Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b3f4357

Browse files
MathiasVPMathiasVP
authored
Merge pull request #7742 from geoffw0/clrtxt6
C++: Upgrade cpp/cleartext-storage-buffer
2 parents d9a1046 + 2e1b09f commit b3f4357

5 files changed

Lines changed: 38 additions & 26 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
/**
2+
* An IR taint tracking library that uses an IR DataFlow configuration to track
3+
* taint from user inputs as defined by `semmle.code.cpp.security.Security`.
4+
*/
5+
16
import cpp
27
import semmle.code.cpp.security.Security
38
private import semmle.code.cpp.ir.dataflow.DataFlow

‎cpp/ql/lib/semmle/code/cpp/security/TaintTracking.qll‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
/*
2-
* Support for tracking tainted data through the program.
2+
* Support for tracking tainted data through the program. This is an alias for
3+
* `semmle.code.cpp.ir.dataflow.DefaultTaintTracking` provided for backwards
4+
* compatibility.
35
*
4-
* Prefer to use `semmle.code.cpp.dataflow.TaintTracking` when designing new queries.
6+
* Prefer to use `semmle.code.cpp.dataflow.TaintTracking` or
7+
* `semmle.code.cpp.ir.dataflow.TaintTracking` when designing new queries.
58
*/
69

710
import semmle.code.cpp.ir.dataflow.DefaultTaintTracking

‎cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,33 @@
1212
*/
1313

1414
import cpp
15-
import semmle.code.cpp.security.BufferWrite
16-
import semmle.code.cpp.security.TaintTracking
15+
import semmle.code.cpp.security.BufferWrite as BufferWrite
1716
import semmle.code.cpp.security.SensitiveExprs
18-
import TaintedWithPath
17+
import semmle.code.cpp.security.FlowSources
18+
import semmle.code.cpp.ir.dataflow.TaintTracking
19+
import DataFlow::PathGraph
1920

20-
class Configuration extends TaintTrackingConfiguration {
21-
override predicate isSink(Element tainted) { exists(BufferWrite w | w.getASource() = tainted) }
21+
/**
22+
* Taint flow from user input to a buffer write.
23+
*/
24+
class ToBufferConfiguration extends TaintTracking::Configuration {
25+
ToBufferConfiguration() { this = "ToBufferConfiguration" }
26+
27+
override predicate isSource(DataFlow::Node source) { source instanceof FlowSource }
28+
29+
override predicate isSink(DataFlow::Node sink) {
30+
exists(BufferWrite::BufferWrite w | w.getASource() = sink.asExpr())
31+
}
2232
}
2333

2434
from
25-
BufferWrite w, Expr taintedArg, Expr taintSource, PathNode sourceNode, PathNode sinkNode,
26-
string taintCause, SensitiveExpr dest
35+
ToBufferConfiguration config, BufferWrite::BufferWrite w, DataFlow::PathNode sourceNode,
36+
DataFlow::PathNode sinkNode, FlowSource source, SensitiveExpr dest
2737
where
28-
taintedWithPath(taintSource, taintedArg, sourceNode, sinkNode) and
29-
isUserInput(taintSource, taintCause) and
30-
w.getASource() = taintedArg and
38+
config.hasFlowPath(sourceNode, sinkNode) and
39+
sourceNode.getNode() = source and
40+
w.getASource() = sinkNode.getNode().asExpr() and
3141
dest = w.getDest()
3242
select w, sourceNode, sinkNode,
33-
"This write into buffer '" + dest.toString() + "' may contain unencrypted data from $@",
34-
taintSource, "user input (" + taintCause + ")"
43+
"This write into buffer '" + dest.toString() + "' may contain unencrypted data from $@", source,
44+
"user input (" + source.getSourceType() + ")"

‎cpp/ql/src/change-notes/2022-01-25-cleartext-storage-buffer.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `cpp/cleartext-storage-buffer` query has been updated to use the `semmle.code.cpp.dataflow.TaintTracking` library.

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,8 @@
11
edges
22
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
3-
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
4-
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
5-
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
6-
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input indirection |
7-
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input indirection |
8-
subpaths
93
nodes
104
| test.cpp:54:17:54:20 | argv | semmle.label | argv |
11-
| test.cpp:54:17:54:20 | argv | semmle.label | argv |
12-
| test.cpp:58:25:58:29 | input | semmle.label | input |
135
| test.cpp:58:25:58:29 | input | semmle.label | input |
14-
| test.cpp:58:25:58:29 | input | semmle.label | input |
15-
| test.cpp:58:25:58:29 | input indirection | semmle.label | input indirection |
16-
| test.cpp:58:25:58:29 | input indirection | semmle.label | input indirection |
6+
subpaths
177
#select
18-
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (argv) |
8+
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (a command-line argument) |

0 commit comments

Comments
 (0)