Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit dcfbb86

Browse files
author
dilanbhalla
committed
pr fixes
1 parent 48e540f commit dcfbb86

4 files changed

Lines changed: 63 additions & 36 deletions

File tree

‎cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ cleartext.</p>
1919

2020
<references>
2121

22-
<li><a href="https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure">OWASP Sensitive_Data_Exposure</a>
22+
<li><a href="https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure">OWASP Sensitive_Data_Exposure</a></li>
2323
<li>M. Dowd, J. McDonald and J. Schuhm, <i>The Art of Software Security Assessment</i>, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.</li>
2424
<li>M. Howard and D. LeBlanc, <i>Writing Secure Code</i>, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.</li>
2525

‎cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@
1212
import cpp
1313
import experimental.semmle.code.cpp.security.PrivateCleartextWrite
1414
import experimental.semmle.code.cpp.security.PrivateCleartextWrite::PrivateCleartextWrite
15+
import DataFlow::PathGraph
1516

16-
from WriteConfig b, DataFlow::Node source, DataFlow::Node sink
17-
where b.hasFlow(source, sink)
18-
select sink, "This write may contain unencrypted data"
17+
from WriteConfig b, DataFlow::PathNode source, DataFlow::PathNode sink
18+
where b.hasFlowPath(source, sink)
19+
select sink.getNode(),
20+
"This write into the external location '" + sink + "' may contain unencrypted data from $@",
21+
source, "this source."

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,21 @@
1-
| test.cpp:50:9:50:18 | theZipcode | This write may contain unencrypted data |
2-
| test.cpp:66:24:66:30 | medical | This write may contain unencrypted data |
3-
| test.cpp:70:24:70:27 | temp | This write may contain unencrypted data |
4-
| test.cpp:74:24:74:28 | buff5 | This write may contain unencrypted data |
5-
| test.cpp:87:37:87:46 | theZipcode | This write may contain unencrypted data |
6-
| test.cpp:90:42:90:51 | theZipcode | This write may contain unencrypted data |
1+
edges
2+
| test.cpp:77:16:77:22 | medical | test.cpp:78:24:78:27 | temp |
3+
| test.cpp:81:17:81:20 | call to func | test.cpp:82:24:82:28 | buff5 |
4+
| test.cpp:81:22:81:28 | medical | test.cpp:81:17:81:20 | call to func |
5+
nodes
6+
| test.cpp:57:9:57:18 | theZipcode | semmle.label | theZipcode |
7+
| test.cpp:74:24:74:30 | medical | semmle.label | medical |
8+
| test.cpp:77:16:77:22 | medical | semmle.label | medical |
9+
| test.cpp:78:24:78:27 | temp | semmle.label | temp |
10+
| test.cpp:81:17:81:20 | call to func | semmle.label | call to func |
11+
| test.cpp:81:22:81:28 | medical | semmle.label | medical |
12+
| test.cpp:82:24:82:28 | buff5 | semmle.label | buff5 |
13+
| test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
14+
| test.cpp:99:42:99:51 | theZipcode | semmle.label | theZipcode |
15+
#select
16+
| test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:57:9:57:18 | theZipcode | this source. |
17+
| test.cpp:74:24:74:30 | medical | This write into the external location 'medical' may contain unencrypted data from $@ | test.cpp:74:24:74:30 | medical | this source. |
18+
| test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@ | test.cpp:77:16:77:22 | medical | this source. |
19+
| test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@ | test.cpp:81:22:81:28 | medical | this source. |
20+
| test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:96:37:96:46 | theZipcode | this source. |
21+
| test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:99:42:99:51 | theZipcode | this source. |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp‎

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -4,45 +4,52 @@
44
typedef int streamsize;
55

66
size_t fwrite(const void *ptr, size_t size, size_t nmemb, FILE *stream);
7-
int fputs(const char *s, FILE *stream);
7+
int fputs(const char *s, FILE *stream);
88
int fputc(int c, FILE *stream);
99
int fprintf(FILE *stream, const char *format, ...);
1010
int sprintf(char *s, const char *format, ...);
1111
size_t strlen(const char *s);
1212

1313
namespace std
1414
{
15-
template<class charT> struct char_traits;
16-
17-
template <class charT, class traits = char_traits<charT> >
18-
class basic_ostream /*: virtual public basic_ios<charT,traits> - not needed for this test */ {
19-
public:
20-
typedef charT char_type;
21-
basic_ostream<charT,traits>& write(const char_type* s, streamsize n);
22-
};
23-
24-
template <class charT, class traits = char_traits<charT> >
25-
class basic_ofstream : public basic_ostream<charT,traits> {
26-
public:
27-
};
28-
29-
template<class charT, class traits> basic_ostream<charT,traits>& operator<<(basic_ostream<charT,traits>&, const charT*);
30-
31-
typedef basic_ostream<char> ostream;
32-
typedef basic_ofstream<char> ofstream;
33-
};
15+
template <class charT>
16+
struct char_traits;
17+
18+
template <class charT, class traits = char_traits<charT>>
19+
class basic_ostream /*: virtual public basic_ios<charT,traits> - not needed for this test */
20+
{
21+
public:
22+
typedef charT char_type;
23+
basic_ostream<charT, traits> &write(const char_type *s, streamsize n);
24+
};
25+
26+
template <class charT, class traits = char_traits<charT>>
27+
class basic_ofstream : public basic_ostream<charT, traits>
28+
{
29+
public:
30+
};
31+
32+
template <class charT, class traits>
33+
basic_ostream<charT, traits> &operator<<(basic_ostream<charT, traits> &, const charT *);
34+
35+
typedef basic_ostream<char> ostream;
36+
typedef basic_ofstream<char> ofstream;
37+
}; // namespace std
3438

3539
using namespace std;
3640

37-
char *encrypt(char *buffer) {
41+
char *encrypt(char *buffer)
42+
{
3843
return buffer;
3944
}
40-
char *func(char *buffer) {
45+
char *func(char *buffer)
46+
{
4147
return buffer;
4248
}
4349

4450
// test for CleartextFileWrite
45-
void file() {
51+
void file()
52+
{
4653
char *theZipcode = "cleartext zipcode!";
4754
FILE *file;
4855

@@ -55,7 +62,8 @@ void file() {
5562
}
5663

5764
// test for CleartextBufferWrite
58-
int main(int argc, char** argv) {
65+
int main(int argc, char **argv)
66+
{
5967
char *medical = "medical";
6068
char *buff1;
6169
char *buff2;
@@ -75,11 +83,12 @@ int main(int argc, char** argv) {
7583

7684
char *buff6 = encrypt(medical);
7785
// GOOD: encrypt first
78-
sprintf(buff4, "%s", buff6);
86+
sprintf(buff4, "%s", buff6);
7987
}
8088

8189
// test for CleartextFileWrite
82-
void stream() {
90+
void stream()
91+
{
8392
char *theZipcode = "cleartext zipcode!";
8493
ofstream mystream;
8594

0 commit comments

Comments
 (0)