hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Crypto: Refactor and change casts to super

Browse Source
This commit is contained in:
Nicolas Will
2025-10-02 18:43:38 +02:00
parent 9673b81677
commit 4901cdf929
3 changed files with 18 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cpp/ql/lib/experimental/quantum/Language.qll
View File

@@ -94,7 +94,10 @@ module GenericDataSourceFlow = TaintTracking::Global<GenericDataSourceFlowConfig
private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof OpenSslGenericSourceCandidateLiteral
{
override DataFlow::Node getOutputNode() {
// A literal can be a string or an int, so handling both indirect and direct cases
// OpenSSL algorithms may be referenced either by string name or by numeric ID:
// String names (e.g. "AES-256-CBC") appear in the AST as character pointer
// literals. For these we must use `asIndirectExpr`. Numeric IDs (e.g. NID_aes_256_cbc)
// appear as integer literals. For these, we must use `asExpr` to get the "value" node.
[result.asIndirectExpr(), result.asExpr()] = this
}

6
cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/HashAlgorithmValueConsumer.qll
View File

@@ -9,11 +9,11 @@ abstract class HashAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer
/**
* An EVP_Q_Digest directly consumes algorithm constant values
*/
class Evp_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
Evp_Q_Digest_Algorithm_Consumer() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
class Evp_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer instanceof Call {
Evp_Q_Digest_Algorithm_Consumer() { super.getTarget().getName() = "EVP_Q_digest" }
override Crypto::ConsumerInputDataFlowNode getInputNode() {
result.asIndirectExpr() = this.(Call).getArgument(1)
result.asIndirectExpr() = super.getArgument(1)
}
override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {