hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-15 06:23:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Applied formatting.

Browse Source
This commit is contained in:
REDMOND\brodes
2022-11-08 12:13:05 -05:00
parent 7a27635a11
commit 1e9c2b3335
1 changed files with 37 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
cpp/ql/src/experimental/campaigns/nccoe-pqc-migration/QuantumVulnerableDiscovery/WinCng/WindowsCngPQCVulnerableUsage.qll
View File

@@ -1,67 +1,57 @@
import cpp
import WindowsCng
predicate vulnerableCngFunctionName(string name) {
name in ["BCryptSignHash", "BCryptEncrypt"]
}
predicate vulnerableCngFunctionName(string name) { name in ["BCryptSignHash", "BCryptEncrypt"] }
predicate vulnerableCngFunction(Function f)
{
exists(string name | f.hasGlobalName(name) and vulnerableCngFunctionName(name))
predicate vulnerableCngFunction(Function f) {
exists(string name | f.hasGlobalName(name) and vulnerableCngFunctionName(name))
}
//TODO: Verify NCrypt calls (parameters) & find all other APIs that should be included (i.e. decrypt, etc.)
predicate isExprKeyHandleForBCryptSignHash(Expr e){
exists( FunctionCall call |
e = call.getArgument(0)
and
vulnerableCngFunction(call.getTarget())
)
predicate isExprKeyHandleForBCryptSignHash(Expr e) {
exists(FunctionCall call |
e = call.getArgument(0) and
vulnerableCngFunction(call.getTarget())
)
}
class BCryptSignHashArgumentSink extends BCryptOpenAlgorithmProviderSink {
BCryptSignHashArgumentSink() {
isExprKeyHandleForBCryptSignHash(this.asExpr())
}
BCryptSignHashArgumentSink() { isExprKeyHandleForBCryptSignHash(this.asExpr()) }
}
class BCryptOpenAlgorithmProviderPqcVulnerableAlgorithmsSource extends BCryptOpenAlgorithmProviderSource {
BCryptOpenAlgorithmProviderPqcVulnerableAlgorithmsSource() {
this.asExpr() instanceof StringLiteral and
(
this.asExpr().getValue() in ["DH", "DSA", "ECDSA", "ECDH"]
or this.asExpr().getValue().matches("ECDH%")
or this.asExpr().getValue().matches("RSA%")
)
}
BCryptOpenAlgorithmProviderPqcVulnerableAlgorithmsSource() {
this.asExpr() instanceof StringLiteral and
(
this.asExpr().getValue() in ["DH", "DSA", "ECDSA", "ECDH"] or
this.asExpr().getValue().matches("ECDH%") or
this.asExpr().getValue().matches("RSA%")
)
}
}
predicate stepOpenAlgorithmProvider(DataFlow::Node node1, DataFlow::Node node2)
{
exists( FunctionCall call |
// BCryptOpenAlgorithmProvider 2nd argument specifies the algorithm to be used
node1.asExpr() = call.getArgument(1)
and
call.getTarget().hasGlobalName("BCryptOpenAlgorithmProvider")
and
node2.asDefiningArgument() = call.getArgument(0)
)
predicate stepOpenAlgorithmProvider(DataFlow::Node node1, DataFlow::Node node2) {
exists(FunctionCall call |
// BCryptOpenAlgorithmProvider 2nd argument specifies the algorithm to be used
node1.asExpr() = call.getArgument(1) and
call.getTarget().hasGlobalName("BCryptOpenAlgorithmProvider") and
node2.asDefiningArgument() = call.getArgument(0)
)
}
predicate stepImportGenerateKeyPair(DataFlow::Node node1, DataFlow::Node node2)
{
exists( FunctionCall call |
node1.asExpr() = call.getArgument(0)
and
( call.getTarget().hasGlobalName("BCryptImportKeyPair") or
call.getTarget().hasGlobalName("BCryptGenerateKeyPair"))
and
node2.asDefiningArgument() = call.getArgument(1)
)
predicate stepImportGenerateKeyPair(DataFlow::Node node1, DataFlow::Node node2) {
exists(FunctionCall call |
node1.asExpr() = call.getArgument(0) and
(
call.getTarget().hasGlobalName("BCryptImportKeyPair") or
call.getTarget().hasGlobalName("BCryptGenerateKeyPair")
) and
node2.asDefiningArgument() = call.getArgument(1)
)
}
predicate isWindowsCngAsymmetricKeyAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
stepOpenAlgorithmProvider(node1, node2)
or
stepImportGenerateKeyPair(node1, node2)
}
stepOpenAlgorithmProvider(node1, node2)
or
stepImportGenerateKeyPair(node1, node2)
}