hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Reinstate the original function names model but call it a heuristic now.

Browse Source
This commit is contained in:
Geoffrey White
2025-11-21 18:45:47 +00:00
parent 2ce4c47646
commit eb674d08d6
2 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
rust/ql/lib/codeql/rust/frameworks/attohttpc.model.yml
View File

@@ -1,13 +0,0 @@
extensions:
- addsTo:
pack: codeql/rust-all
extensible: sinkModel
data:
- ["<attohttpc::request::session::Session>::danger_accept_invalid_certs", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::request::session::Session>::danger_accept_invalid_hostnames", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::request::builder::RequestBuilder>::danger_accept_invalid_certs", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::request::builder::RequestBuilder>::danger_accept_invalid_hostnames", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::tls::native_tls_impl::TlsHandshaker>::danger_accept_invalid_certs", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::tls::native_tls_impl::TlsHandshaker>::danger_accept_invalid_hostnames", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::tls::rustls_impl::TlsHandshaker>::danger_accept_invalid_certs", "Argument[0]", "disable-certificate", "manual"]
- ["<attohttpc::tls::rustls_impl::TlsHandshaker>::danger_accept_invalid_hostnames", "Argument[0]", "disable-certificate", "manual"]

13
rust/ql/lib/codeql/rust/security/DisabledCertificateCheckExtensions.qll
View File

@@ -26,4 +26,17 @@ module DisabledCertificateCheckExtensions {
private class ModelsAsDataSink extends Sink {
ModelsAsDataSink() { sinkNode(this, "disable-certificate") }
}
/**
* A heuristic sink for disabled certificate check vulnerabilities based on function names.
*/
private class HeuristicSink extends Sink {
HeuristicSink() {
exists(CallExprBase fc |
fc.getStaticTarget().(Function).getName().getText() =
["danger_accept_invalid_certs", "danger_accept_invalid_hostnames"] and
fc.getArg(0) = this.asExpr()
)
}
}
}