mirror of
https://github.com/github/codeql.git
synced 2026-04-25 08:45:14 +02:00
Rename new article
This commit is contained in:
Felicity Chapman
@@ -1,14 +1,19 @@
|
||||
.. _analyzing-data-flow-in-cpp:
|
||||
|
||||
.. pull-quote:: Note
|
||||
|
||||
The data flow library used in this article has been replaced with an improved library which is available from CodeQL 2.12.5 onwards, see :ref:`Analyzing data flow in C and C++ (new) <analyzing-data-flow-in-cpp-new>`. The old library has been deprecated in CodeQL 2.14.1 and will be removed in a later release. With the release of CodeQL 2.13.0 both libraries use the new modular API for data flow.
|
||||
|
||||
Analyzing data flow in C and C++
|
||||
================================
|
||||
|
||||
You can use data flow analysis to track the flow of potentially malicious or insecure data that can cause vulnerabilities in your codebase.
|
||||
|
||||
About this article
|
||||
------------------
|
||||
|
||||
This article describes how data flow analysis is implemented in the CodeQL libraries for C/C++ and includes examples to help you write your own data flow queries.
|
||||
The following sections describe how to use the libraries for local data flow, global data flow, and taint tracking.
|
||||
For a more general introduction to modeling data flow, see ":ref:`About data flow analysis <about-data-flow-analysis>`."
|
||||
|
||||
.. include:: ../reusables/new-data-flow-api.rst
|
||||
|
||||
About data flow
|
||||
---------------
|
||||
|
||||
@@ -22,41 +27,47 @@ Local data flow is data flow within a single function. Local data flow is usuall
|
||||
Using local data flow
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The local data flow library is in the module ``DataFlow``, which defines the class ``Node`` denoting any element that data can flow through. ``Node``\ s are divided into expression nodes (``ExprNode``) and parameter nodes (``ParameterNode``). It is possible to map between data flow nodes and expressions/parameters using the member predicates ``asExpr`` and ``asParameter``:
|
||||
The local data flow library is in the module ``DataFlow``, which defines the class ``Node`` denoting any element that data can flow through. ``Node``\ s are divided into expression nodes (``ExprNode``, ``IndirectExprNode``) and parameter nodes (``ParameterNode``, ``IndirectParameterNode``). The indirect nodes represent expressions or parameters after a fixed number of pointer dereferences.
|
||||
|
||||
It is possible to map between data flow nodes and expressions or parameters using the member predicates ``asExpr``, ``asIndirectExpr``, and ``asParameter``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
class Node {
|
||||
/** Gets the expression corresponding to this node, if any. */
|
||||
/**
|
||||
* Gets the expression corresponding to this node, if any.
|
||||
*/
|
||||
Expr asExpr() { ... }
|
||||
|
||||
/** Gets the parameter corresponding to this node, if any. */
|
||||
/**
|
||||
* Gets the expression corresponding to a node that is obtained after dereferencing
|
||||
* the expression `index` times, if any.
|
||||
*/
|
||||
Expr asIndirectExpr(int index) { ... }
|
||||
|
||||
/**
|
||||
* Gets the parameter corresponding to this node, if any.
|
||||
*/
|
||||
Parameter asParameter() { ... }
|
||||
|
||||
/**
|
||||
* Gets the parameter corresponding to a node that is obtained after dereferencing
|
||||
* the parameter `index` times.
|
||||
*/
|
||||
Parameter asParameter(int index) { ... }
|
||||
|
||||
...
|
||||
}
|
||||
|
||||
or using the predicates ``exprNode`` and ``parameterNode``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
/**
|
||||
* Gets the node corresponding to expression `e`.
|
||||
*/
|
||||
ExprNode exprNode(Expr e) { ... }
|
||||
|
||||
/**
|
||||
* Gets the node corresponding to the value of parameter `p` at function entry.
|
||||
*/
|
||||
ParameterNode parameterNode(Parameter p) { ... }
|
||||
|
||||
The predicate ``localFlowStep(Node nodeFrom, Node nodeTo)`` holds if there is an immediate data flow edge from the node ``nodeFrom`` to the node ``nodeTo``. The predicate can be applied recursively (using the ``+`` and ``*`` operators), or through the predefined recursive predicate ``localFlow``, which is equivalent to ``localFlowStep*``.
|
||||
|
||||
For example, finding flow from a parameter ``source`` to an expression ``sink`` in zero or more local steps can be achieved as follows:
|
||||
For example, finding flow from a parameter ``source`` to an expression ``sink`` in zero or more local steps can be achieved as follows, where ``nodeFrom`` and ``nodeTo`` are of type ``DataFlow::Node``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
DataFlow::localFlow(DataFlow::parameterNode(source), DataFlow::exprNode(sink))
|
||||
nodeFrom.asParameter() = source and
|
||||
nodeTo.asExpr() = sink and
|
||||
DataFlow::localFlow(nodeFrom, nodeTo)
|
||||
|
||||
Using local taint tracking
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
@@ -72,37 +83,43 @@ In this case, the argument to ``malloc`` is tainted.
|
||||
|
||||
The local taint tracking library is in the module ``TaintTracking``. Like local data flow, a predicate ``localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo)`` holds if there is an immediate taint propagation edge from the node ``nodeFrom`` to the node ``nodeTo``. The predicate can be applied recursively (using the ``+`` and ``*`` operators), or through the predefined recursive predicate ``localTaint``, which is equivalent to ``localTaintStep*``.
|
||||
|
||||
For example, finding taint propagation from a parameter ``source`` to an expression ``sink`` in zero or more local steps can be achieved as follows:
|
||||
For example, finding taint propagation from a parameter ``source`` to an expression ``sink`` in zero or more local steps can be achieved as follows, where ``nodeFrom`` and ``nodeTo`` are of type ``DataFlow::Node``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
TaintTracking::localTaint(DataFlow::parameterNode(source), DataFlow::exprNode(sink))
|
||||
nodeFrom.asParameter() = source and
|
||||
nodeTo.asExpr() = sink and
|
||||
TaintTracking::localTaint(nodeFrom, nodeTo)
|
||||
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
The following query finds the filename passed to ``fopen``.
|
||||
The following query finds the filename passed to ``fopen``:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import cpp
|
||||
|
||||
from Function fopen, FunctionCall fc
|
||||
where fopen.hasGlobalName("fopen")
|
||||
and fc.getTarget() = fopen
|
||||
where
|
||||
fopen.hasGlobalName("fopen") and
|
||||
fc.getTarget() = fopen
|
||||
select fc.getArgument(0)
|
||||
|
||||
Unfortunately, this will only give the expression in the argument, not the values which could be passed to it. So we use local data flow to find all expressions that flow into the argument:
|
||||
However, this will only give the expression in the argument, not the values which could be passed to it. Instead we can use local data flow to find all expressions that flow into the argument, where we use ``asIndirectExpr(1)``. This is because we are interested in the value of the string passed to `fopen`, not the pointer pointing to it:
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
from Function fopen, FunctionCall fc, Expr src
|
||||
where fopen.hasGlobalName("fopen")
|
||||
and fc.getTarget() = fopen
|
||||
and DataFlow::localFlow(DataFlow::exprNode(src), DataFlow::exprNode(fc.getArgument(0)))
|
||||
from Function fopen, FunctionCall fc, Expr src, DataFlow::Node source, DataFlow::Node sink
|
||||
where
|
||||
fopen.hasGlobalName("fopen") and
|
||||
fc.getTarget() = fopen and
|
||||
source.asIndirectExpr(1) = src and
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
DataFlow::localFlow(source, sink)
|
||||
select src
|
||||
|
||||
Then we can vary the source and, for example, use the parameter of a function. The following query finds where a parameter is used when opening a file:
|
||||
@@ -110,28 +127,32 @@ Then we can vary the source and, for example, use the parameter of a function. T
|
||||
.. code-block:: ql
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
from Function fopen, FunctionCall fc, Parameter p
|
||||
where fopen.hasGlobalName("fopen")
|
||||
and fc.getTarget() = fopen
|
||||
and DataFlow::localFlow(DataFlow::parameterNode(p), DataFlow::exprNode(fc.getArgument(0)))
|
||||
from Function fopen, FunctionCall fc, Parameter p, DataFlow::Node source, DataFlow::Node sink
|
||||
where
|
||||
fopen.hasGlobalName("fopen") and
|
||||
fc.getTarget() = fopen and
|
||||
source.asParameter(1) = p and
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
DataFlow::localFlow(source, sink)
|
||||
select p
|
||||
|
||||
The following example finds calls to formatting functions where the format string is not hard-coded.
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
import semmle.code.cpp.commons.Printf
|
||||
|
||||
from FormattingFunction format, FunctionCall call, Expr formatString
|
||||
where call.getTarget() = format
|
||||
and call.getArgument(format.getFormatParameterIndex()) = formatString
|
||||
and not exists(DataFlow::Node source, DataFlow::Node sink |
|
||||
from FormattingFunction format, FunctionCall call, Expr formatString, DataFlow::Node sink
|
||||
where
|
||||
call.getTarget() = format and
|
||||
call.getArgument(format.getFormatParameterIndex()) = formatString and
|
||||
sink.asIndirectExpr(1) = formatString and
|
||||
not exists(DataFlow::Node source |
|
||||
DataFlow::localFlow(source, sink) and
|
||||
source.asExpr() instanceof StringLiteral and
|
||||
sink.asExpr() = formatString
|
||||
source.asIndirectExpr(1) instanceof StringLiteral
|
||||
)
|
||||
select call, "Argument to " + format.getQualifiedName() + " isn't hard-coded."
|
||||
|
||||
@@ -156,7 +177,7 @@ The global data flow library is used by implementing the signature ``DataFlow::C
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
module MyFlowConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
@@ -170,7 +191,6 @@ The global data flow library is used by implementing the signature ``DataFlow::C
|
||||
|
||||
module MyFlow = DataFlow::Global<MyFlowConfiguration>;
|
||||
|
||||
|
||||
The following predicates are defined in the configuration:
|
||||
|
||||
- ``isSource``—defines where data may flow from
|
||||
@@ -193,7 +213,7 @@ Global taint tracking is to global data flow as local taint tracking is to local
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.TaintTracking
|
||||
import semmle.code.cpp.dataflow.new.TaintTracking
|
||||
|
||||
module MyFlowConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
@@ -216,19 +236,20 @@ The following data flow configuration tracks data flow from environment variable
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
module EnvironmentToFileConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
exists (Function getenv |
|
||||
source.asExpr().(FunctionCall).getTarget() = getenv and
|
||||
exists(Function getenv |
|
||||
source.asIndirectExpr(1).(FunctionCall).getTarget() = getenv and
|
||||
getenv.hasGlobalName("getenv")
|
||||
)
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists (FunctionCall fc |
|
||||
sink.asExpr() = fc.getArgument(0) and
|
||||
exists(FunctionCall fc |
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
fc.getTarget().hasGlobalName("fopen")
|
||||
)
|
||||
}
|
||||
@@ -236,53 +257,56 @@ The following data flow configuration tracks data flow from environment variable
|
||||
|
||||
module EnvironmentToFileFlow = DataFlow::Global<EnvironmentToFileConfiguration>;
|
||||
|
||||
from Expr getenv, Expr fopen
|
||||
where EnvironmentToFileFlow::flow(DataFlow::exprNode(getenv), DataFlow::exprNode(fopen))
|
||||
select fopen, "This 'fopen' uses data from $@.",
|
||||
getenv, "call to 'getenv'"
|
||||
from
|
||||
Expr getenv, Expr fopen, DataFlow::Node source, DataFlow::Node sink
|
||||
where
|
||||
source.asIndirectExpr(1) = getenv and
|
||||
sink.asIndirectExpr(1) = fopen and
|
||||
EnvironmentToFileFlow::flow(source, sink)
|
||||
select fopen, "This 'fopen' uses data from $@.", getenv, "call to 'getenv'"
|
||||
|
||||
The following taint-tracking configuration tracks data from a call to ``ntohl`` to an array index operation. It uses the ``Guards`` library to recognize expressions that have been bounds-checked, and defines ``isBarrier`` to prevent taint from propagating through them. It also uses ``isAdditionalFlowStep`` to add flow from loop bounds to loop indexes.
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.controlflow.Guards
|
||||
import semmle.code.cpp.dataflow.TaintTracking
|
||||
import cpp
|
||||
import semmle.code.cpp.controlflow.Guards
|
||||
import semmle.code.cpp.dataflow.new.TaintTracking
|
||||
|
||||
module NetworkToBufferSizeConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node node) {
|
||||
node.asExpr().(FunctionCall).getTarget().hasGlobalName("ntohl")
|
||||
}
|
||||
module NetworkToBufferSizeConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node node) {
|
||||
node.asExpr().(FunctionCall).getTarget().hasGlobalName("ntohl")
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node node) {
|
||||
exists(ArrayExpr ae | node.asExpr() = ae.getArrayOffset())
|
||||
}
|
||||
predicate isSink(DataFlow::Node node) {
|
||||
exists(ArrayExpr ae | node.asExpr() = ae.getArrayOffset())
|
||||
}
|
||||
|
||||
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
exists(Loop loop, LoopCounter lc |
|
||||
loop = lc.getALoop() and
|
||||
loop.getControllingExpr().(RelationalOperation).getGreaterOperand() = pred.asExpr() |
|
||||
succ.asExpr() = lc.getVariableAccessInLoop(loop)
|
||||
)
|
||||
}
|
||||
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
|
||||
exists(Loop loop, LoopCounter lc |
|
||||
loop = lc.getALoop() and
|
||||
loop.getControllingExpr().(RelationalOperation).getGreaterOperand() = pred.asExpr()
|
||||
|
|
||||
succ.asExpr() = lc.getVariableAccessInLoop(loop)
|
||||
)
|
||||
}
|
||||
|
||||
predicate isBarrier(DataFlow::Node node) {
|
||||
exists(GuardCondition gc, Variable v |
|
||||
gc.getAChild*() = v.getAnAccess() and
|
||||
node.asExpr() = v.getAnAccess() and
|
||||
gc.controls(node.asExpr().getBasicBlock(), _)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
module NetworkToBufferSizeFlow = TaintTracking::Global<NetworkToBufferSizeConfiguration>;
|
||||
|
||||
from DataFlow::Node ntohl, DataFlow::Node offset
|
||||
where NetworkToBufferSizeFlow::flow(ntohl, offset)
|
||||
select offset, "This array offset may be influenced by $@.", ntohl,
|
||||
"converted data from the network"
|
||||
predicate isBarrier(DataFlow::Node node) {
|
||||
exists(GuardCondition gc, Variable v |
|
||||
gc.getAChild*() = v.getAnAccess() and
|
||||
node.asExpr() = v.getAnAccess() and
|
||||
gc.controls(node.asExpr().getBasicBlock(), _) and
|
||||
not exists(Loop loop | loop.getControllingExpr() = gc)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
module NetworkToBufferSizeFlow = TaintTracking::Global<NetworkToBufferSizeConfiguration>;
|
||||
|
||||
from DataFlow::Node ntohl, DataFlow::Node offset
|
||||
where NetworkToBufferSizeFlow::flow(ntohl, offset)
|
||||
select offset, "This array offset may be influenced by $@.", ntohl,
|
||||
"converted data from the network"
|
||||
|
||||
Exercises
|
||||
~~~~~~~~~
|
||||
@@ -301,11 +325,15 @@ Exercise 1
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
from StringLiteral sl, FunctionCall fc
|
||||
where fc.getTarget().hasName("gethostbyname")
|
||||
and DataFlow::localFlow(DataFlow::exprNode(sl), DataFlow::exprNode(fc.getArgument(0)))
|
||||
from StringLiteral sl, FunctionCall fc, DataFlow::Node source, DataFlow::Node sink
|
||||
where
|
||||
fc.getTarget().hasName("gethostbyname") and
|
||||
source.asIndirectExpr(1) = sl and
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
DataFlow::localFlow(source, sink)
|
||||
select sl, fc
|
||||
|
||||
Exercise 2
|
||||
@@ -313,24 +341,30 @@ Exercise 2
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
module LiteralToGethostbynameConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
source.asExpr() instanceof StringLiteral
|
||||
source.asIndirectExpr(1) instanceof StringLiteral
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists (FunctionCall fc |
|
||||
sink.asExpr() = fc.getArgument(0) and
|
||||
fc.getTarget().hasName("gethostbyname"))
|
||||
exists(FunctionCall fc |
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
fc.getTarget().hasName("gethostbyname")
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
module LiteralToGethostbynameFlow = DataFlow::Global<LiteralToGethostbynameConfiguration>;
|
||||
|
||||
from StringLiteral sl, FunctionCall fc
|
||||
where LiteralToGethostbynameFlow::flow(DataFlow::exprNode(sl), DataFlow::exprNode(fc.getArgument(0)))
|
||||
from
|
||||
StringLiteral sl, FunctionCall fc, DataFlow::Node source, DataFlow::Node sink
|
||||
where
|
||||
source.asIndirectExpr(1) = sl and
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
LiteralToGethostbynameFlow::flow(source, sink)
|
||||
select sl, fc
|
||||
|
||||
Exercise 3
|
||||
@@ -339,11 +373,10 @@ Exercise 3
|
||||
.. code-block:: ql
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
class GetenvSource extends FunctionCall {
|
||||
GetenvSource() {
|
||||
this.getTarget().hasGlobalName("getenv")
|
||||
}
|
||||
class GetenvSource extends DataFlow::Node {
|
||||
GetenvSource() { this.asIndirectExpr(1).(FunctionCall).getTarget().hasGlobalName("getenv") }
|
||||
}
|
||||
|
||||
Exercise 4
|
||||
@@ -351,31 +384,33 @@ Exercise 4
|
||||
|
||||
.. code-block:: ql
|
||||
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
|
||||
class GetenvSource extends DataFlow::Node {
|
||||
GetenvSource() {
|
||||
this.asExpr().(FunctionCall).getTarget().hasGlobalName("getenv")
|
||||
}
|
||||
GetenvSource() { this.asIndirectExpr(1).(FunctionCall).getTarget().hasGlobalName("getenv") }
|
||||
}
|
||||
|
||||
module GetenvToGethostbynameConfiguration implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
source instanceof GetenvSource
|
||||
}
|
||||
predicate isSource(DataFlow::Node source) { source instanceof GetenvSource }
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
exists (FunctionCall fc |
|
||||
sink.asExpr() = fc.getArgument(0) and
|
||||
fc.getTarget().hasName("gethostbyname"))
|
||||
exists(FunctionCall fc |
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
fc.getTarget().hasName("gethostbyname")
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
module GetenvToGethostbynameFlow = DataFlow::Global<GetenvToGethostbynameConfiguration>;
|
||||
|
||||
from DataFlow::Node getenv, FunctionCall fc
|
||||
where GetenvToGethostbynameFlow::flow(getenv, DataFlow::exprNode(fc.getArgument(0)))
|
||||
select getenv.asExpr(), fc
|
||||
from
|
||||
Expr getenv, FunctionCall fc, DataFlow::Node source, DataFlow::Node sink
|
||||
where
|
||||
source.asIndirectExpr(1) = getenv and
|
||||
sink.asIndirectExpr(1) = fc.getArgument(0) and
|
||||
GetenvToGethostbynameFlow::flow(source, sink)
|
||||
select getenv, fc
|
||||
|
||||
Further reading
|
||||
---------------
|
||||
|
||||
Reference in New Issue
Block a user