hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 14:23:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

SSH host checking: Expand definition of a host-key checking function to include calls with multiple return types

Browse Source 
For example, https://godoc.org/golang.org/x/crypto/ssh/knownhosts#New returns a host-key checker and an error value, and we previously didn't consider the first return value a candidate checker function.
This commit is contained in:
Chris Smowton
2020-07-29 16:06:38 +01:00
parent f162a5be94
commit d0e86f787d
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ql/src/Security/CWE-322/InsecureHostKeyCallback.ql
View File

@@ -31,8 +31,9 @@ class HostKeyCallbackFunc extends DataFlow::Node {
(
this instanceof DataFlow::FunctionNode
or
this instanceof DataFlow::CallNode and
not exists(this.(DataFlow::CallNode).getACallee().getBody())
exists(DataFlow::CallNode call | not exists(call.getACallee().getBody()) |
this = call.getAResult()
)
)
}
}
@@ -41,7 +42,7 @@ class HostKeyCallbackFunc extends DataFlow::Node {
class InsecureHostKeyCallbackFunc extends HostKeyCallbackFunc {
InsecureHostKeyCallbackFunc() {
// Either a call to InsecureIgnoreHostKey(), which we know returns an insecure callback.
this = any(InsecureIgnoreHostKey f).getACall()
this = any(InsecureIgnoreHostKey f).getACall().getAResult()
or
// Or a callback function in the source code (named or anonymous) that always returns nil.
forex(DataFlow::ResultNode returnValue |