hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 12:16:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Make sure we use an indirect sink only for the sinks that receive a

Browse Source 
pointer to the data. Also fix a bug where we used 'asExpr' instead
of 'asIndirectExpr'.
This commit is contained in:
Mathias Vorreiter Pedersen
2023-03-06 11:22:58 +00:00
parent 620c69df12
commit 8836cbae5b
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cpp/ql/src/Security/CWE/CWE-497/PotentiallyExposedSystemData.ql
View File

@@ -39,7 +39,17 @@ class PotentiallyExposedSystemDataConfiguration extends TaintTracking::Configura
}
override predicate isSink(DataFlow::Node sink) {
exists(OutputWrite ow | ow.getASource().getAChild*() = sink.asIndirectExpr())
exists(OutputWrite ow, Expr child | child = ow.getASource().getAChild*() |
// Most sinks receive a pointer as an argument (for example `printf`),
// and we use an indirect sink for those.
// However, some sinks (for example `puts`) receive receive a single
// character as an argument. For those we have to use a direct sink.
if
child.getUnspecifiedType() instanceof PointerType or
child.getUnspecifiedType() instanceof ArrayType
then child = sink.asIndirectExpr()
else child = sink.asExpr()
)
}
}

2
cpp/ql/src/Security/CWE/CWE-497/SystemData.qll
View File

@@ -72,7 +72,7 @@ private predicate sqlConnectInfo(FunctionCall source, Expr use) {
class SqlConnectInfo extends SystemData {
SqlConnectInfo() { sqlConnectInfo(this, _) }
override DataFlow::Node getAnExpr() { sqlConnectInfo(this, result.asExpr()) }
override DataFlow::Node getAnExpr() { sqlConnectInfo(this, result.asIndirectExpr(1)) }
override predicate isSensitive() { any() }
}