hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-08 20:20:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Improve logic of bit fields

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2021-03-01 15:04:48 +01:00
parent 7a1d953fca
commit 97d26687fe
1 changed files with 26 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
python/ql/src/Security/CWE-327/Ssl.qll
View File

@@ -37,15 +37,17 @@ class OptionsAugOr extends ProtocolRestriction {
ProtocolVersion restriction;
OptionsAugOr() {
exists(AugAssign aa, AttrNode attr |
exists(AugAssign aa, AttrNode attr, Expr flag |
aa.getOperation().getOp() instanceof BitOr and
aa.getTarget() = attr.getNode() and
attr.getName() = "options" and
attr.getObject() = node and
// TODO: Use something like BoolExpr::impliesValue here
API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() in [
aa.getValue(), aa.getValue().getAChildNode()
]
flag = API::moduleImport("ssl").getMember("OP_NO_" + restriction).getAUse().asExpr() and
(
aa.getValue() = flag
or
impliesValue(aa.getValue(), flag, false, false)
)
)
}
@@ -54,6 +56,25 @@ class OptionsAugOr extends ProtocolRestriction {
override ProtocolVersion getRestriction() { result = restriction }
}
/** Whether `part` evaluates to `partIsTrue` if `whole` evaluates to `wholeIsTrue`. */
predicate impliesValue(BinaryExpr whole, Expr part, boolean partIsTrue, boolean wholeIsTrue) {
whole.getOp() instanceof BitAnd and
(
wholeIsTrue = true and partIsTrue = true and part in [whole.getLeft(), whole.getRight()]
or
wholeIsTrue = true and
impliesValue([whole.getLeft(), whole.getRight()], part, partIsTrue, wholeIsTrue)
)
or
whole.getOp() instanceof BitOr and
(
wholeIsTrue = false and partIsTrue = false and part in [whole.getLeft(), whole.getRight()]
or
wholeIsTrue = false and
impliesValue([whole.getLeft(), whole.getRight()], part, partIsTrue, wholeIsTrue)
)
}
class ContextSetVersion extends ProtocolRestriction {
string restriction;