hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 22:32:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Exclude TLS version sources accompanied by a non-nil error

Browse Source 
It is common to return 0 has a dummy value with an error; these are very likely not going to be used as a real TLS version.
This commit is contained in:
Chris Smowton
2020-07-14 14:30:53 +01:00
parent af960ed2cd
commit a7e549e771
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
ql/src/experimental/CWE-327/InsecureTLS.ql
View File

@@ -83,13 +83,30 @@ predicate nodeSuggestsOldVersion(AstNode node) {
exprSuggestsOldVersion(node.(CaseClause).getAnExpr())
}
/**
* Holds if `node` refers to a value returned alongside a non-nil error value.
*
* For example, `0` in `func tryGetInt() (int, error) { return 0, errors.New("no good") }`
*/
predicate isReturnedWithError(DataFlow::Node node) {
exists(ReturnStmt ret |
ret.getExpr(0) = node.asExpr() and
ret.getNumExpr() = 2 and
ret.getExpr(1).getType().implements(Builtin::error().getType().getUnderlyingType()) and
ret.getExpr(1) != Builtin::nil().getAReference()
)
}
/**
* Flow of TLS versions into a `tls.Config` struct, to the `MinVersion` and `MaxVersion` fields.
*/
class TlsVersionFlowConfig extends TaintTracking::Configuration {
TlsVersionFlowConfig() { this = "TlsVersionFlowConfig" }
predicate isSource(DataFlow::Node source, int val) { val = source.getIntValue() }
predicate isSource(DataFlow::Node source, int val) {
val = source.getIntValue() and
not isReturnedWithError(source)
}
predicate isSink(DataFlow::Node sink, Field fld, DataFlow::Node base, Write fieldWrite) {
fld.hasQualifiedName("crypto/tls", "Config", ["MinVersion", "MaxVersion"]) and