hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

CPP: Support taint flow to qualifiers.

Browse Source
This commit is contained in:
Geoffrey White
2020-01-22 15:37:16 +00:00
parent 974994ed49
commit e6daf3b7ee
4 changed files with 33 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -68,9 +68,11 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
)
or
// Taint can flow through modeled functions
exprToExprStep(nodeFrom.asExpr(), nodeTo.asExpr())
or
exprToDefinitionByReferenceStep(nodeFrom.asExpr(), nodeTo.asDefiningArgument())
or
exprToExprStep(nodeFrom.asExpr(), nodeTo.asExpr())
exprToPartialDefinitionStep(nodeFrom.asExpr(), nodeTo.asPartialDefinition())
}
/**
@@ -187,3 +189,24 @@ private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
)
)
}
private predicate exprToPartialDefinitionStep(Expr exprIn, Expr exprOut) {
exists(TaintFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
call.getTarget() = f and
(
exprOut = call.getQualifier() and
outModel.isQualifierObject()
) and
f.hasTaintFlow(inModel, outModel) and
exists(int argInIndex |
inModel.isParameterDeref(argInIndex) and
exprIn = call.getArgument(argInIndex)
or
inModel.isParameterDeref(argInIndex) and
call.passesByReference(argInIndex, exprIn)
or
inModel.isParameter(argInIndex) and
exprIn = call.getArgument(argInIndex)
)
)
}

6
cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
View File

@@ -420,7 +420,7 @@ void test_qualifiers()
sink(a);
sink(a.getMember());
a.setMember(source());
sink(a); // tainted [NOT DETECTED]
sink(a); // tainted
sink(a.getMember()); // tainted [NOT DETECTED]
sink(b);
@@ -435,7 +435,7 @@ void test_qualifiers()
sink(c);
sink(c->getMember());
c->setMember(source());
sink(c); // tainted (deref) [NOT DETECTED]
sink(c); // tainted (deref)
sink(c->getMember()); // tainted [NOT DETECTED]
delete c;
@@ -443,6 +443,6 @@ void test_qualifiers()
sink(d);
sink(d.getString());
d.setString(strings::source());
sink(d); // tainted [NOT DETECTED]
sink(d); // tainted
sink(d.getString()); // tainted [NOT DETECTED]
}

3
cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
View File

@@ -39,4 +39,7 @@
| taint.cpp:352:7:352:7 | b | taint.cpp:330:6:330:11 | call to source |
| taint.cpp:372:7:372:7 | a | taint.cpp:365:24:365:29 | source |
| taint.cpp:391:7:391:7 | a | taint.cpp:385:27:385:32 | source |
| taint.cpp:423:7:423:7 | a | taint.cpp:422:14:422:19 | call to source |
| taint.cpp:430:9:430:14 | member | taint.cpp:428:13:428:18 | call to source |
| taint.cpp:438:7:438:7 | c | taint.cpp:437:15:437:20 | call to source |
| taint.cpp:446:7:446:7 | d | taint.cpp:445:14:445:28 | call to source |

3
cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
View File

@@ -26,5 +26,8 @@
| taint.cpp:352:7:352:7 | taint.cpp:330:6:330:11 | AST only |
| taint.cpp:372:7:372:7 | taint.cpp:365:24:365:29 | AST only |
| taint.cpp:391:7:391:7 | taint.cpp:385:27:385:32 | AST only |
| taint.cpp:423:7:423:7 | taint.cpp:422:14:422:19 | AST only |
| taint.cpp:429:7:429:7 | taint.cpp:428:13:428:18 | IR only |
| taint.cpp:430:9:430:14 | taint.cpp:428:13:428:18 | AST only |
| taint.cpp:438:7:438:7 | taint.cpp:437:15:437:20 | AST only |
| taint.cpp:446:7:446:7 | taint.cpp:445:14:445:28 | AST only |