hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-06 07:36:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix CWE-611 XXE query to work with use-use dataflow - take 2

Browse Source 
This commit ensures stack allocated parsers are also handled.
This commit is contained in:
Jeroen Ketema
2022-11-23 23:59:04 +01:00
parent 30bdd25228
commit 6fa5fdfeb2
4 changed files with 150 additions and 173 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/src/Security/CWE/CWE-611/XXE.ql
View File

@@ -34,14 +34,14 @@ class XxeConfiguration extends DataFlow::Configuration {
DataFlow::Node node1, string state1, DataFlow::Node node2, string state2
) {
// create additional flow steps for `XxeFlowStateTransformer`s
state2 = node2.asConvertedExpr().(XxeFlowStateTransformer).transform(state1) and
state2 = node2.asIndirectExpr().(XxeFlowStateTransformer).transform(state1) and
DataFlow::simpleLocalFlowStep(node1, node2)
}
override predicate isBarrier(DataFlow::Node node, string flowstate) {
// when the flowstate is transformed at a call node, block the original
// flowstate value.
node.asConvertedExpr().(XxeFlowStateTransformer).transform(flowstate) != flowstate
node.asIndirectExpr().(XxeFlowStateTransformer).transform(flowstate) != flowstate
}
}

24
cpp/ql/src/Security/CWE/CWE-611/Xerces.qll
View File

@@ -65,9 +65,9 @@ class XercesDomParserLibrary extends XmlLibrary {
override predicate configurationSource(DataFlow::Node node, string flowstate) {
// source is the write on `this` of a call to the `XercesDOMParser`
// constructor.
exists(CallInstruction call |
call.getStaticCallTarget() = any(XercesDomParserClass c).getAConstructor() and
node.asInstruction().(StoreInstruction).getSourceValue() = call.getThisArgument() and
exists(Call call |
call.getTarget() = any(XercesDomParserClass c).getAConstructor() and
node.asExpr() = call and
encodeXercesFlowState(flowstate, 0, 1) // default configuration
)
}
@@ -76,7 +76,7 @@ class XercesDomParserLibrary extends XmlLibrary {
// sink is the read of the qualifier of a call to `AbstractDOMParser.parse`.
exists(Call call |
call.getTarget().getClassAndName("parse") instanceof AbstractDomParserClass and
call.getQualifier() = node.asConvertedExpr()
call.getQualifier() = node.asIndirectConvertedExpr()
) and
flowstate instanceof XercesFlowState and
not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
@@ -111,7 +111,7 @@ class CreateLSParserLibrary extends XmlLibrary {
// source is the result of a call to `createLSParser`.
exists(Call call |
call.getTarget() instanceof CreateLSParser and
call = node.asExpr() and
call = node.asIndirectExpr() and
encodeXercesFlowState(flowstate, 0, 1) // default configuration
)
}
@@ -120,7 +120,7 @@ class CreateLSParserLibrary extends XmlLibrary {
// sink is the read of the qualifier of a call to `DOMLSParserClass.parse`.
exists(Call call |
call.getTarget().getClassAndName("parse") instanceof DomLSParserClass and
call.getQualifier() = node.asConvertedExpr()
call.getQualifier() = node.asIndirectConvertedExpr()
) and
flowstate instanceof XercesFlowState and
not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
@@ -150,9 +150,9 @@ class SaxParserLibrary extends XmlLibrary {
override predicate configurationSource(DataFlow::Node node, string flowstate) {
// source is the write on `this` of a call to the `SAXParser`
// constructor.
exists(CallInstruction call |
call.getStaticCallTarget() = any(SaxParserClass c).getAConstructor() and
node.asInstruction().(StoreInstruction).getSourceValue() = call.getThisArgument() and
exists(Call call |
call.getTarget() = any(SaxParserClass c).getAConstructor() and
node.asExpr() = call and
encodeXercesFlowState(flowstate, 0, 1) // default configuration
)
}
@@ -161,7 +161,7 @@ class SaxParserLibrary extends XmlLibrary {
// sink is the read of the qualifier of a call to `SAXParser.parse`.
exists(Call call |
call.getTarget().getClassAndName("parse") instanceof SaxParserClass and
call.getQualifier() = node.asConvertedExpr()
call.getQualifier() = node.asIndirectConvertedExpr()
) and
flowstate instanceof XercesFlowState and
not encodeXercesFlowState(flowstate, 1, 1) // safe configuration
@@ -189,7 +189,7 @@ class Sax2XmlReaderLibrary extends XmlLibrary {
// source is the result of a call to `createXMLReader`.
exists(Call call |
call.getTarget() instanceof CreateXmlReader and
call = node.asExpr() and
call = node.asIndirectExpr() and
encodeXercesFlowState(flowstate, 0, 1) // default configuration
)
}
@@ -198,7 +198,7 @@ class Sax2XmlReaderLibrary extends XmlLibrary {
// sink is the read of the qualifier of a call to `SAX2XMLReader.parse`.
exists(Call call |
call.getTarget().getClassAndName("parse") instanceof Sax2XmlReader and
call.getQualifier() = node.asConvertedExpr()
call.getQualifier() = node.asIndirectConvertedExpr()
) and
flowstate instanceof XercesFlowState and
not encodeXercesFlowState(flowstate, 1, 1) // safe configuration