diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.c b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.c deleted file mode 100644 index 2700109a586..00000000000 --- a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.c +++ /dev/null @@ -1,24 +0,0 @@ -#include - -char *copy; - -void copyArgv(char **argv) { - copy = argv[1]; -} - -void printWrapper(char *str) { - printf(str); -} - -int main(int argc, char **argv) { - copyArgv(argv); - - // This should be avoided - printf(copy); - - // This should be avoided too, because it has the same effect - printWrapper(copy); - - // This is fine - printf("%s", copy); -} diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.qhelp b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.qhelp deleted file mode 100644 index 80b84580a57..00000000000 --- a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.qhelp +++ /dev/null @@ -1,36 +0,0 @@ - - - -

The program uses input from the user, propagated via a global variable, as a format string for printf style functions. -This can lead to buffer overflows or data representation problems. An attacker can exploit this weakness to crash the program, -disclose information or even execute arbitrary code.

- -

This rule only identifies inputs from the user that are transferred through global variables before being used in printf style functions. -Analyzing the flow of data through global variables is more prone to errors and so this rule may identify some examples of code where -the input is not really from the user. For example, when a global variable is set in two places, one that comes from the user and one that does not. -In this case we would mark all usages of the global variable as input from the user, but the input from the user may always came after the call to the -printf style functions.

- -

The results of this rule should be considered alongside the related rule "Uncontrolled format string" which tracks the flow of the -values input by a user, excluding global variables, until the values are used as the format argument for a printf like function call.

- -
- -

Use constant expressions as the format strings. If you need to print a value from the user, use printf("%s", value_from_user).

- -
- - - - - - -
  • CERT C Coding -Standard: FIO30-C. Exclude -user input from format strings.
  • - - -
    -
    diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql deleted file mode 100644 index b37e34c296c..00000000000 --- a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql +++ /dev/null @@ -1,40 +0,0 @@ -/** - * @name Uncontrolled format string (through global variable) - * @description Using externally-controlled format strings in - * printf-style functions can lead to buffer overflows - * or data representation problems. - * @kind path-problem - * @problem.severity warning - * @security-severity 9.3 - * @precision high - * @id cpp/tainted-format-string-through-global - * @tags reliability - * security - * external/cwe/cwe-134 - */ - -import cpp -import semmle.code.cpp.security.FunctionWithWrappers -import semmle.code.cpp.security.Security -import semmle.code.cpp.ir.dataflow.internal.DefaultTaintTrackingImpl -import TaintedWithPath - -class Configuration extends TaintTrackingConfiguration { - override predicate isSink(Element tainted) { - exists(PrintfLikeFunction printf | printf.outermostWrapperFunctionCall(tainted, _)) - } - - override predicate taintThroughGlobals() { any() } -} - -from - PrintfLikeFunction printf, Expr arg, PathNode sourceNode, PathNode sinkNode, - string printfFunction, Expr userValue, string cause -where - printf.outermostWrapperFunctionCall(arg, printfFunction) and - not taintedWithoutGlobals(arg) and - taintedWithPath(userValue, arg, sourceNode, sinkNode) and - isUserInput(userValue, cause) -select arg, sourceNode, sinkNode, - "The value of this argument may come from $@ and is being used as a formatting argument to " + - printfFunction + ".", userValue, cause diff --git a/cpp/ql/src/change-notes/2023-11-16-tainted-format-string-through-global-deleted.md b/cpp/ql/src/change-notes/2023-11-16-tainted-format-string-through-global-deleted.md new file mode 100644 index 00000000000..a4b3be355bc --- /dev/null +++ b/cpp/ql/src/change-notes/2023-11-16-tainted-format-string-through-global-deleted.md @@ -0,0 +1,4 @@ +--- +category: breaking +--- +* The `cpp/tainted-format-string-through-global` query has been deleted. This does not lead to a loss of relevant alerts, as the query duplicated a subset of the alerts from `cpp/tainted-format-string`. diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected deleted file mode 100644 index 6aca673fb4b..00000000000 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected +++ /dev/null @@ -1,69 +0,0 @@ -edges -| globalVars.c:8:7:8:10 | copy | globalVars.c:27:9:27:12 | copy | -| globalVars.c:8:7:8:10 | copy | globalVars.c:27:9:27:12 | copy | -| globalVars.c:8:7:8:10 | copy | globalVars.c:30:15:30:18 | copy | -| globalVars.c:8:7:8:10 | copy | globalVars.c:30:15:30:18 | copy | -| globalVars.c:8:7:8:10 | copy | globalVars.c:30:15:30:18 | copy | -| globalVars.c:8:7:8:10 | copy | globalVars.c:33:15:33:18 | copy | -| globalVars.c:8:7:8:10 | copy | globalVars.c:35:11:35:14 | copy | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:38:9:38:13 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:38:9:38:13 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:41:15:41:19 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:41:15:41:19 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:41:15:41:19 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:44:15:44:19 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:50:9:50:13 | copy2 | -| globalVars.c:9:7:9:11 | copy2 | globalVars.c:50:9:50:13 | copy2 | -| globalVars.c:11:22:11:25 | argv | globalVars.c:8:7:8:10 | copy | -| globalVars.c:11:22:11:25 | argv | globalVars.c:12:2:12:15 | ... = ... | -| globalVars.c:12:2:12:15 | ... = ... | globalVars.c:8:7:8:10 | copy | -| globalVars.c:15:21:15:23 | val | globalVars.c:9:7:9:11 | copy2 | -| globalVars.c:15:21:15:23 | val | globalVars.c:16:2:16:12 | ... = ... | -| globalVars.c:16:2:16:12 | ... = ... | globalVars.c:9:7:9:11 | copy2 | -| globalVars.c:24:11:24:14 | argv | globalVars.c:11:22:11:25 | argv | -| globalVars.c:24:11:24:14 | argv | globalVars.c:11:22:11:25 | argv | -| globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy | -| globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy | -| globalVars.c:30:15:30:18 | copy | globalVars.c:30:15:30:18 | copy | -| globalVars.c:30:15:30:18 | copy | globalVars.c:35:11:35:14 | copy | -| globalVars.c:33:15:33:18 | copy | globalVars.c:35:11:35:14 | copy | -| globalVars.c:35:11:35:14 | copy | globalVars.c:15:21:15:23 | val | -| globalVars.c:35:11:35:14 | copy | globalVars.c:35:11:35:14 | copy | -| globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 | -| globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 | -| globalVars.c:41:15:41:19 | copy2 | globalVars.c:41:15:41:19 | copy2 | -| globalVars.c:41:15:41:19 | copy2 | globalVars.c:50:9:50:13 | copy2 | -| globalVars.c:41:15:41:19 | copy2 | globalVars.c:50:9:50:13 | copy2 | -| globalVars.c:44:15:44:19 | copy2 | globalVars.c:50:9:50:13 | copy2 | -| globalVars.c:44:15:44:19 | copy2 | globalVars.c:50:9:50:13 | copy2 | -subpaths -nodes -| globalVars.c:8:7:8:10 | copy | semmle.label | copy | -| globalVars.c:9:7:9:11 | copy2 | semmle.label | copy2 | -| globalVars.c:11:22:11:25 | argv | semmle.label | argv | -| globalVars.c:12:2:12:15 | ... = ... | semmle.label | ... = ... | -| globalVars.c:15:21:15:23 | val | semmle.label | val | -| globalVars.c:16:2:16:12 | ... = ... | semmle.label | ... = ... | -| globalVars.c:24:11:24:14 | argv | semmle.label | argv | -| globalVars.c:24:11:24:14 | argv | semmle.label | argv | -| globalVars.c:27:9:27:12 | copy | semmle.label | copy | -| globalVars.c:27:9:27:12 | copy | semmle.label | copy | -| globalVars.c:30:15:30:18 | copy | semmle.label | copy | -| globalVars.c:30:15:30:18 | copy | semmle.label | copy | -| globalVars.c:30:15:30:18 | copy | semmle.label | copy | -| globalVars.c:33:15:33:18 | copy | semmle.label | copy | -| globalVars.c:35:11:35:14 | copy | semmle.label | copy | -| globalVars.c:38:9:38:13 | copy2 | semmle.label | copy2 | -| globalVars.c:38:9:38:13 | copy2 | semmle.label | copy2 | -| globalVars.c:41:15:41:19 | copy2 | semmle.label | copy2 | -| globalVars.c:41:15:41:19 | copy2 | semmle.label | copy2 | -| globalVars.c:41:15:41:19 | copy2 | semmle.label | copy2 | -| globalVars.c:44:15:44:19 | copy2 | semmle.label | copy2 | -| globalVars.c:50:9:50:13 | copy2 | semmle.label | copy2 | -| globalVars.c:50:9:50:13 | copy2 | semmle.label | copy2 | -#select -| globalVars.c:27:9:27:12 | copy | globalVars.c:24:11:24:14 | argv | globalVars.c:27:9:27:12 | copy | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | globalVars.c:24:11:24:14 | argv | argv | -| globalVars.c:30:15:30:18 | copy | globalVars.c:24:11:24:14 | argv | globalVars.c:30:15:30:18 | copy | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(str), which calls printf(format). | globalVars.c:24:11:24:14 | argv | argv | -| globalVars.c:38:9:38:13 | copy2 | globalVars.c:24:11:24:14 | argv | globalVars.c:38:9:38:13 | copy2 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | globalVars.c:24:11:24:14 | argv | argv | -| globalVars.c:41:15:41:19 | copy2 | globalVars.c:24:11:24:14 | argv | globalVars.c:41:15:41:19 | copy2 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(str), which calls printf(format). | globalVars.c:24:11:24:14 | argv | argv | -| globalVars.c:50:9:50:13 | copy2 | globalVars.c:24:11:24:14 | argv | globalVars.c:50:9:50:13 | copy2 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | globalVars.c:24:11:24:14 | argv | argv | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.qlref deleted file mode 100644 index eac059de2bb..00000000000 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.qlref +++ /dev/null @@ -1 +0,0 @@ -Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql \ No newline at end of file