mirror of
https://github.com/github/codeql.git
synced 2026-05-01 03:35:13 +02:00
Merge pull request #8736 from geoffw0/xxe
C++: New query for CWE-611 / XML External Entity Expansion (XXE)
This commit is contained in:
Geoffrey White
76
cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.expected
Normal file
76
cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.expected
Normal file
@@ -0,0 +1,76 @@
|
||||
edges
|
||||
| tests.cpp:33:23:33:43 | XercesDOMParser output argument | tests.cpp:35:2:35:2 | p |
|
||||
| tests.cpp:46:23:46:43 | XercesDOMParser output argument | tests.cpp:49:2:49:2 | p |
|
||||
| tests.cpp:53:19:53:19 | VariableAddress [post update] | tests.cpp:55:2:55:2 | p |
|
||||
| tests.cpp:53:23:53:43 | XercesDOMParser output argument | tests.cpp:53:19:53:19 | VariableAddress [post update] |
|
||||
| tests.cpp:55:2:55:2 | p | tests.cpp:56:2:56:2 | p |
|
||||
| tests.cpp:56:2:56:2 | p | tests.cpp:57:2:57:2 | p |
|
||||
| tests.cpp:69:19:69:19 | VariableAddress [post update] | tests.cpp:71:2:71:2 | p |
|
||||
| tests.cpp:69:23:69:43 | XercesDOMParser output argument | tests.cpp:69:19:69:19 | VariableAddress [post update] |
|
||||
| tests.cpp:71:2:71:2 | p | tests.cpp:72:2:72:2 | p |
|
||||
| tests.cpp:72:2:72:2 | p | tests.cpp:73:2:73:2 | p |
|
||||
| tests.cpp:73:2:73:2 | p | tests.cpp:74:2:74:2 | p |
|
||||
| tests.cpp:73:2:73:2 | p | tests.cpp:74:2:74:2 | p |
|
||||
| tests.cpp:74:2:74:2 | p | tests.cpp:75:2:75:2 | p |
|
||||
| tests.cpp:75:2:75:2 | p | tests.cpp:76:2:76:2 | p |
|
||||
| tests.cpp:76:2:76:2 | p | tests.cpp:77:2:77:2 | p |
|
||||
| tests.cpp:77:2:77:2 | p | tests.cpp:78:2:78:2 | p |
|
||||
| tests.cpp:84:23:84:43 | XercesDOMParser output argument | tests.cpp:87:2:87:2 | p |
|
||||
| tests.cpp:91:23:91:43 | XercesDOMParser output argument | tests.cpp:98:2:98:2 | p |
|
||||
| tests.cpp:103:24:103:44 | XercesDOMParser output argument | tests.cpp:106:3:106:3 | q |
|
||||
| tests.cpp:118:24:118:44 | XercesDOMParser output argument | tests.cpp:122:3:122:3 | q |
|
||||
| tests.cpp:130:39:130:39 | p | tests.cpp:131:2:131:2 | p |
|
||||
| tests.cpp:134:39:134:39 | p | tests.cpp:135:2:135:2 | p |
|
||||
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:144:18:144:18 | q |
|
||||
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:146:18:146:18 | q |
|
||||
| tests.cpp:144:18:144:18 | q | tests.cpp:130:39:130:39 | p |
|
||||
| tests.cpp:146:18:146:18 | q | tests.cpp:134:39:134:39 | p |
|
||||
nodes
|
||||
| tests.cpp:33:23:33:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:35:2:35:2 | p | semmle.label | p |
|
||||
| tests.cpp:46:23:46:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:49:2:49:2 | p | semmle.label | p |
|
||||
| tests.cpp:53:19:53:19 | VariableAddress [post update] | semmle.label | VariableAddress [post update] |
|
||||
| tests.cpp:53:23:53:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:55:2:55:2 | p | semmle.label | p |
|
||||
| tests.cpp:56:2:56:2 | p | semmle.label | p |
|
||||
| tests.cpp:57:2:57:2 | p | semmle.label | p |
|
||||
| tests.cpp:69:19:69:19 | VariableAddress [post update] | semmle.label | VariableAddress [post update] |
|
||||
| tests.cpp:69:23:69:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:71:2:71:2 | p | semmle.label | p |
|
||||
| tests.cpp:72:2:72:2 | p | semmle.label | p |
|
||||
| tests.cpp:73:2:73:2 | p | semmle.label | p |
|
||||
| tests.cpp:74:2:74:2 | p | semmle.label | p |
|
||||
| tests.cpp:74:2:74:2 | p | semmle.label | p |
|
||||
| tests.cpp:75:2:75:2 | p | semmle.label | p |
|
||||
| tests.cpp:76:2:76:2 | p | semmle.label | p |
|
||||
| tests.cpp:77:2:77:2 | p | semmle.label | p |
|
||||
| tests.cpp:78:2:78:2 | p | semmle.label | p |
|
||||
| tests.cpp:84:23:84:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:87:2:87:2 | p | semmle.label | p |
|
||||
| tests.cpp:91:23:91:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:98:2:98:2 | p | semmle.label | p |
|
||||
| tests.cpp:103:24:103:44 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:106:3:106:3 | q | semmle.label | q |
|
||||
| tests.cpp:118:24:118:44 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:122:3:122:3 | q | semmle.label | q |
|
||||
| tests.cpp:130:39:130:39 | p | semmle.label | p |
|
||||
| tests.cpp:131:2:131:2 | p | semmle.label | p |
|
||||
| tests.cpp:134:39:134:39 | p | semmle.label | p |
|
||||
| tests.cpp:135:2:135:2 | p | semmle.label | p |
|
||||
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
|
||||
| tests.cpp:144:18:144:18 | q | semmle.label | q |
|
||||
| tests.cpp:146:18:146:18 | q | semmle.label | q |
|
||||
subpaths
|
||||
#select
|
||||
| tests.cpp:35:2:35:2 | p | tests.cpp:33:23:33:43 | XercesDOMParser output argument | tests.cpp:35:2:35:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:33:23:33:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:49:2:49:2 | p | tests.cpp:46:23:46:43 | XercesDOMParser output argument | tests.cpp:49:2:49:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:46:23:46:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:57:2:57:2 | p | tests.cpp:53:23:53:43 | XercesDOMParser output argument | tests.cpp:57:2:57:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:53:23:53:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:74:2:74:2 | p | tests.cpp:69:23:69:43 | XercesDOMParser output argument | tests.cpp:74:2:74:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:69:23:69:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:78:2:78:2 | p | tests.cpp:69:23:69:43 | XercesDOMParser output argument | tests.cpp:78:2:78:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:69:23:69:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:87:2:87:2 | p | tests.cpp:84:23:84:43 | XercesDOMParser output argument | tests.cpp:87:2:87:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:84:23:84:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:98:2:98:2 | p | tests.cpp:91:23:91:43 | XercesDOMParser output argument | tests.cpp:98:2:98:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:91:23:91:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:106:3:106:3 | q | tests.cpp:103:24:103:44 | XercesDOMParser output argument | tests.cpp:106:3:106:3 | q | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:103:24:103:44 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:122:3:122:3 | q | tests.cpp:118:24:118:44 | XercesDOMParser output argument | tests.cpp:122:3:122:3 | q | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:118:24:118:44 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:131:2:131:2 | p | tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:131:2:131:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:140:23:140:43 | XercesDOMParser output argument | XML parser |
|
||||
| tests.cpp:135:2:135:2 | p | tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:135:2:135:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:140:23:140:43 | XercesDOMParser output argument | XML parser |
|
||||
1
cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.qlref
Normal file
1
cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.qlref
Normal file
@@ -0,0 +1 @@
|
||||
Security/CWE/CWE-611/XXE.ql
|
||||
170
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp
Normal file
170
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp
Normal file
@@ -0,0 +1,170 @@
|
||||
// test cases for rule CWE-611
|
||||
|
||||
#include "tests.h"
|
||||
|
||||
// ---
|
||||
|
||||
class SecurityManager;
|
||||
class InputSource;
|
||||
|
||||
class AbstractDOMParser {
|
||||
public:
|
||||
AbstractDOMParser();
|
||||
|
||||
void setDisableDefaultEntityResolution(bool); // default is false
|
||||
void setCreateEntityReferenceNodes(bool); // default is true
|
||||
void setSecurityManager(SecurityManager *const manager);
|
||||
void parse(const InputSource &data);
|
||||
};
|
||||
|
||||
class XercesDOMParser: public AbstractDOMParser {
|
||||
public:
|
||||
XercesDOMParser();
|
||||
};
|
||||
|
||||
class LSParser: public AbstractDOMParser {
|
||||
};
|
||||
|
||||
LSParser *createLSParser();
|
||||
|
||||
// ---
|
||||
|
||||
void test1(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->parse(data); // BAD (parser not correctly configured)
|
||||
}
|
||||
|
||||
void test2(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
p->parse(data); // GOOD
|
||||
}
|
||||
|
||||
void test3(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(false);
|
||||
p->parse(data); // BAD (parser not correctly configured)
|
||||
}
|
||||
|
||||
void test4(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
p->setCreateEntityReferenceNodes(false);
|
||||
p->parse(data); // BAD (parser not correctly configured)
|
||||
}
|
||||
|
||||
void test5(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
p->setCreateEntityReferenceNodes(true);
|
||||
p->parse(data); // GOOD
|
||||
}
|
||||
|
||||
void test6(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
p->parse(data); // GOOD
|
||||
p->setDisableDefaultEntityResolution(false);
|
||||
p->parse(data); // BAD (parser not correctly configured)
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
p->parse(data); // GOOD
|
||||
p->setCreateEntityReferenceNodes(false);
|
||||
p->parse(data); // BAD (parser not correctly configured)
|
||||
p->setCreateEntityReferenceNodes(true);
|
||||
p->parse(data); // GOOD
|
||||
}
|
||||
|
||||
void test7(InputSource &data, bool cond) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(cond);
|
||||
p->parse(data); // BAD (parser may not be correctly configured)
|
||||
}
|
||||
|
||||
void test8(InputSource &data, bool cond) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
|
||||
if (cond)
|
||||
{
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
}
|
||||
|
||||
p->parse(data); // BAD (parser may not be correctly configured)
|
||||
}
|
||||
|
||||
void test9(InputSource &data) {
|
||||
{
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
XercesDOMParser &q = *p;
|
||||
|
||||
q.parse(data); // BAD (parser not correctly configured)
|
||||
}
|
||||
|
||||
{
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
XercesDOMParser &q = *p;
|
||||
|
||||
q.setDisableDefaultEntityResolution(true);
|
||||
q.parse(data); // GOOD
|
||||
}
|
||||
|
||||
{
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
XercesDOMParser &q = *p;
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
q.parse(data); // GOOD [FALSE POSITIVE]
|
||||
}
|
||||
}
|
||||
|
||||
void test10_doParseA(XercesDOMParser *p, InputSource &data) {
|
||||
p->parse(data); // GOOD
|
||||
}
|
||||
|
||||
void test10_doParseB(XercesDOMParser *p, InputSource &data) {
|
||||
p->parse(data); // BAD (parser not correctly configured)
|
||||
}
|
||||
|
||||
void test10_doParseC(XercesDOMParser *p, InputSource &data) {
|
||||
p->parse(data); // BAD (parser may not be correctly configured)
|
||||
}
|
||||
|
||||
void test10(InputSource &data) {
|
||||
XercesDOMParser *p = new XercesDOMParser();
|
||||
XercesDOMParser *q = new XercesDOMParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
test10_doParseA(p, data);
|
||||
test10_doParseB(q, data);
|
||||
test10_doParseC(p, data);
|
||||
test10_doParseC(q, data);
|
||||
}
|
||||
|
||||
void test11(InputSource &data) {
|
||||
LSParser *p = createLSParser();
|
||||
|
||||
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
|
||||
}
|
||||
|
||||
void test12(InputSource &data) {
|
||||
LSParser *p = createLSParser();
|
||||
|
||||
p->setDisableDefaultEntityResolution(true);
|
||||
p->parse(data); // GOOD
|
||||
}
|
||||
|
||||
LSParser *g_p1 = createLSParser();
|
||||
LSParser *g_p2 = createLSParser();
|
||||
InputSource *g_data;
|
||||
|
||||
void test13() {
|
||||
g_p1->setDisableDefaultEntityResolution(true);
|
||||
g_p1->parse(*g_data); // GOOD
|
||||
g_p2->parse(*g_data); // BAD (parser not correctly configured) [NOT DETECTED]
|
||||
}
|
||||
2
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.h
Normal file
2
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.h
Normal file
@@ -0,0 +1,2 @@
|
||||
// library functions for rule CWE-611
|
||||
|
||||
Reference in New Issue
Block a user