Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fbb3f2e

Browse files
author
Robert Marsh
authored
Merge pull request #6273 from geoffw0/cleartext-storage-file
C++: Improve the CleartextFileWrite query
2 parents 6c666b4 + d9682aa commit fbb3f2e

6 files changed

Lines changed: 176 additions & 11 deletions

File tree

‎cpp/change-notes/2021-07-13-cleartext-storage-file.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
lgtm,codescanning
2+
* The "Cleartext storage of sensitive information in file" (cpp/cleartext-storage-file) query now uses dataflow to produce additional results.
3+
* Heuristics in the SensitiveExprs.qll library have been improved, making the "Cleartext storage of sensitive information in file" (cpp/cleartext-storage-file), "Cleartext storage of sensitive information in buffer" (cpp/cleartext-storage-buffer) and "Cleartext storage of sensitive information in an SQLite" (cpp/cleartext-storage-database) queries more accurate.

‎cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql‎

Lines changed: 34 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
* @kind problem
66
* @problem.severity warning
77
* @security-severity 7.5
8-
* @precision medium
8+
* @precision high
99
* @id cpp/cleartext-storage-file
1010
* @tags security
1111
* external/cwe/cwe-313
@@ -14,10 +14,40 @@
1414
import cpp
1515
import semmle.code.cpp.security.SensitiveExprs
1616
import semmle.code.cpp.security.FileWrite
17+
import semmle.code.cpp.dataflow.DataFlow
18+
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
1719

18-
from FileWrite w, SensitiveExpr source, Expr dest
20+
/**
21+
* An operation on a filename.
22+
*/
23+
predicate filenameOperation(FunctionCall op, Expr path) {
24+
exists(string name | name = op.getTarget().getName() |
25+
name =
26+
[
27+
"remove", "unlink", "rmdir", "rename", "fopen", "open", "freopen", "_open", "_wopen",
28+
"_wfopen", "_fsopen", "_wfsopen", "chmod", "chown", "stat", "lstat", "fstat", "access",
29+
"_access", "_waccess", "_access_s", "_waccess_s"
30+
] and
31+
path = op.getArgument(0)
32+
or
33+
name = ["fopen_s", "wfopen_s", "rename"] and
34+
path = op.getArgument(1)
35+
)
36+
}
37+
38+
predicate isFileName(GVN gvn) {
39+
exists(FunctionCall op, Expr path |
40+
filenameOperation(op, path) and
41+
gvn = globalValueNumber(path)
42+
)
43+
}
44+
45+
from FileWrite w, SensitiveExpr source, Expr mid, Expr dest
1946
where
20-
source = w.getASource() and
21-
dest = w.getDest()
47+
DataFlow::localFlow(DataFlow::exprNode(source), DataFlow::exprNode(mid)) and
48+
mid = w.getASource() and
49+
dest = w.getDest() and
50+
not isFileName(globalValueNumber(source)) and // file names are not passwords
51+
not exists(string convChar | convChar = w.getSourceConvChar(mid) | not convChar = ["s", "S"]) // ignore things written with other conversion characters
2252
select w, "This write into file '" + dest.toString() + "' may contain unencrypted data from $@",
2353
source, "this source."

‎cpp/ql/src/semmle/code/cpp/security/FileWrite.qll‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,15 @@ class FileWrite extends Expr {
1919
* Gets the expression for the object being written to.
2020
*/
2121
Expr getDest() { fileWrite(this, _, result) }
22+
23+
/**
24+
* Gets the conversion character for this write, if it exists and is known. For example in the following code the write of `value1` has conversion character `"s"`, whereas the write of `value2` has no conversion specifier.
25+
* ```
26+
* fprintf(file, "%s", value1);
27+
* stream << value2;
28+
* ```
29+
*/
30+
string getSourceConvChar(Expr source) { fileWriteWithConvChar(this, source, result) }
2231
}
2332

2433
/**
@@ -150,3 +159,20 @@ private predicate fileWrite(Call write, Expr source, Expr dest) {
150159
// file stream using '<<', 'put' or 'write'
151160
fileStreamChain(write, source, dest)
152161
}
162+
163+
/**
164+
* Whether the function call is a write to a file from 'source' with
165+
* conversion character 'conv'. Does not hold if there isn't a conversion
166+
* character, or if it is unknown (for example the format string is not a
167+
* constant).
168+
*/
169+
private predicate fileWriteWithConvChar(FormattingFunctionCall ffc, Expr source, string conv) {
170+
// fprintf
171+
exists(FormattingFunction f, int n |
172+
f = ffc.getTarget() and
173+
source = ffc.getFormatArgument(n)
174+
|
175+
exists(f.getOutputParameterIndex(true)) and
176+
conv = ffc.(FormattingFunctionCall).getFormat().(FormatLiteral).getConversionChar(n)
177+
)
178+
}

‎cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,34 @@ private predicate suspicious(string s) {
1414
(
1515
s.matches("%password%") or
1616
s.matches("%passwd%") or
17-
s.matches("%account%") or
18-
s.matches("%accnt%") or
1917
s.matches("%trusted%")
2018
) and
2119
not (
22-
s.matches("%hashed%") or
23-
s.matches("%encrypted%") or
24-
s.matches("%crypt%")
20+
s.matches("%hash%") or
21+
s.matches("%crypt%") or
22+
s.matches("%file%") or
23+
s.matches("%path%")
2524
)
2625
}
2726

2827
/**
2928
* A variable that might contain a password or other sensitive information.
3029
*/
3130
class SensitiveVariable extends Variable {
32-
SensitiveVariable() { suspicious(getName().toLowerCase()) }
31+
SensitiveVariable() {
32+
suspicious(getName().toLowerCase()) and
33+
not this.getUnspecifiedType() instanceof IntegralType
34+
}
3335
}
3436

3537
/**
3638
* A function that might return a password or other sensitive information.
3739
*/
3840
class SensitiveFunction extends Function {
39-
SensitiveFunction() { suspicious(getName().toLowerCase()) }
41+
SensitiveFunction() {
42+
suspicious(getName().toLowerCase()) and
43+
not this.getUnspecifiedType() instanceof IntegralType
44+
}
4045
}
4146

4247
/**

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
| test2.cpp:43:2:43:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:43:36:43:43 | password | this source. |
2+
| test2.cpp:44:2:44:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:44:37:44:45 | thepasswd | this source. |
3+
| test2.cpp:50:2:50:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:50:41:50:53 | passwd_config | this source. |
4+
| test2.cpp:54:2:54:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:54:41:54:52 | widepassword | this source. |
5+
| test2.cpp:55:2:55:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:55:40:55:51 | widepassword | this source. |
6+
| test2.cpp:57:2:57:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:57:39:57:49 | call to getPassword | this source. |
7+
| test2.cpp:65:3:65:9 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:62:18:62:25 | password | this source. |
18
| test.cpp:45:3:45:7 | call to fputs | This write into file 'file' may contain unencrypted data from $@ | test.cpp:45:9:45:19 | thePassword | this source. |
29
| test.cpp:70:35:70:35 | call to operator<< | This write into file 'mystream' may contain unencrypted data from $@ | test.cpp:70:38:70:48 | thePassword | this source. |
310
| test.cpp:73:37:73:41 | call to write | This write into file 'mystream' may contain unencrypted data from $@ | test.cpp:73:43:73:53 | thePassword | this source. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
2+
#define FILE int
3+
4+
typedef unsigned long size_t;
5+
6+
FILE *fopen(const char *filename, const char *mode);
7+
int snprintf(char *s, size_t n, const char *format, ...);
8+
int fprintf(FILE *stream, const char *format, ...);
9+
char *strcpy(char *s1, const char *s2);
10+
11+
char *crypt(char *input);
12+
13+
struct myStruct
14+
{
15+
// sensitive
16+
char *password;
17+
char *thepasswd;
18+
char *accountkey;
19+
wchar_t *widepassword;
20+
21+
// encrypted
22+
char password_hash[64];
23+
char *encrypted_passwd;
24+
25+
// not sensitive
26+
char *password_file;
27+
char *password_path;
28+
int num_passwords;
29+
int *password_tries;
30+
bool have_passwd;
31+
32+
// dubious
33+
char *passwd_config;
34+
char *passwd_config2;
35+
};
36+
37+
char *getPassword();
38+
char *getPasswordHash();
39+
int getPasswordMaxChars();
40+
41+
void tests(FILE *log, myStruct &s)
42+
{
43+
fprintf(log, "password = %s\n", s.password); // BAD
44+
fprintf(log, "thepasswd = %s\n", s.thepasswd); // BAD
45+
fprintf(log, "accountkey = %s\n", s.accountkey); // DUBIOUS [NOT REPORTED]
46+
fprintf(log, "password_hash = %s\n", s.password_hash); // GOOD
47+
fprintf(log, "encrypted_passwd = %s\n", s.encrypted_passwd); // GOOD
48+
fprintf(log, "password_file = %s\n", s.password_file); // GOOD
49+
fprintf(log, "password_path = %s\n", s.password_path); // GOOD
50+
fprintf(log, "passwd_config = %s\n", s.passwd_config); // DUBIOUS [REPORTED]
51+
fprintf(log, "num_passwords = %i\n", s.num_passwords); // GOOD
52+
fprintf(log, "password_tries = %i\n", *(s.password_tries)); // GOOD
53+
fprintf(log, "have_passwd = %i\n", s.have_passwd); // GOOD
54+
fprintf(log, "widepassword = %ls\n", s.widepassword); // BAD
55+
fprintf(log, "widepassword = %S\n", s.widepassword); // BAD
56+
57+
fprintf(log, "getPassword() = %s\n", getPassword()); // BAD
58+
fprintf(log, "getPasswordHash() = %s\n", getPasswordHash()); // GOOD
59+
fprintf(log, "getPasswordMaxChars() = %i\n", getPasswordMaxChars()); // GOOD
60+
61+
{
62+
char *cpy1 = s.password;
63+
char *cpy2 = crypt(s.password);
64+
65+
fprintf(log, "cpy1 = %s\n", cpy1); // BAD
66+
fprintf(log, "cpy2 = %s\n", cpy2); // GOOD
67+
}
68+
69+
{
70+
char buf[1024];
71+
72+
strcpy(buf, s.password);
73+
fprintf(log, "buf = %s\n", buf); // BAD [NOT DETECTED]
74+
75+
strcpy(buf, s.password_hash);
76+
fprintf(log, "buf = %s\n", buf); // GOOD
77+
}
78+
79+
fprintf(log, "password = %p\n", s.password); // GOOD
80+
81+
{
82+
if (fopen(s.passwd_config2, "rt") == 0)
83+
{
84+
fprintf(log, "could not open file '%s'.\n", s.passwd_config2); // GOOD
85+
}
86+
}
87+
88+
{
89+
char buffer[1024];
90+
91+
snprintf(buffer, 1024, "password = %s", s.password);
92+
fprintf(log, "log: %s", buffer); // BAD [NOT DETECTED]
93+
}
94+
}

0 commit comments

Comments
 (0)