Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b205951

Browse files
zlaski-semmlezlaski-semmle
committed
[CPP-370] Reformat test cases so that the .expect files line up with what was
 checked in initially. Check for DataFlow::DefinitionByReferenceNode when computing isSource() for our taint analysis.
1 parent ed67c9f commit b205951

5 files changed

Lines changed: 97 additions & 95 deletions

File tree

‎cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql‎

Lines changed: 44 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -46,51 +46,56 @@ predicate whitelisted(FunctionCall fc) {
4646
exists(Function f, int arg | f = fc.getTarget() | whitelistFunction(f, arg))
4747
}
4848

49-
predicate isNonConst(Expr e) {
50-
exists(FunctionCall fc | fc = e.(FunctionCall) |
51-
not whitelisted(fc) and not fc.getTarget().hasDefinition()
52-
)
53-
or
54-
exists(Parameter p | p = e.(VariableAccess).getTarget().(Parameter) |
55-
p.getFunction().getName() = "main" and p.getType() instanceof PointerType
56-
)
57-
or
58-
e instanceof CrementOperation
59-
or
60-
e instanceof AddressOfExpr
61-
or
62-
e instanceof ReferenceToExpr
63-
or
64-
e instanceof AssignPointerAddExpr
65-
or
66-
e instanceof AssignPointerSubExpr
67-
or
68-
e instanceof PointerArithmeticOperation
69-
or
70-
e instanceof FieldAccess
71-
or
72-
e instanceof PointerDereferenceExpr
73-
or
74-
e instanceof AddressOfExpr
75-
or
76-
e instanceof ExprCall
77-
or
78-
e instanceof NewArrayExpr
79-
or
80-
e instanceof AssignExpr
81-
or
82-
exists(Variable v | v = e.(VariableAccess).getTarget() |
83-
v.getType().(ArrayType).getBaseType() instanceof CharType and
84-
exists(AssignExpr ae |
85-
ae.getLValue().(ArrayExpr).getArrayBase().(VariableAccess).getTarget() = v
49+
predicate isNonConst(DataFlow::Node node) {
50+
exists(Expr e | e = node.asExpr() |
51+
exists(FunctionCall fc | fc = e.(FunctionCall) |
52+
not whitelisted(fc) and not fc.getTarget().hasDefinition()
53+
)
54+
or
55+
exists(Parameter p | p = e.(VariableAccess).getTarget().(Parameter) |
56+
p.getFunction().getName() = "main" and p.getType() instanceof PointerType
57+
)
58+
or
59+
e instanceof CrementOperation
60+
or
61+
e instanceof AddressOfExpr
62+
or
63+
e instanceof ReferenceToExpr
64+
or
65+
e instanceof AssignPointerAddExpr
66+
or
67+
e instanceof AssignPointerSubExpr
68+
or
69+
e instanceof PointerArithmeticOperation
70+
or
71+
e instanceof FieldAccess
72+
or
73+
e instanceof PointerDereferenceExpr
74+
or
75+
e instanceof AddressOfExpr
76+
or
77+
e instanceof ExprCall
78+
or
79+
e instanceof NewArrayExpr
80+
or
81+
e instanceof AssignExpr
82+
or
83+
exists(Variable v | v = e.(VariableAccess).getTarget() |
84+
v.getType().(ArrayType).getBaseType() instanceof CharType and
85+
exists(AssignExpr ae |
86+
ae.getLValue().(ArrayExpr).getArrayBase().(VariableAccess).getTarget() = v
87+
)
8688
)
8789
)
90+
or
91+
// TODO: Figure out what to do with DataFlow::DefinitionByReferenceNode
92+
exists(DataFlow::DefinitionByReferenceNode dbr | dbr = node.(DataFlow::DefinitionByReferenceNode))
8893
}
8994

9095
class NonConstFlow extends TaintTracking::Configuration {
9196
NonConstFlow() { this = "NonConstFlow" }
9297

93-
override predicate isSource(DataFlow::Node source) { isNonConst(source.asExpr()) }
98+
override predicate isSource(DataFlow::Node source) { isNonConst(source) }
9499

95100
override predicate isSink(DataFlow::Node sink) {
96101
exists(FormattingFunctionCall fc | sink.asExpr() = fc.getArgument(fc.getFormatParameterIndex()))
@@ -105,5 +110,5 @@ where
105110
sink.asExpr() = formatString
106111
)
107112
select formatString,
108-
"The format string argument to " + call.getTarget().getQualifiedName() +
113+
"The format string argument to " + call.getTarget().getName() +
109114
" should be constant to prevent security issues and other potential errors."

‎cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.c‎

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
extern int printf(const char *fmt, ...);
22

3-
// For the following `...gettext` functions, we assume that
4-
// all translations preserve the type and order of `%` specifiers
5-
// (and hence are safe to use as format strings). This
6-
// assumption is hard-coded into the query.
73

84
extern char *gettext (const char *__msgid);
95

@@ -12,6 +8,7 @@ extern char *dgettext (const char *__domainname, const char *__msgid);
128
extern char *dcgettext (const char *__domainname,
139
const char *__msgid, int __category);
1410

11+
1512
extern char *ngettext (const char *__msgid1, const char *__msgid2,
1613
unsigned long int __n);
1714

@@ -26,30 +23,27 @@ extern char *dcngettext (const char *__domainname, const char *__msgid1,
2623
extern char *any_random_function(const char *);
2724

2825
#define NULL ((void*)0)
29-
30-
#define _(X) my_gettext(X)
26+
#define _(X) any_random_function((X))
3127

3228
int main(int argc, char **argv) {
3329
if(argc > 1)
34-
printf(argv[1]); // NOT OK
30+
printf(argv[1]); // not ok
3531
else
36-
printf("No argument supplied.\n"); // OK
32+
printf("No argument supplied.\n"); // ok
3733

38-
printf(_("No argument supplied.\n")); // NOT OK
34+
printf(_("No argument supplied.\n")); // not ok
3935

40-
printf(dgettext(NULL, "No argument supplied.\n")); // OK
36+
printf(dgettext(NULL, "No argument supplied.\n")); // ok
4137

42-
printf(ngettext("One argument\n", "%d arguments\n", argc-1), argc-1); // OK
38+
printf(ngettext("One argument\n", "%d arguments\n", argc-1), argc-1); // ok
4339

44-
printf(gettext("%d arguments\n"), argc-1); // OK
45-
printf(any_random_function("%d arguments\n"), argc-1); // NOT OK
40+
printf(gettext("%d arguments\n"), argc-1); // ok
41+
printf(any_random_function("%d arguments\n"), argc-1); // not ok
4642

47-
#undef _
48-
/* The special `..gettext..` functions are allowed arbitrary arguments */
49-
printf(_(any_random_function("%d arguments\n")), // OK
50-
argc-1);
51-
printf(_("%d more arguments\n"), // OK
52-
argc-1);
43+
// Since `_` is mapped to `some_random_function` above,
44+
// the following call will be flagged.
45+
printf(_(any_random_function("%d arguments\n")),
46+
argc-1); // not ok
5347

5448
return 0;
5549
}

‎cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,19 @@
1-
| NonConstantFormat.c:34:10:34:16 | access to array | The format string argument to printf should be constant to prevent security issues and other potential errors. |
2-
| NonConstantFormat.c:38:9:38:36 | call to my_gettext | The format string argument to printf should be constant to prevent security issues and other potential errors. |
3-
| NonConstantFormat.c:45:9:45:27 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
4-
| test.cpp:60:12:60:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
5-
| test.cpp:63:12:63:21 | call to const_wash | The format string argument to printf should be constant to prevent security issues and other potential errors. |
6-
| test.cpp:64:12:64:26 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
7-
| test.cpp:65:12:65:17 | + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
8-
| test.cpp:66:12:66:18 | * ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
9-
| test.cpp:67:12:67:18 | & ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
10-
| test.cpp:68:12:68:39 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
11-
| test.cpp:70:10:70:35 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
12-
| test.cpp:73:12:73:20 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
13-
| test.cpp:79:12:79:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
14-
| test.cpp:85:12:85:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
15-
| test.cpp:91:12:91:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
16-
| test.cpp:96:12:96:18 | ++ ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
17-
| test.cpp:113:12:113:24 | new[] | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1+
| NonConstantFormat.c:30:10:30:16 | access to array | The format string argument to printf should be constant to prevent security issues and other potential errors. |
2+
| NonConstantFormat.c:34:9:34:36 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
3+
| NonConstantFormat.c:41:9:41:27 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
4+
| NonConstantFormat.c:45:9:45:48 | call to any_random_function | The format string argument to printf should be constant to prevent security issues and other potential errors. |
5+
| test.cpp:45:10:45:21 | call to make_message | The format string argument to printf should be constant to prevent security issues and other potential errors. |
6+
| test.cpp:50:12:50:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
7+
| test.cpp:53:12:53:21 | call to const_wash | The format string argument to printf should be constant to prevent security issues and other potential errors. |
8+
| test.cpp:54:12:54:26 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
9+
| test.cpp:55:12:55:17 | + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
10+
| test.cpp:56:12:56:18 | * ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
11+
| test.cpp:57:12:57:18 | & ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
12+
| test.cpp:58:12:58:39 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
13+
| test.cpp:60:10:60:35 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
14+
| test.cpp:63:12:63:20 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
15+
| test.cpp:69:12:69:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
16+
| test.cpp:75:12:75:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
17+
| test.cpp:81:12:81:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
18+
| test.cpp:86:12:86:18 | ++ ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
19+
| test.cpp:103:12:103:24 | new[] | The format string argument to printf should be constant to prevent security issues and other potential errors. |

‎cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,6 @@ const char *messages[] = {
1010
"%u tasks left\n",
1111
};
1212

13-
const char *simple_func(const char *str) {
14-
return str;
15-
}
16-
1713
const char *choose_message(unsigned int n) {
1814
if (n == 0) {
1915
const char *message = messages[0];
@@ -27,7 +23,7 @@ const char *choose_message(unsigned int n) {
2723

2824
const char *make_message(unsigned int n) {
2925
static char buf[64];
30-
sprintf(buf, "%d tasks left\n", n); // OK
26+
sprintf(buf, "%d tasks left\n", n);
3127
return buf;
3228
}
3329

@@ -45,14 +41,8 @@ const char *const_wash(char *str) {
4541
}
4642

4743
int main(int argc, char **argv) {
48-
const char *message = messages[2];
49-
printf(simple_func("Hello, World\n")); // OK
5044
printf(choose_message(argc - 1), argc - 1); // OK
51-
printf(messages[1]); // OK
52-
printf(message); // OK
53-
printf(make_message(argc - 1)); // OK
54-
printf("Hello, World\n"); // OK
55-
printf(gettext("Hello, World\n")); // OK
45+
printf(make_message(argc - 1)); // NOT OK
5646
printf(_("Hello, World\n")); // OK
5747
{
5848
char hello[] = "hello, World\n";
@@ -100,14 +90,14 @@ int main(int argc, char **argv) {
10090
const char *hello = "Hello, World\n";
10191
const char **p = &hello;
10292
(*p)++;
103-
printf(hello); // NOT OK [NOT DETECTED]
93+
printf(hello); // NOT OK
10494
}
10595
{
10696
// Same as above block but through a C++ reference
10797
const char *hello = "Hello, World\n";
10898
const char *&p = hello;
10999
p++;
110-
printf(hello); // NOT OK [NOT DETECTED]
100+
printf(hello); // NOT OK
111101
}
112102
if (gettext_debug) {
113103
printf(new char[100]); // NOT OK
@@ -120,5 +110,22 @@ int main(int argc, char **argv) {
120110
}
121111
printf(argc > 2 ? "More than one\n" : _("Only one\n")); // OK
122112

113+
// This following is OK since a const literal is passed to const_wash()
114+
// and the taint tracker detects this.
115+
//
116+
//
123117
printf(const_wash("Hello, World\n")); // OK
124118
}
119+
120+
const char *simple_func(const char *str) {
121+
return str;
122+
}
123+
124+
void another_func(void) {
125+
const char *message = messages[2];
126+
printf(simple_func("Hello, World\n")); // OK
127+
printf(messages[1]); // OK
128+
printf(message); // OK
129+
printf("Hello, World\n"); // OK
130+
printf(gettext("Hello, World\n")); // OK
131+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,10 @@
1-
| consts.cpp:63:9:63:10 | c5 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
2-
| consts.cpp:69:9:69:10 | c6 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
31
| consts.cpp:81:9:81:10 | c8 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
4-
| consts.cpp:86:9:86:10 | v1 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
52
| consts.cpp:91:9:91:10 | v2 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
6-
| consts.cpp:95:9:95:10 | v3 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
7-
| consts.cpp:100:9:100:10 | v4 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
83
| consts.cpp:103:9:103:15 | call to varFunc | The format string argument to printf should be constant to prevent security issues and other potential errors. |
94
| consts.cpp:107:9:107:10 | v5 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
105
| consts.cpp:112:9:112:10 | v6 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
116
| consts.cpp:116:9:116:13 | access to array | The format string argument to printf should be constant to prevent security issues and other potential errors. |
127
| consts.cpp:121:9:121:10 | v8 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
13-
| consts.cpp:130:9:130:10 | v9 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
148
| consts.cpp:135:9:135:11 | v10 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
159
| consts.cpp:140:9:140:11 | v11 | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1610
| consts.cpp:145:9:145:11 | v12 | The format string argument to printf should be constant to prevent security issues and other potential errors. |

0 commit comments

Comments
 (0)