hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 01:33:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Extend cpp/cleartext-transmission using PrivateData.qll.

Browse Source
This commit is contained in:
Geoffrey White
2022-03-25 15:49:03 +00:00
parent 202b6d44a5
commit 3fed7bf6d0
3 changed files with 55 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql
View File

@@ -13,24 +13,38 @@
import cpp
import semmle.code.cpp.security.SensitiveExprs
import semmle.code.cpp.security.PrivateData
import semmle.code.cpp.dataflow.TaintTracking
import semmle.code.cpp.models.interfaces.FlowSource
import semmle.code.cpp.commons.File
import DataFlow::PathGraph
class SourceVariable extends Variable {
SourceVariable() {
this instanceof SensitiveVariable or
this instanceof PrivateDataVariable
}
}
class SourceFunction extends Function {
SourceFunction() {
this instanceof SensitiveFunction or
this instanceof PrivateDataFunction
}
}
/**
* A DataFlow node corresponding to a variable or function call that
* might contain or return a password or other sensitive information.
*/
class SensitiveNode extends DataFlow::Node {
SensitiveNode() {
this.asExpr() = any(SensitiveVariable sv).getInitializer().getExpr() or
this.asExpr().(VariableAccess).getTarget() =
any(SensitiveVariable sv).(GlobalOrNamespaceVariable) or
this.asExpr().(VariableAccess).getTarget() = any(SensitiveVariable v | v instanceof Field) or
this.asUninitialized() instanceof SensitiveVariable or
this.asParameter() instanceof SensitiveVariable or
this.asExpr().(FunctionCall).getTarget() instanceof SensitiveFunction
class SourceNode extends DataFlow::Node {
SourceNode() {
this.asExpr() = any(SourceVariable sv).getInitializer().getExpr() or
this.asExpr().(VariableAccess).getTarget() = any(SourceVariable sv).(GlobalOrNamespaceVariable) or
this.asExpr().(VariableAccess).getTarget() = any(SourceVariable v | v instanceof Field) or
this.asUninitialized() instanceof SourceVariable or
this.asParameter() instanceof SourceVariable or
this.asExpr().(FunctionCall).getTarget() instanceof SourceFunction
}
}
@@ -207,7 +221,7 @@ class Encrypted extends Expr {
class FromSensitiveConfiguration extends TaintTracking::Configuration {
FromSensitiveConfiguration() { this = "FromSensitiveConfiguration" }
override predicate isSource(DataFlow::Node source) { source instanceof SensitiveNode }
override predicate isSource(DataFlow::Node source) { source instanceof SourceNode }
override predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(NetworkSendRecv nsr).getDataExpr()

22
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected
View File

@@ -92,6 +92,8 @@ edges
| test3.cpp:398:18:398:25 | password | test3.cpp:400:33:400:40 | password |
| test3.cpp:421:21:421:28 | password | test3.cpp:421:3:421:17 | call to decrypt_inplace |
| test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password |
| test3.cpp:526:44:526:54 | my_latitude | test3.cpp:527:15:527:20 | buffer |
| test3.cpp:532:45:532:58 | home_longitude | test3.cpp:533:15:533:20 | buffer |
| test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:21:48:27 | call to encrypt |
| test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:29:48:39 | thePassword |
| test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:21:76:27 | call to encrypt |
@@ -221,6 +223,17 @@ nodes
| test3.cpp:421:21:421:28 | password | semmle.label | password |
| test3.cpp:429:7:429:14 | password | semmle.label | password |
| test3.cpp:431:8:431:15 | password | semmle.label | password |
| test3.cpp:507:18:507:39 | social_security_number | semmle.label | social_security_number |
| test3.cpp:509:18:509:29 | homePostCode | semmle.label | homePostCode |
| test3.cpp:511:18:511:26 | telephone | semmle.label | telephone |
| test3.cpp:512:18:512:36 | mobile_phone_number | semmle.label | mobile_phone_number |
| test3.cpp:513:18:513:22 | email | semmle.label | email |
| test3.cpp:516:18:516:29 | employerName | semmle.label | employerName |
| test3.cpp:517:18:517:29 | medical_info | semmle.label | medical_info |
| test3.cpp:526:44:526:54 | my_latitude | semmle.label | my_latitude |
| test3.cpp:527:15:527:20 | buffer | semmle.label | buffer |
| test3.cpp:532:45:532:58 | home_longitude | semmle.label | home_longitude |
| test3.cpp:533:15:533:20 | buffer | semmle.label | buffer |
| test.cpp:41:23:41:43 | cleartext password! | semmle.label | cleartext password! |
| test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
| test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
@@ -254,3 +267,12 @@ subpaths
| test3.cpp:414:3:414:6 | call to recv | test3.cpp:414:17:414:24 | password | test3.cpp:414:17:414:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:414:17:414:24 | password | password |
| test3.cpp:420:3:420:6 | call to recv | test3.cpp:420:17:420:24 | password | test3.cpp:420:17:420:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:420:17:420:24 | password | password |
| test3.cpp:431:2:431:6 | call to fgets | test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:429:7:429:14 | password | password |
| test3.cpp:507:2:507:5 | call to send | test3.cpp:507:18:507:39 | social_security_number | test3.cpp:507:18:507:39 | social_security_number | This operation transmits 'social_security_number', which may contain unencrypted sensitive data from $@ | test3.cpp:507:18:507:39 | social_security_number | social_security_number |
| test3.cpp:509:2:509:5 | call to send | test3.cpp:509:18:509:29 | homePostCode | test3.cpp:509:18:509:29 | homePostCode | This operation transmits 'homePostCode', which may contain unencrypted sensitive data from $@ | test3.cpp:509:18:509:29 | homePostCode | homePostCode |
| test3.cpp:511:2:511:5 | call to send | test3.cpp:511:18:511:26 | telephone | test3.cpp:511:18:511:26 | telephone | This operation transmits 'telephone', which may contain unencrypted sensitive data from $@ | test3.cpp:511:18:511:26 | telephone | telephone |
| test3.cpp:512:2:512:5 | call to send | test3.cpp:512:18:512:36 | mobile_phone_number | test3.cpp:512:18:512:36 | mobile_phone_number | This operation transmits 'mobile_phone_number', which may contain unencrypted sensitive data from $@ | test3.cpp:512:18:512:36 | mobile_phone_number | mobile_phone_number |
| test3.cpp:513:2:513:5 | call to send | test3.cpp:513:18:513:22 | email | test3.cpp:513:18:513:22 | email | This operation transmits 'email', which may contain unencrypted sensitive data from $@ | test3.cpp:513:18:513:22 | email | email |
| test3.cpp:516:2:516:5 | call to send | test3.cpp:516:18:516:29 | employerName | test3.cpp:516:18:516:29 | employerName | This operation transmits 'employerName', which may contain unencrypted sensitive data from $@ | test3.cpp:516:18:516:29 | employerName | employerName |
| test3.cpp:517:2:517:5 | call to send | test3.cpp:517:18:517:29 | medical_info | test3.cpp:517:18:517:29 | medical_info | This operation transmits 'medical_info', which may contain unencrypted sensitive data from $@ | test3.cpp:517:18:517:29 | medical_info | medical_info |
| test3.cpp:527:3:527:6 | call to send | test3.cpp:526:44:526:54 | my_latitude | test3.cpp:527:15:527:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:526:44:526:54 | my_latitude | my_latitude |
| test3.cpp:533:3:533:6 | call to send | test3.cpp:532:45:532:58 | home_longitude | test3.cpp:533:15:533:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:532:45:532:58 | home_longitude | home_longitude |

18
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
View File

@@ -504,17 +504,17 @@ struct person_info
void tests2(person_info *pi)
{
// direct cases
send(val(), pi->social_security_number, strlen(pi->social_security_number), val()); // BAD [NOT DETECTED]
send(val(), pi->social_security_number, strlen(pi->social_security_number), val()); // BAD
send(val(), pi->socialSecurityNo, strlen(pi->socialSecurityNo), val()); // BAD [NOT DETECTED]
send(val(), pi->homePostCode, strlen(pi->homePostCode), val()); // BAD [NOT DETECTED]
send(val(), pi->homePostCode, strlen(pi->homePostCode), val()); // BAD
send(val(), pi->my_zip_code, strlen(pi->my_zip_code), val()); // BAD [NOT DETECTED]
send(val(), pi->telephone, strlen(pi->telephone), val()); // BAD [NOT DETECTED]
send(val(), pi->mobile_phone_number, strlen(pi->mobile_phone_number), val()); // BAD [NOT DETECTED]
send(val(), pi->email, strlen(pi->email), val()); // BAD [NOT DETECTED]
send(val(), pi->telephone, strlen(pi->telephone), val()); // BAD
send(val(), pi->mobile_phone_number, strlen(pi->mobile_phone_number), val()); // BAD
send(val(), pi->email, strlen(pi->email), val()); // BAD
send(val(), pi->my_credit_card_number, strlen(pi->my_credit_card_number), val()); // BAD [NOT DETECTED]
send(val(), pi->my_bank_account_no, strlen(pi->my_bank_account_no), val()); // BAD [NOT DETECTED]
send(val(), pi->employerName, strlen(pi->employerName), val()); // BAD [NOT DETECTED]
send(val(), pi->medical_info, strlen(pi->medical_info), val()); // BAD [NOT DETECTED]
send(val(), pi->employerName, strlen(pi->employerName), val()); // BAD
send(val(), pi->medical_info, strlen(pi->medical_info), val()); // BAD
send(val(), pi->license_key, strlen(pi->license_key), val()); // BAD [NOT DETECTED]
send(val(), pi->license_key_hash, strlen(pi->license_key_hash), val()); // GOOD
send(val(), pi->my_zip_file, strlen(pi->my_zip_file), val()); // GOOD
@@ -524,13 +524,13 @@ void tests2(person_info *pi)
char buffer[1024];
snprintf(buffer, 1024, "lat = %f\n", pi->my_latitude);
send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
send(val(), buffer, strlen(buffer), val()); // BAD
}
{
char buffer[1024];
snprintf(buffer, 1024, "long = %f\n", pi->home_longitude);
send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
send(val(), buffer, strlen(buffer), val()); // BAD
}
{
char buffer[1024];