hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
ihsinme
2021-03-04 16:20:22 +03:00
committed by GitHub
parent 15049ca853
commit 633fc92efc
3 changed files with 101 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
cpp/ql/src/experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.c Normal file
View File

@@ -0,0 +1,7 @@
if(len<0) return 1;
memset(dest, source, len); // GOOD: variable `len` checked before call
...
memset(dest, source, len); // BAD: variable `len` checked after call
if(len<0) return 1;

28
cpp/ql/src/experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.qhelp Normal file
View File

@@ -0,0 +1,28 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>Checking the function argument after calling the function itself. This situation looks suspicious and requires the attention of the developer. It may be necessary to add validation before calling the function</p>
</overview>
<recommendation>
<p>We recommend checking before calling the function.</p>
</recommendation>
<example>
<p>The following example demonstrates an erroneous and fixed use of function argument validation.</p>
<sample src="LateCheckOfFunctionArgument.c" />
</example>
<references>
<li>
CWE Common Weakness Enumeration:
<a href="https://cwe.mitre.org/data/definitions/20.html"> CWE-20: Improper Input Validation</a>.
</li>
</references>
</qhelp>

66
cpp/ql/src/experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql Normal file
View File

@@ -0,0 +1,66 @@
/**
* @name Late Check Of Function Argument
* @description --Checking the function argument after calling the function itself.
* --This situation looks suspicious and requires the attention of the developer.
* --It may be necessary to add validation before calling the function.
* @kind problem
* @id cpp/late-check-of-function-argument
* @problem.severity warning
* @precision medium
* @tags correctness
* security
* external/cwe/cwe-20
*/
import cpp
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
predicate numberArgument(Function f, int size) {
f.hasGlobalOrStdName("write") and size = 2
or
f.hasGlobalOrStdName("read") and size = 2
or
f.hasGlobalOrStdName("lseek") and size = 1
or
f.hasGlobalOrStdName("memmove") and size = 2
or
f.hasGlobalOrStdName("memset") and size = 2
or
f.hasGlobalOrStdName("memcpy") and size = 2
or
f.hasGlobalOrStdName("memcmp") and size = 2
or
f.hasGlobalOrStdName("strncat") and size = 2
or
f.hasGlobalOrStdName("strncpy") and size = 2
or
f.hasGlobalOrStdName("strncmp") and size = 2
or
f.hasGlobalOrStdName("snprintf") and size = 1
or
f.hasGlobalOrStdName("strndup") and size = 2
or
f.hasGlobalOrStdName("read") and size = 2
}
class IfCompareWithZero extends IfStmt {
IfCompareWithZero() { this.getCondition().(RelationalOperation).getAChild().getValue() = "0" }
Expr noZerroOperand() {
if this.getCondition().(RelationalOperation).getGreaterOperand().getValue() = "0"
then result = this.getCondition().(RelationalOperation).getLesserOperand()
else result = this.getCondition().(RelationalOperation).getGreaterOperand()
}
}
from FunctionCall fc, IfCompareWithZero ifc, int na
where
numberArgument(fc.getTarget(), na) and
na >= 0 and
globalValueNumber(fc.getArgument(na)) = globalValueNumber(ifc.noZerroOperand()) and
dominates(fc, ifc) and
not exists(IfStmt ifc1 |
dominates(ifc1, fc) and
globalValueNumber(fc.getArgument(na)) = globalValueNumber(ifc1.getCondition().getAChild*())
)
select fc, "Argument '$@' will be checked later.", fc.getArgument(na), fc.getArgument(na).toString()