hohn/codeql-c-sqli
1
0
Fork 0
mirror of https://github.com/hohn/codeql-c-sqli.git synced 2025-12-16 10:33:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

minor changes

Browse Source
This commit is contained in:
Michael Hohn
2025-06-03 13:59:56 -07:00
committed by =Michael Hohn
parent 61804125e3
commit cfdf2168f5
3 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
README.org
View File

@@ -202,13 +202,23 @@
--ram=14000 \
-j12 \
--rerun \
--search-path ~/local/vmsync/ql \
--format=sarif-latest \
--output cpp-sqli.sarif \
-- \
$DB \
$SRCDIR/SqlInjection.ql
codeql database analyze \
-v \
--ram=14000 \
-j12 \
--rerun \
--format=sarif-latest \
--output cpp-sqli.sarif \
-- \
$DB \
$SRCDIR/trivial.ql
# Examine the file in an editor
edit cpp-sqli.sarif
#+END_SRC

30
SqlInjection.ql
View File

@@ -20,21 +20,21 @@ module SqliFlowConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node sanitizer) { none() }
predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) {
// Extra taint step
// snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
// But snprintf is a macro on mac os. The actual function's name is
// #undef snprintf
// #define snprintf(str, len, ...) \
// __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__)
// #endif
exists(FunctionCall printf |
printf.getTarget().getName().matches("%snprintf%") and
printf.getArgument(0) = out.asDefiningArgument() and
// very specific: shifted index for macro.
printf.getArgument(6) = into.asIndirectArgument()
)
}
// predicate isAdditionalFlowStep(DataFlow::Node into, DataFlow::Node out) {
// // Extra taint step
// // snprintf(query, bufsize, "INSERT INTO users VALUES (%d, '%s')", id, info);
// // But snprintf is a macro on mac os. The actual function's name is
// // #undef snprintf
// // #define snprintf(str, len, ...) \
// // __builtin___snprintf_chk (str, len, 0, __darwin_obsz(str), __VA_ARGS__)
// // #endif
// exists(FunctionCall printf |
// printf.getTarget().getName().matches("%snprintf%") and
// printf.getArgument(0) = out.asDefiningArgument() and
// // very specific: shifted index for macro.
// printf.getArgument(6) = into.asIndirectArgument()
// )
// }
predicate isSink(DataFlow::Node sink) {
// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
exists(FunctionCall exec |

10
notes.org Normal file
View File

@@ -0,0 +1,10 @@
* sequence
- [X] build program
- [X] build under codeql control -> codeql db
/Users/hohn/2025-05-21/codeqlworkshop/codeql-c-sqli/cpp-sqli-35d4c80
- [X] write / use query (db + query -> codeql -> sarif)
- [X] view sarif
- [ ] follow up:
+ [ ] classes of vulnerabilities