hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-21 02:14:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into redsun82/fix-cmake-bazel-version

Browse Source
This commit is contained in:
Paolo Tranquilli
2023-12-13 17:36:07 +01:00
committed by GitHub
parent 819fc52854 25a1b0532e
commit 9e300a9906
7 changed files with 95 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View File

@@ -6,6 +6,7 @@ private import semmle.code.cpp.ir.internal.IRCppLanguage
private import SsaInternals as Ssa
private import DataFlowImplCommon as DataFlowImplCommon
private import codeql.util.Unit
private import Node0ToString
cached
private module Cached {
@@ -138,11 +139,7 @@ abstract class InstructionNode0 extends Node0Impl {
override DataFlowType getType() { result = getInstructionType(instr, _) }
override string toStringImpl() {
if instr.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
then result = "this"
else result = instr.getAst().toString()
}
override string toStringImpl() { result = instructionToString(instr) }
override Location getLocationImpl() {
if exists(instr.getAst().getLocation())
@@ -187,11 +184,7 @@ abstract class OperandNode0 extends Node0Impl {
override DataFlowType getType() { result = getOperandType(op, _) }
override string toStringImpl() {
if op.getDef().(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
then result = "this"
else result = op.getDef().getAst().toString()
}
override string toStringImpl() { result = operandToString(op) }
override Location getLocationImpl() {
if exists(op.getDef().getAst().getLocation())

12
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
View File

@@ -15,6 +15,7 @@ private import ModelUtil
private import SsaInternals as Ssa
private import DataFlowImplCommon as DataFlowImplCommon
private import codeql.util.Unit
private import Node0ToString
/**
* The IR dataflow graph consists of the following nodes:
@@ -486,10 +487,13 @@ class Node extends TIRDataFlowNode {
}
private string toExprString(Node n) {
result = n.asExpr(0).toString()
or
not exists(n.asExpr()) and
result = n.asIndirectExpr(0, 1).toString() + " indirection"
not isDebugMode() and
(
result = n.asExpr(0).toString()
or
not exists(n.asExpr()) and
result = n.asIndirectExpr(0, 1).toString() + " indirection"
)
}
/**

9
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DebugPrinting.qll Normal file
View File

@@ -0,0 +1,9 @@
/**
* This file activates debugging mode for dataflow node printing.
*/
private import Node0ToString
private class DebugNode0ToString extends Node0ToString {
final override predicate isDebugMode() { any() }
}

75
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/Node0ToString.qll Normal file
View File

@@ -0,0 +1,75 @@
/**
* This file contains the abstract class that serves as the base class for
* dataflow node printing.
*
* By default, a non-debug string is produced. However, a debug-friendly
* string can be produced by importing `DebugPrinting.qll`.
*/
private import semmle.code.cpp.ir.IR
private import codeql.util.Unit
/**
* A class to control whether a debugging version of instructions and operands
* should be printed as part of the `toString` output of dataflow nodes.
*
* To enable debug printing import the `DebugPrinting.ql` file. By default,
* non-debug output will be used.
*/
class Node0ToString extends Unit {
abstract predicate isDebugMode();
private string normalInstructionToString(Instruction i) {
not this.isDebugMode() and
if i.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
then result = "this"
else result = i.getAst().toString()
}
private string normalOperandToString(Operand op) {
not this.isDebugMode() and
if op.getDef().(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable
then result = "this"
else result = op.getDef().getAst().toString()
}
/**
* Gets the string that should be used by `InstructionNode.toString`
*/
string instructionToString(Instruction i) {
if this.isDebugMode()
then result = i.getDumpString()
else result = this.normalInstructionToString(i)
}
/**
* Gets the string that should be used by `OperandNode.toString`.
*/
string operandToString(Operand op) {
if this.isDebugMode()
then result = op.getDumpString() + " @ " + op.getUse().getResultId()
else result = this.normalOperandToString(op)
}
}
private class NoDebugNode0ToString extends Node0ToString {
final override predicate isDebugMode() { none() }
}
/**
* Gets the string that should be used by `OperandNode.toString`.
*/
string operandToString(Operand op) { result = any(Node0ToString nts).operandToString(op) }
/**
* Gets the string that should be used by `InstructionNode.toString`
*/
string instructionToString(Instruction i) { result = any(Node0ToString nts).instructionToString(i) }
/**
* Holds if debugging mode is enabled.
*
* In debug mode the `toString` on dataflow nodes is more expensive to compute,
* but gives more precise information about the different dataflow nodes.
*/
predicate isDebugMode() { any(Node0ToString nts).isDebugMode() }

0
swift/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.expected
View File

1
swift/ql/test/query-tests/Security/CWE-327/BrokenCryptoAlgorithm.qlref.disabled
View File

@@ -1 +0,0 @@
queries/Security/CWE-327/BrokenCryptoAlgorithm.ql

217
swift/ql/test/query-tests/Security/CWE-327/test_commoncrypto.swift
View File

@@ -1,217 +0,0 @@
// --- stubs ---
struct Data {
func withUnsafeBytes<ResultType>(
_ body: (UnsafeRawBufferPointer) throws -> ResultType
) rethrows -> ResultType { return 0 as! ResultType }
mutating func withUnsafeMutableBytes<ResultType>(
_ body: (UnsafeMutableRawBufferPointer) throws -> ResultType
) rethrows -> ResultType { return 0 as! ResultType }
}
// --- CommonCryptor ---
// (real world projects will import the CommonCryptor headers which get
// converted to Swift by the compiler; the following is an approximation
// of that derived from QL queries and the CommonCryptor header files)
var kCCSuccess : Int = 0
typealias CCCryptorStatus = Int32
typealias CCCryptorRef = OpaquePointer
var kCCEncrypt : Int = 0
var kCCDecrypt : Int = 1
typealias CCOperation = UInt32
var kCCAlgorithmAES128 : Int = 0
var kCCAlgorithmAES : Int = 0
var kCCAlgorithmDES : Int = 1
var kCCAlgorithm3DES : Int = 2
var kCCAlgorithmCAST : Int = 3
var kCCAlgorithmRC4 : Int = 4
var kCCAlgorithmRC2 : Int = 5
var kCCAlgorithmBlowfish : Int = 6
typealias CCAlgorithm = UInt32
var kCCOptionPKCS7Padding : Int = 1
var kCCOptionECBMode : Int = 2
typealias CCOptions = UInt32
var kCCModeECB : Int = 1
var kCCModeCBC : Int = 2
var kCCModeCFB : Int = 3
var kCCModeCTR : Int = 4
var kCCModeOFB : Int = 7
var kCCModeRC4 : Int = 9
var kCCModeCFB8 : Int = 10
typealias CCMode = UInt32
typealias CCPadding = UInt32
typealias CCModeOptions = UInt32
func CCCryptorCreate(
_ op: CCOperation,
_ alg: CCAlgorithm,
_ options: CCOptions,
_ key: UnsafeRawPointer?,
_ keyLength: Int,
_ iv: UnsafeRawPointer?,
_ cryptorRef: UnsafeMutablePointer<CCCryptorRef?>?
) -> CCCryptorStatus { return 0 }
func CCCryptorCreateFromData(
_ op: CCOperation,
_ alg: CCAlgorithm,
_ options: CCOptions,
_ key: UnsafeRawPointer?,
_ keyLength: Int,
_ iv: UnsafeRawPointer?,
_ data: UnsafeRawPointer?,
_ dataLength: Int,
_ cryptorRef: UnsafeMutablePointer<CCCryptorRef?>?,
_ dataUsed: UnsafeMutablePointer<Int>?
) -> CCCryptorStatus { return 0 }
func CCCryptorCreateWithMode(
_ op: CCOperation,
_ mode: CCMode,
_ alg: CCAlgorithm,
_ padding: CCPadding,
_ iv: UnsafeRawPointer?,
_ key: UnsafeRawPointer?,
_ keyLength: Int,
_ tweak: UnsafeRawPointer?,
_ tweakLength: Int,
_ numRounds: Int32,
_ options: CCModeOptions,
_ cryptorRef: UnsafeMutablePointer<CCCryptorRef?>?
) -> CCCryptorStatus { return 0 }
func CCCryptorUpdate(
_ cryptorRef: CCCryptorRef?,
_ dataIn: UnsafeRawPointer?,
_ dataInLength: Int,
_ dataOut: UnsafeMutableRawPointer?,
_ dataOutAvailable: Int,
_ dataOutMoved: UnsafeMutablePointer<Int>?
) -> CCCryptorStatus { return 0 }
func CCCryptorFinal(
_ cryptorRef: CCCryptorRef?,
_ dataOut: UnsafeMutableRawPointer?,
_ dataOutAvailable: Int,
_ dataOutMoved: UnsafeMutablePointer<Int>?
) -> CCCryptorStatus { return 0 }
func CCCrypt(
_ op: CCOperation,
_ alg: CCAlgorithm,
_ options: CCOptions,
_ key: UnsafeRawPointer?,
_ keyLength: Int,
_ iv: UnsafeRawPointer?,
_ dataIn: UnsafeRawPointer?,
_ dataInLength: Int,
_ dataOut: UnsafeMutableRawPointer?,
_ dataOutAvailable: Int,
_ dataOutMoved: UnsafeMutablePointer<Int>?
) -> CCCryptorStatus { return 0 }
// --- tests ---
func cond() -> Bool { return true }
func test_commoncrypto1(key: Data, iv: Data, dataIn: Data, dataOut: inout Data) {
// semi-realistic test case
var myCryptor: CCCryptorRef?
var dataOutWritten = 0
key.withUnsafeBytes({
keyPtr in
iv.withUnsafeBytes({
// create the cryptor object
ivPtr in
let result1 = CCCryptorCreate(
CCOperation(kCCEncrypt),
CCAlgorithm(kCCAlgorithm3DES), // BAD [NOT DETECTED]
CCOptions(0),
keyPtr.baseAddress!,
keyPtr.count,
ivPtr.baseAddress!,
&myCryptor
)
guard result1 == CCCryptorStatus(kCCSuccess) else {
return // fail
}
dataIn.withUnsafeBytes({
dataInPtr in
dataOut.withUnsafeMutableBytes({
dataOutPtr in
// encrypt data
while (cond()) {
let result2 = CCCryptorUpdate(
myCryptor,
dataInPtr.baseAddress!,
dataInPtr.count,
dataOutPtr.baseAddress!,
dataOutPtr.count,
&dataOutWritten)
guard result2 == CCCryptorStatus(kCCSuccess) else {
return // fail
}
}
// finish
let result3 = CCCryptorFinal(
myCryptor,
dataOutPtr.baseAddress!,
dataOutPtr.count,
&dataOutWritten)
guard result3 == CCCryptorStatus(kCCSuccess) else {
return // fail
}
})
})
})
})
}
func test_commoncrypto2(
key: UnsafeRawPointer, keyLen: Int,
iv: UnsafeRawPointer,
dataIn: UnsafeRawPointer, dataInLen: Int,
dataOut: UnsafeMutableRawPointer, dataOutAvail: Int) {
var myCryptor: CCCryptorRef?
var dataOutWritten = 0
// algorithms
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES128), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil)
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil)
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmDES), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil) // BAD [NOT DETECTED]
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithm3DES), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil) // BAD [NOT DETECTED]
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmCAST), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil)
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmRC4), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil) // BAD [NOT DETECTED]
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmRC2), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil) // BAD [NOT DETECTED]
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmBlowfish), 0, key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil)
_ = CCCryptorCreate(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithm3DES), 0, key, keyLen, iv, &myCryptor) // BAD [NOT DETECTED]
_ = CCCryptorCreateFromData(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithm3DES), 0, key, keyLen, iv, dataIn, dataInLen, &myCryptor, &dataOutWritten) // BAD [NOT DETECTED]
_ = CCCryptorCreateFromData(CCOperation(kCCDecrypt), CCAlgorithm(kCCAlgorithm3DES), 0, key, keyLen, iv, dataIn, dataInLen, &myCryptor, &dataOutWritten) // BAD [NOT DETECTED]
// block modes (the default is CBC)
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES), CCOptions(0), key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil)
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES), CCOptions(kCCOptionPKCS7Padding), key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil)
_ = CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmAES), CCOptions(kCCOptionECBMode), key, keyLen, iv, dataIn, dataInLen, dataOut, dataOutAvail, nil) // BAD [NOT DETECTED]
_ = CCCryptorCreate(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithm3DES), CCOptions(kCCOptionECBMode), key, keyLen, iv, &myCryptor) // BAD [NOT DETECTED]
_ = CCCryptorCreateFromData(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithm3DES), CCOptions(kCCOptionECBMode), key, keyLen, iv, dataIn, dataInLen, &myCryptor, &dataOutWritten) // BAD [NOT DETECTED]
// modes
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeECB), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor) // BAD [NOT DETECTED]
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeCBC), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor)
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeCFB), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor)
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeCTR), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor)
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeOFB), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor)
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeRC4), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor)
_ = CCCryptorCreateWithMode(CCOperation(kCCAlgorithmAES), CCMode(kCCModeCFB8), CCAlgorithm(kCCAlgorithm3DES), CCPadding(0), iv, key, keyLen, nil, 0, 0, CCModeOptions(0), &myCryptor)
}