cpp/ql/src/semmle/code/cpp/models/implementations/GetDelim.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.FlowSource
77
* The standard functions `getdelim`, `getwdelim` and the glibc variant `__getdelim`.
88
*/
99
private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectFunction,
10-
RemoteFlowFunction {
10+
RemoteFlowSourceFunction {
1111
GetDelimFunction() { hasGlobalName(["getdelim", "getwdelim", "__getdelim"]) }
1212

1313
override predicate hasTaintFlow(FunctionInput i, FunctionOutput o) {

‎cpp/ql/src/semmle/code/cpp/models/implementations/Getenv.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import semmle.code.cpp.models.interfaces.FlowSource
88
/**
99
* The POSIX function `getenv`.
1010
*/
11-
class Getenv extends LocalFlowFunction {
11+
class Getenv extends LocalFlowSourceFunction {
1212
Getenv() { this.hasGlobalName("getenv") }
1313

1414
override predicate hasLocalFlowSource(FunctionOutput output, string description) {

‎cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import semmle.code.cpp.models.interfaces.FlowSource
1414
* The standard functions `gets` and `fgets`.
1515
*/
1616
private class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
17-
SideEffectFunction, RemoteFlowFunction {
17+
SideEffectFunction, RemoteFlowSourceFunction {
1818
GetsFunction() {
1919
// gets(str)
2020
// fgets(str, num, stream)

‎cpp/ql/src/semmle/code/cpp/models/implementations/Recv.qll‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,13 @@ import semmle.code.cpp.models.interfaces.FlowSource
1010
import semmle.code.cpp.models.interfaces.SideEffect
1111

1212
/** The function `recv` and its assorted variants */
13-
private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction, RemoteFlowFunction {
13+
private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction,
14+
RemoteFlowSourceFunction {
1415
Recv() {
1516
this.hasGlobalName([
1617
"recv", // recv(socket, dest, len, flags)
1718
"recvfrom", // recvfrom(socket, dest, len, flags, from, fromlen)
19+
"recvmsg", // recvmsg(socket, msg, flags)
1820
"read", // read(socket, dest, len)
1921
"pread" // pread(socket, dest, len, offset)
2022
])
@@ -29,7 +31,9 @@ private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction, Rem
2931
override predicate parameterIsAlwaysReturned(int index) { none() }
3032

3133
override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
32-
bufParam = 1 and countParam = 2
34+
not this.hasGlobalName("recvmsg") and
35+
bufParam = 1 and
36+
countParam = 2
3337
}
3438

3539
override predicate hasArrayInput(int bufParam) { this.hasGlobalName("recvfrom") and bufParam = 4 }
@@ -47,6 +51,10 @@ private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction, Rem
4751
or
4852
i = 5 and buffer = false
4953
)
54+
or
55+
this.hasGlobalName("recvmsg") and
56+
i = 1 and
57+
buffer = true
5058
}
5159

5260
override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
@@ -67,7 +75,11 @@ private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction, Rem
6775
override predicate hasOnlySpecificWriteSideEffects() { any() }
6876

6977
override predicate hasRemoteFlowSource(FunctionOutput output, string description) {
70-
output.isParameterDeref(1) and
78+
(
79+
output.isParameterDeref(1)
80+
or
81+
this.hasGlobalName("recvfrom") and output.isParameterDeref([4, 5])
82+
) and
7183
description = "Buffer read by " + this.getName()
7284
}
7385
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Send.qll‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,12 @@ import semmle.code.cpp.models.interfaces.FlowSource
1010
import semmle.code.cpp.models.interfaces.SideEffect
1111

1212
/** The function `send` and its assorted variants */
13-
private class Send extends AliasFunction, ArrayFunction, SideEffectFunction, RemoteFlowFunctionSink {
13+
private class Send extends AliasFunction, ArrayFunction, SideEffectFunction, RemoteFlowSinkFunction {
1414
Send() {
1515
this.hasGlobalName([
1616
"send", // send(socket, buf, len, flags)
1717
"sendto", // sendto(socket, buf, len, flags, to, tolen)
18+
"sendmsg", // sendmsg(socket, msg, flags)
1819
"write" // write(socket, buf, len);
1920
])
2021
}
@@ -28,7 +29,9 @@ private class Send extends AliasFunction, ArrayFunction, SideEffectFunction, Rem
2829
override predicate parameterIsAlwaysReturned(int index) { none() }
2930

3031
override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
31-
bufParam = 1 and countParam = 2
32+
not this.hasGlobalName("sendmsg") and
33+
bufParam = 1 and
34+
countParam = 2
3235
}
3336

3437
override predicate hasArrayInput(int bufParam) { bufParam = 1 }
@@ -44,7 +47,9 @@ private class Send extends AliasFunction, ArrayFunction, SideEffectFunction, Rem
4447
override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
4548
i = 1 and buffer = true
4649
or
47-
exists(this.getParameter(4)) and i = 4 and buffer = false
50+
this.hasGlobalName("sendto") and i = 4 and buffer = false
51+
or
52+
this.hasGlobalName("sendmsg") and i = 1 and buffer = true
4853
}
4954

5055
override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }

‎cpp/ql/src/semmle/code/cpp/models/interfaces/FlowSource.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
/**
2-
* Provides a class for modeling functions that return data from potentially untrusted sources. To use
3-
* this QL library, create a QL class extending `DataFlowFunction` with a
2+
* Provides classes for modeling functions that return data from (or send data to) potentially untrusted
3+
* sources. To use this QL library, create a QL class extending `DataFlowFunction` with a
44
* characteristic predicate that selects the function or set of functions you
55
* are modeling. Within that class, override the predicates provided by
6-
* `RemoteFlowFunction` to match the flow within that function.
6+
* `RemoteFlowSourceFunction` or `RemoteFlowSinkFunction` to match the flow within that function.
77
*/
88

99
import cpp
@@ -13,7 +13,7 @@ import semmle.code.cpp.models.Models
1313
/**
1414
* A library function that returns data that may be read from a network connection.
1515
*/
16-
abstract class RemoteFlowFunction extends Function {
16+
abstract class RemoteFlowSourceFunction extends Function {
1717
/**
1818
* Holds if remote data described by `description` flows from `output` of a call to this function.
1919
*/
@@ -23,15 +23,15 @@ abstract class RemoteFlowFunction extends Function {
2323
/**
2424
* A library function that returns data that is directly controlled by a user.
2525
*/
26-
abstract class LocalFlowFunction extends Function {
26+
abstract class LocalFlowSourceFunction extends Function {
2727
/**
2828
* Holds if data described by `description` flows from `output` of a call to this function.
2929
*/
3030
abstract predicate hasLocalFlowSource(FunctionOutput output, string description);
3131
}
3232

3333
/** A library function that sends data over a network connection. */
34-
abstract class RemoteFlowFunctionSink extends Function {
34+
abstract class RemoteFlowSinkFunction extends Function {
3535
/**
3636
* Holds if data described by `description` flows into `input` to a call to this function, and is then
3737
* send over a network connection.

‎cpp/ql/src/semmle/code/cpp/security/FlowSources.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ private class RemoteReturnSource extends RemoteFlowSource {
2323
string sourceType;
2424

2525
RemoteReturnSource() {
26-
exists(RemoteFlowFunction func, CallInstruction instr, FunctionOutput output |
26+
exists(RemoteFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
2727
asInstruction() = instr and
2828
instr.getStaticCallTarget() = func and
2929
func.hasRemoteFlowSource(output, sourceType) and
@@ -42,7 +42,7 @@ private class RemoteParameterSource extends RemoteFlowSource {
4242
string sourceType;
4343

4444
RemoteParameterSource() {
45-
exists(RemoteFlowFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
45+
exists(RemoteFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
4646
asInstruction() = instr and
4747
instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
4848
func.hasRemoteFlowSource(output, sourceType) and
@@ -57,7 +57,7 @@ private class LocalReturnSource extends LocalFlowSource {
5757
string sourceType;
5858

5959
LocalReturnSource() {
60-
exists(LocalFlowFunction func, CallInstruction instr, FunctionOutput output |
60+
exists(LocalFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
6161
asInstruction() = instr and
6262
instr.getStaticCallTarget() = func and
6363
func.hasLocalFlowSource(output, sourceType) and
@@ -76,7 +76,7 @@ private class LocalParameterSource extends LocalFlowSource {
7676
string sourceType;
7777

7878
LocalParameterSource() {
79-
exists(LocalFlowFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
79+
exists(LocalFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
8080
asInstruction() = instr and
8181
instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
8282
func.hasLocalFlowSource(output, sourceType) and
@@ -109,7 +109,7 @@ private class RemoteParameterSink extends RemoteFlowSink {
109109
string sourceType;
110110

111111
RemoteParameterSink() {
112-
exists(RemoteFlowFunctionSink func, FunctionInput input, CallInstruction call, int index |
112+
exists(RemoteFlowSinkFunction func, FunctionInput input, CallInstruction call, int index |
113113
func.hasRemoteFlowSink(input, sourceType) and call.getStaticCallTarget() = func
114114
|
115115
exists(ReadSideEffectInstruction read |

‎cpp/ql/src/semmle/code/cpp/security/Security.qll‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,11 @@ class SecurityOptions extends string {
6060
or
6161
functionCall.getTarget().hasGlobalName(fname) and
6262
exists(functionCall.getArgument(arg)) and
63-
(
64-
fname = "recvmsg" and arg = 1
65-
or
66-
fname = "getaddrinfo" and arg = 3
67-
or
68-
fname = "recvfrom" and
69-
(arg = 1 or arg = 4 or arg = 5)
70-
)
63+
fname = "getaddrinfo" and
64+
arg = 3
7165
)
7266
or
73-
exists(RemoteFlowFunction remote, FunctionOutput output |
67+
exists(RemoteFlowSourceFunction remote, FunctionOutput output |
7468
functionCall.getTarget() = remote and
7569
output.isParameterDerefOrQualifierObject(arg) and
7670
remote.hasRemoteFlowSource(output, _)
@@ -89,7 +83,7 @@ class SecurityOptions extends string {
8983
)
9084
)
9185
or
92-
exists(RemoteFlowFunction remote, FunctionOutput output |
86+
exists(RemoteFlowSourceFunction remote, FunctionOutput output |
9387
functionCall.getTarget() = remote and
9488
(output.isReturnValue() or output.isReturnValueDeref()) and
9589
remote.hasRemoteFlowSource(output, _)

0 commit comments

Comments
 (0)