hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix results that flow to/from encryption routines.

Browse Source
This commit is contained in:
Geoffrey White
2021-10-04 19:07:47 +01:00
parent b82425a35c
commit 511bee7a1a
3 changed files with 137 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql
View File

@@ -14,11 +14,14 @@
import cpp
import semmle.code.cpp.security.SensitiveExprs
import semmle.code.cpp.dataflow.TaintTracking
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
import semmle.code.cpp.models.interfaces.FlowSource
import DataFlow::PathGraph
/**
* A function call that sends or receives data over a network.
*
* note: functions such as `write` may be writing to a network source or a file. We could attempt to determine which, and sort results into `cpp/cleartext-transmission` and perhaps `cpp/cleartext-storage-file`. In practice it usually isn't very important which query reports a result as long as its reported exactly once. See `checkSocket` to narrow this down somewhat.
*/
abstract class NetworkSendRecv extends FunctionCall {
/**
@@ -31,12 +34,21 @@ abstract class NetworkSendRecv extends FunctionCall {
* Gets the expression for the buffer to be sent from / received into.
*/
abstract Expr getDataExpr();
/**
* Holds if any socket used by this call could be a true network socket.
* A zero socket descriptor is standard input, which is not a network
* operation.
*/
predicate checkSocket() {
not exists(Zero zero |
DataFlow::localFlow(DataFlow::exprNode(zero), DataFlow::exprNode(getSocketExpr()))
)
}
}
/**
* A function call that sends data over a network.
*
* note: functions such as `write` may be writing to a network source or a file. We could attempt to determine which, and sort results into `cpp/cleartext-transmission` and perhaps `cpp/cleartext-storage-file`. In practice it usually isn't very important which query reports a result as long as its reported exactly once.
*/
class NetworkSend extends NetworkSendRecv {
RemoteFlowSinkFunction target;
@@ -86,33 +98,65 @@ class NetworkRecv extends NetworkSendRecv {
}
/**
* Taint flow from a sensitive expression to a network operation with data
* tainted by that expression.
* An expression that is an argument or return value from an encryption or
* decryption call.
*/
class SensitiveSendRecvConfiguration extends TaintTracking::Configuration {
SensitiveSendRecvConfiguration() { this = "SensitiveSendRecvConfiguration" }
override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SensitiveExpr }
override predicate isSink(DataFlow::Node sink) {
exists(NetworkSendRecv transmission |
sink.asExpr() = transmission.getDataExpr() and
// a zero socket descriptor is standard input, which is not interesting for this query.
not exists(Zero zero |
DataFlow::localFlow(DataFlow::exprNode(zero),
DataFlow::exprNode(transmission.getSocketExpr()))
class Encrypted extends Expr {
Encrypted() {
exists(FunctionCall fc |
fc.getTarget().getName().toLowerCase().regexpMatch(".*(crypt|encode|decode).*") and
(
this = fc or
this = fc.getAnArgument()
)
)
}
}
/**
* Taint flow from a sensitive expression.
*/
class FromSensitiveConfiguration extends TaintTracking::Configuration {
FromSensitiveConfiguration() { this = "FromSensitiveConfiguration" }
override predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SensitiveExpr }
override predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(NetworkSendRecv nsr | nsr.checkSocket()).getDataExpr()
or
sink.asExpr() instanceof Encrypted
}
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
// flow from pre-update to post-update of the source
isSource(node1) and
node2.(DataFlow::PostUpdateNode).getPreUpdateNode() = node1
or
// flow from pre-update to post-update of the sink (in case we can reach other sinks)
isSink(node1) and
node2.(DataFlow::PostUpdateNode).getPreUpdateNode() = node1
or
// flow through encryption functions to the return value (in case we can reach other sinks)
node2.asExpr().(Encrypted).(FunctionCall).getAnArgument() = node1.asExpr()
}
}
from
SensitiveSendRecvConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink,
NetworkSendRecv transmission, string msg
FromSensitiveConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink,
NetworkSendRecv networkSendRecv, string msg
where
// flow from sensitive -> network data
config.hasFlowPath(source, sink) and
sink.getNode().asExpr() = transmission.getDataExpr() and
if transmission instanceof NetworkSend
sink.getNode().asExpr() = networkSendRecv.getDataExpr() and
networkSendRecv.checkSocket() and
// no flow from sensitive -> evidence of encryption
not exists(DataFlow::Node anySource, DataFlow::Node encrypted |
config.hasFlow(anySource, sink.getNode()) and
config.hasFlow(anySource, encrypted) and
encrypted.asExpr() instanceof Encrypted
) and
// construct result
if networkSendRecv instanceof NetworkSend
then
msg =
"This operation transmits '" + sink.toString() +
@@ -121,4 +165,4 @@ where
msg =
"This operation receives into '" + sink.toString() +
"', which may put unencrypted sensitive data into $@"
select transmission, source, sink, msg, source, source.getNode().asExpr().toString()
select networkSendRecv, source, sink, msg, source, source.getNode().asExpr().toString()