hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Autoformat result conflation query.

Browse Source
This commit is contained in:
Geoffrey White
2021-11-24 18:20:57 +00:00
parent 88b6bd9478
commit 7869733ab5
1 changed files with 11 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
cpp/ql/src/Security/CWE/CWE-295/SSLResultConflation.ql
View File

@@ -10,15 +10,12 @@
* external/cwe/cwe-295
*/
import cpp
import semmle.code.cpp.controlflow.Guards
import semmle.code.cpp.dataflow.DataFlow
class SSLGetVerifyResultCall extends FunctionCall {
SSLGetVerifyResultCall() {
getTarget().getName() = "SSL_get_verify_result"
}
SSLGetVerifyResultCall() { getTarget().getName() = "SSL_get_verify_result" }
}
class VerifyResultConfig extends DataFlow::Configuration {
@@ -29,21 +26,18 @@ class VerifyResultConfig extends DataFlow::Configuration {
}
override predicate isSink(DataFlow::Node sink) {
exists(GuardCondition guard |
guard.getAChild*() = sink.asExpr()
)
exists(GuardCondition guard | guard.getAChild*() = sink.asExpr())
}
}
from
VerifyResultConfig config, DataFlow::Node source, DataFlow::Node sink1, DataFlow::Node sink2,
GuardCondition guard, Expr c1, Expr c2, boolean testIsTrue
VerifyResultConfig config, DataFlow::Node source, DataFlow::Node sink1, DataFlow::Node sink2,
GuardCondition guard, Expr c1, Expr c2, boolean testIsTrue
where
config.hasFlow(source, sink1) and
config.hasFlow(source, sink2) and
guard.comparesEq(sink1.asExpr(), c1, 0, false, testIsTrue) and // (value != c1) => testIsTrue
guard.comparesEq(sink2.asExpr(), c2, 0, false, testIsTrue) and // (value != c2) => testIsTrue
c1.getValue().toInt() = 0 and
c2.getValue().toInt() != 0
select
guard, "This expression conflates OK and non-OK results from $@.", source, source.toString()
config.hasFlow(source, sink1) and
config.hasFlow(source, sink2) and
guard.comparesEq(sink1.asExpr(), c1, 0, false, testIsTrue) and // (value != c1) => testIsTrue
guard.comparesEq(sink2.asExpr(), c2, 0, false, testIsTrue) and // (value != c2) => testIsTrue
c1.getValue().toInt() = 0 and
c2.getValue().toInt() != 0
select guard, "This expression conflates OK and non-OK results from $@.", source, source.toString()