hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: fix FP and add paths in InsufficientKeySize

Browse Source
This commit is contained in:
Robert Marsh
2022-02-22 15:38:50 -05:00
parent 103796dfa8
commit a37f746dff
2 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
cpp/ql/src/Security/CWE/CWE-326/InsufficientKeySize.ql
View File

@@ -13,6 +13,7 @@
import cpp
import semmle.code.cpp.ir.dataflow.DataFlow
import semmle.code.cpp.ir.IR
import DataFlow::PathGraph
// Gets the recommended minimum key size (in bits) of `func`, the name of an encryption function that accepts a key size as parameter `paramIndex`
int getMinimumKeyStrength(string func, int paramIndex) {
@@ -43,14 +44,16 @@ class KeyStrengthFlow extends DataFlow::Configuration {
}
from
DataFlow::PathNode source, DataFlow::PathNode sink, KeyStrengthFlow conf, FunctionCall fc, int param,
string name, int bits
DataFlow::PathNode source, DataFlow::PathNode sink, KeyStrengthFlow conf, FunctionCall fc,
int param, string name, int minimumBits, int bits
where
conf.hasFlowPath(source, sink) and
sink.getNode().asExpr() = fc.getArgument(param) and
fc.getTarget().hasGlobalName(name) and
bits = getMinimumKeyStrength(name, param) and
source.getNode().asInstruction().(ConstantValueInstruction).getValue().toInt() < bits
minimumBits = getMinimumKeyStrength(name, param) and
bits = source.getNode().asInstruction().(ConstantValueInstruction).getValue().toInt() and
bits < minimumBits and
bits != 0
select fc, source, sink,
"The key size $@ is less than the recommended key size of " + bits.toString() + " bits.", source,
source.toString()
"The key size $@ is less than the recommended key size of " + minimumBits.toString() + " bits.",
source, bits.toString()