From 9a35febe80df3c4e36b53ccfa8dea903aa55093b Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 3 Mar 2025 17:20:58 +0000 Subject: [PATCH 001/286] Rust: Query framework and basic tests. --- .../CWE-798/HardcodedCryptographicValue.ql | 21 ++++++ .../HardcodedCryptographicValue.expected | 0 .../CWE-798/HardcodedCryptographicValue.qlref | 2 + .../query-tests/security/CWE-798/options.yml | 6 ++ .../security/CWE-798/test_cipher.rs | 66 +++++++++++++++++++ 5 files changed, 95 insertions(+) create mode 100644 rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql create mode 100644 rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected create mode 100644 rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.qlref create mode 100644 rust/ql/test/query-tests/security/CWE-798/options.yml create mode 100644 rust/ql/test/query-tests/security/CWE-798/test_cipher.rs diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql new file mode 100644 index 00000000000..717831bba2b --- /dev/null +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql @@ -0,0 +1,21 @@ +/** + * @name Hard-coded cryptographic value + * @description Using hardcoded keys, passwords, salts or initialization + * vectors is not secure. + * @kind problem + * @problem.severity warning + * @security-severity TODO + * @precision high + * @id rust/hardcoded-crytographic-value + * @tags security + * external/cwe/cwe-259 + * external/cwe/cwe-321 + * external/cwe/cwe-798 + * external/cwe/cwe-1204 + */ + +import rust + +from Locatable e +where none() +select e, "" diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected new file mode 100644 index 00000000000..e69de29bb2d diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.qlref b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.qlref new file mode 100644 index 00000000000..99053e9bf1a --- /dev/null +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.qlref @@ -0,0 +1,2 @@ +query: queries/security/CWE-798/HardcodedCryptographicValue.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/rust/ql/test/query-tests/security/CWE-798/options.yml b/rust/ql/test/query-tests/security/CWE-798/options.yml new file mode 100644 index 00000000000..07dc5e9922e --- /dev/null +++ b/rust/ql/test/query-tests/security/CWE-798/options.yml @@ -0,0 +1,6 @@ +qltest_cargo_check: true +qltest_dependencies: + - cipher = { version = "0.4.4" } + - rabbit = { version = "0.4.1" } + - aes = { version = "0.8.4" } + - cfb-mode = { version = "0.8.2" } diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs new file mode 100644 index 00000000000..532fe523c07 --- /dev/null +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -0,0 +1,66 @@ + +use cipher::{consts::*, StreamCipher, AsyncStreamCipher, KeyInit, KeyIvInit, BlockEncrypt}; +use rabbit::{Rabbit, RabbitKeyOnly}; +use aes::Aes256; + +// --- tests --- + +fn test_stream_cipher_rabbit( + key: &[u8;16], iv: &[u8;16], plaintext: &str +) { + let mut data = plaintext.as_bytes().to_vec(); + + // rabbit + + let mut rabbit_cipher1 = RabbitKeyOnly::new(rabbit::Key::from_slice(key)); + rabbit_cipher1.apply_keystream(&mut data); + + let const1: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher2 = RabbitKeyOnly::new(rabbit::Key::from_slice(const1)); + rabbit_cipher2.apply_keystream(&mut data); + + let mut rabbit_cipher3 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(iv)); + rabbit_cipher3.apply_keystream(&mut data); + + let const2: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const2), rabbit::Iv::from_slice(iv)); + rabbit_cipher4.apply_keystream(&mut data); + + let const3: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const3)); + rabbit_cipher5.apply_keystream(&mut data); + + let const4: &[u8;16] = &[0u8;16]; // (unused, so good) +} + +fn test_block_cipher_aes( + key: &[u8], iv: &[u8], key256: &[u8;32], + block128: &mut [u8;16], input: &[u8], output: &mut [u8] +) { + // aes + + let aes_cipher1 = Aes256::new(key256.into()); + aes_cipher1.encrypt_block(block128.into()); + + let const1 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher2 = Aes256::new(const1.into()); + aes_cipher2.encrypt_block(block128.into()); + + let aes_cipher3 = Aes256::new_from_slice(key256).unwrap(); + aes_cipher3.encrypt_block(block128.into()); + + let const2 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher4 = Aes256::new_from_slice(const2).unwrap(); + aes_cipher4.encrypt_block(block128.into()); + + let aes_cipher5 = cfb_mode::Encryptor::::new(key.into(), iv.into()); + _ = aes_cipher5.encrypt_b2b(input, output).unwrap(); + + let const3 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher6 = cfb_mode::Encryptor::::new(const3.into(), iv.into()); + _ = aes_cipher6.encrypt_b2b(input, output).unwrap(); + + let const4 = &[0u8; 16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher7 = cfb_mode::Encryptor::::new(key.into(), const4.into()); + _ = aes_cipher7.encrypt_b2b(input, output).unwrap(); +} From bd75f0187b88823b41dd9767b05a081306f29b61 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Wed, 5 Mar 2025 18:44:59 +0000 Subject: [PATCH 002/286] Rust: More test cases. --- .../query-tests/security/CWE-798/options.yml | 2 + .../security/CWE-798/test_cipher.rs | 92 ++++++++++++++++--- 2 files changed, 82 insertions(+), 12 deletions(-) diff --git a/rust/ql/test/query-tests/security/CWE-798/options.yml b/rust/ql/test/query-tests/security/CWE-798/options.yml index 07dc5e9922e..aff715ea271 100644 --- a/rust/ql/test/query-tests/security/CWE-798/options.yml +++ b/rust/ql/test/query-tests/security/CWE-798/options.yml @@ -3,4 +3,6 @@ qltest_dependencies: - cipher = { version = "0.4.4" } - rabbit = { version = "0.4.1" } - aes = { version = "0.8.4" } + - aes-gcm = { version = "0.10.3" } - cfb-mode = { version = "0.8.2" } + - base64 = { version = "0.22.1" } diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs index 532fe523c07..748b9f3e012 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -22,19 +22,40 @@ fn test_stream_cipher_rabbit( let mut rabbit_cipher3 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(iv)); rabbit_cipher3.apply_keystream(&mut data); - let const2: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const2), rabbit::Iv::from_slice(iv)); + let const4: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const4), rabbit::Iv::from_slice(iv)); rabbit_cipher4.apply_keystream(&mut data); - let const3: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const3)); + let const5: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const5)); rabbit_cipher5.apply_keystream(&mut data); - let const4: &[u8;16] = &[0u8;16]; // (unused, so good) + // various expressions of constant arrays + + let const6: &[u8;16] = &[0u8;16]; // (unused, so good) + + let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher7 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const7)); + rabbit_cipher7.apply_keystream(&mut data); + + let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher8 = RabbitKeyOnly::new(rabbit::Key::from_slice(const8)); + rabbit_cipher8.apply_keystream(&mut data); + + let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let const9_conv = unsafe { const9.align_to::().1 }; // convert [u16;8] -> [u8;8] + let mut rabbit_cipher9 = RabbitKeyOnly::new(rabbit::Key::from_slice(const9_conv)); + rabbit_cipher9.apply_keystream(&mut data); + + let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher10 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const10)); + rabbit_cipher10.apply_keystream(&mut data); } +use base64::Engine; + fn test_block_cipher_aes( - key: &[u8], iv: &[u8], key256: &[u8;32], + key: &[u8], iv: &[u8], key256: &[u8;32], key_str: &str, block128: &mut [u8;16], input: &[u8], output: &mut [u8] ) { // aes @@ -42,8 +63,8 @@ fn test_block_cipher_aes( let aes_cipher1 = Aes256::new(key256.into()); aes_cipher1.encrypt_block(block128.into()); - let const1 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher2 = Aes256::new(const1.into()); + let const2 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher2 = Aes256::new(const2.into()); aes_cipher2.encrypt_block(block128.into()); let aes_cipher3 = Aes256::new_from_slice(key256).unwrap(); @@ -56,11 +77,58 @@ fn test_block_cipher_aes( let aes_cipher5 = cfb_mode::Encryptor::::new(key.into(), iv.into()); _ = aes_cipher5.encrypt_b2b(input, output).unwrap(); - let const3 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher6 = cfb_mode::Encryptor::::new(const3.into(), iv.into()); + let const6 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher6 = cfb_mode::Encryptor::::new(const6.into(), iv.into()); _ = aes_cipher6.encrypt_b2b(input, output).unwrap(); - let const4 = &[0u8; 16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher7 = cfb_mode::Encryptor::::new(key.into(), const4.into()); + let const7 = &[0u8; 16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher7 = cfb_mode::Encryptor::::new(key.into(), const7.into()); _ = aes_cipher7.encrypt_b2b(input, output).unwrap(); + + // various string conversions + + let key8: &[u8] = key_str.as_bytes(); + let aes_cipher8 = cfb_mode::Encryptor::::new(key8.into(), iv.into()); + _ = aes_cipher8.encrypt_b2b(input, output).unwrap(); + + let key9: &[u8] = "1234567890123456".as_bytes(); // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let aes_cipher9 = cfb_mode::Encryptor::::new(key9.into(), iv.into()); + _ = aes_cipher9.encrypt_b2b(input, output).unwrap(); + + let key10: [u8; 32] = match base64::engine::general_purpose::STANDARD.decode(key_str) { + Ok(x) => x.try_into().unwrap(), + Err(_) => "1234567890123456".as_bytes().try_into().unwrap() // $ MISSING: Alert[rust/hardcoded-crytographic-value] + }; + let aes_cipher10 = Aes256::new(&key10.into()); + aes_cipher10.encrypt_block(block128.into()); + + if let Ok(const11) = base64::engine::general_purpose::STANDARD.decode("1234567890123456") { // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let key11: [u8; 32] = const11.try_into().unwrap(); + let aes_cipher11 = Aes256::new(&key11.into()); + aes_cipher11.encrypt_block(block128.into()); + } +} + +use aes_gcm::aead::{Aead, AeadCore, OsRng}; +use aes_gcm::{Aes256Gcm, Key, Nonce}; + +fn test_aes_gcm( +) { + // aes (GCM) + + let key1 = Aes256Gcm::generate_key(aes_gcm::aead::OsRng); + let nonce1 = Aes256Gcm::generate_nonce(aes_gcm::aead::OsRng); + let cipher1 = Aes256Gcm::new(&key1); + let _ = cipher1.encrypt(&nonce1, b"plaintext".as_ref()).unwrap(); + + let key2: [u8;32] = [0;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let nonce2 = [0;12]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let cipher2 = Aes256Gcm::new(&key2.into()); + let _ = cipher2.encrypt(&nonce2.into(), b"plaintext".as_ref()).unwrap(); + + let key3_array: &[u8;32] = &[0xff;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let key3 = Key::::from_slice(key3_array); + let nonce3: [u8;12] = [0xff;12]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let cipher3 = Aes256Gcm::new(&key3); + let _ = cipher3.encrypt(&nonce3.into(), b"plaintext".as_ref()).unwrap(); } From 9fb00daeecb423f2b1beab21472dc40dd35eb0c8 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 3 Mar 2025 19:43:55 +0000 Subject: [PATCH 003/286] Rust: Implement the query (with one source, one sink model). --- .../rustcrypto/rustcrypto.model.yml | 1 + .../HardcodedCryptographicValueExtensions.qll | 57 +++++++++++++++++++ .../CWE-798/HardcodedCryptographicValue.ql | 37 ++++++++++-- .../HardcodedCryptographicValue.expected | 16 ++++++ .../security/CWE-798/test_cipher.rs | 4 +- 5 files changed, 109 insertions(+), 6 deletions(-) create mode 100644 rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll diff --git a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml index fe3fd67a8fd..baf21e9d6cc 100644 --- a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml +++ b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml @@ -8,3 +8,4 @@ extensions: - ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::chain_update", "Argument[0]", "hasher-input", "manual"] - ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::digest", "Argument[0]", "hasher-input", "manual"] - ["repo:https://github.com/stainless-steel/md5:md5", "crate::compute", "Argument[0]", "hasher-input", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "crate::KeyInit::new_from_slice", "Argument[0]", "credentials-key", "manual"] diff --git a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll new file mode 100644 index 00000000000..006f4fd8139 --- /dev/null +++ b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll @@ -0,0 +1,57 @@ +/** + * Provides classes and predicates for reasoning about hardcoded cryptographic value + * vulnerabilities. + */ + +import rust +private import codeql.rust.dataflow.DataFlow +private import codeql.rust.dataflow.internal.DataFlowImpl +private import codeql.rust.security.SensitiveData + +/** + * Provides default sources, sinks and barriers for detecting hardcoded cryptographic + * value vulnerabilities, as well as extension points for adding your own. + */ +module HardcodedCryptographicValue { + /** + * A data flow source for hardcoded cryptographic value vulnerabilities. + */ + abstract class Source extends DataFlow::Node { } + + /** + * A data flow sink for hardcoded cryptographic value vulnerabilities. + */ + abstract class Sink extends DataFlow::Node { + /** + * Gets the kind of credential this sink is interpreted as, + * for example "password", "key", "iv", "salt". + */ + abstract string getKind(); + } + + /** + * A barrier for hardcoded cryptographic value vulnerabilities. + */ + abstract class Barrier extends DataFlow::Node { } + + /** + * A literal, considered as a flow source. + */ + private class LiteralSource extends Source { + LiteralSource() { this.asExpr().getExpr() instanceof LiteralExpr } + } + + /** + * A sink for hardcoded cryptographic value from model data. + */ + private class ModelsAsDataSinks extends Sink { + string kind; + + ModelsAsDataSinks() { + kind = ["password", "key", "iv", "salt"] and + sinkNode(this, "credentials-" + kind) + } + + override string getKind() { result = kind } + } +} diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql index 717831bba2b..2ec8ea8c257 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql @@ -2,7 +2,7 @@ * @name Hard-coded cryptographic value * @description Using hardcoded keys, passwords, salts or initialization * vectors is not secure. - * @kind problem + * @kind path-problem * @problem.severity warning * @security-severity TODO * @precision high @@ -15,7 +15,36 @@ */ import rust +import codeql.rust.security.HardcodedCryptographicValueExtensions +import codeql.rust.dataflow.DataFlow +import codeql.rust.dataflow.TaintTracking +import codeql.rust.dataflow.internal.DataFlowImpl -from Locatable e -where none() -select e, "" +/** + * A taint-tracking configuration for hardcoded cryptographic value vulnerabilities. + */ +module HardcodedCryptographicValueConfig implements DataFlow::ConfigSig { + import HardcodedCryptographicValue + + predicate isSource(DataFlow::Node source) { source instanceof Source } + + predicate isSink(DataFlow::Node sink) { sink instanceof Sink } + + predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier } + + predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) { + // flow out from reference content at sinks. + isSink(node) and + c.getAReadContent() instanceof ReferenceContent + } +} + +module HardcodedCryptographicValueFlow = TaintTracking::Global; + +import HardcodedCryptographicValueFlow::PathGraph + +from + HardcodedCryptographicValueFlow::PathNode source, HardcodedCryptographicValueFlow::PathNode sink +where HardcodedCryptographicValueFlow::flowPath(source, sink) +select source.getNode(), source, sink, "This hard-coded value is used as $@.", sink, + sink.getNode().(HardcodedCryptographicValueConfig::Sink).getKind() diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index e69de29bb2d..4e3e67e41e0 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -0,0 +1,16 @@ +#select +| test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | key | +edges +| test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | +| test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | +| test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | test_cipher.rs:73:18:73:26 | &... [&ref, element] | provenance | | +| test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | provenance | | +| test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:54 Sink:MaD:54 Sink:MaD:54 | +nodes +| test_cipher.rs:73:9:73:14 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | +| test_cipher.rs:73:18:73:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | +| test_cipher.rs:73:20:73:22 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:74:23:74:44 | ...::new_from_slice | semmle.label | ...::new_from_slice | +| test_cipher.rs:74:46:74:51 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | +subpaths diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs index 748b9f3e012..cfd07d688a1 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -70,8 +70,8 @@ fn test_block_cipher_aes( let aes_cipher3 = Aes256::new_from_slice(key256).unwrap(); aes_cipher3.encrypt_block(block128.into()); - let const2 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher4 = Aes256::new_from_slice(const2).unwrap(); + let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value] + let aes_cipher4 = Aes256::new_from_slice(const2).unwrap(); // $ Sink aes_cipher4.encrypt_block(block128.into()); let aes_cipher5 = cfb_mode::Encryptor::::new(key.into(), iv.into()); From a6e106e025ad51c11f8fe4c5abef38c65317b4b6 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Tue, 4 Mar 2025 16:02:33 +0000 Subject: [PATCH 004/286] Rust: Model more sinks + flows. --- .../rust/frameworks/genericarray.model.yml | 9 + .../rustcrypto/rustcrypto.model.yml | 31 ++++ .../HardcodedCryptographicValue.expected | 162 +++++++++++++++++- .../security/CWE-798/test_cipher.rs | 20 +-- 4 files changed, 211 insertions(+), 11 deletions(-) create mode 100644 rust/ql/lib/codeql/rust/frameworks/genericarray.model.yml diff --git a/rust/ql/lib/codeql/rust/frameworks/genericarray.model.yml b/rust/ql/lib/codeql/rust/frameworks/genericarray.model.yml new file mode 100644 index 00000000000..29a72e2666c --- /dev/null +++ b/rust/ql/lib/codeql/rust/frameworks/genericarray.model.yml @@ -0,0 +1,9 @@ +extensions: + - addsTo: + pack: codeql/rust-all + extensible: summaryModel + data: + - ["repo:https://github.com/fizyk20/generic-array.git:generic-array", "::from_slice", "Argument[0].Reference", "ReturnValue.Reference", "value", "manual"] + - ["repo:https://github.com/fizyk20/generic-array.git:generic-array", "::from_mut_slice", "Argument[0].Reference", "ReturnValue.Reference", "value", "manual"] + - ["repo:https://github.com/fizyk20/generic-array.git:generic-array", "::try_from_slice", "Argument[0].Reference", "ReturnValue.Field[crate::result::Result::Ok(0)].Reference", "value", "manual"] + - ["repo:https://github.com/fizyk20/generic-array.git:generic-array", "::try_from_mut_slice", "Argument[0].Reference", "ReturnValue.Field[crate::result::Result::Ok(0)].Reference", "value", "manual"] diff --git a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml index baf21e9d6cc..5b5b42ca309 100644 --- a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml +++ b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml @@ -8,4 +8,35 @@ extensions: - ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::chain_update", "Argument[0]", "hasher-input", "manual"] - ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::digest", "Argument[0]", "hasher-input", "manual"] - ["repo:https://github.com/stainless-steel/md5:md5", "crate::compute", "Argument[0]", "hasher-input", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[1]", "credentials-iv", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new_from_slice", "Argument[1]", "credentials-iv", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "crate::KeyInit::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "crate::KeyInit::new", "Argument[1]", "credentials-iv", "manual"] - ["repo:https://github.com/RustCrypto/traits:crypto-common", "crate::KeyInit::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "crate::KeyInit::new_from_slice", "Argument[1]", "credentials-iv", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new", "Argument[1]", "credentials-iv", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new_from_slices", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new_from_slices", "Argument[1]", "credentials-iv", "manual"] diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index 4e3e67e41e0..f7ab5392e75 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -1,12 +1,172 @@ #select +| test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:19:30:19:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:19:30:19:47 | ...::new | key | +| test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:26:30:26:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:26:30:26:40 | ...::new | key | +| test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | iv | +| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | +| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | +| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | key | edges +| test_cipher.rs:18:9:18:14 | const1 [&ref, element] | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | provenance | | +| test_cipher.rs:18:28:18:36 | &... [&ref, element] | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | provenance | | +| test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | test_cipher.rs:18:28:18:36 | &... [&ref, element] | provenance | | +| test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | provenance | | +| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:19:30:19:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:19:73:19:78 | const1 [&ref, element] | test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:25:9:25:14 | const4 [&ref, element] | test_cipher.rs:26:66:26:71 | const4 [&ref, element] | provenance | | +| test_cipher.rs:25:28:25:36 | &... [&ref, element] | test_cipher.rs:25:9:25:14 | const4 [&ref, element] | provenance | | +| test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | test_cipher.rs:25:28:25:36 | &... [&ref, element] | provenance | | +| test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | provenance | | +| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | test_cipher.rs:26:30:26:40 | ...::new | provenance | MaD:82 Sink:MaD:82 Sink:MaD:82 | +| test_cipher.rs:26:66:26:71 | const4 [&ref, element] | test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:29:9:29:14 | const5 [&ref, element] | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | provenance | | +| test_cipher.rs:29:28:29:36 | &... [&ref, element] | test_cipher.rs:29:9:29:14 | const5 [&ref, element] | provenance | | +| test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | test_cipher.rs:29:28:29:36 | &... [&ref, element] | provenance | | +| test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | provenance | | +| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:83 Sink:MaD:83 Sink:MaD:83 | +| test_cipher.rs:30:95:30:100 | const5 [&ref, element] | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:37:9:37:14 | const7 [element] | test_cipher.rs:38:74:38:79 | const7 [element] | provenance | | +| test_cipher.rs:37:27:37:74 | [...] [element] | test_cipher.rs:37:9:37:14 | const7 [element] | provenance | | +| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | +| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref, element] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:38:73:38:79 | &const7 [&ref, element] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:38:74:38:79 | const7 [element] | test_cipher.rs:38:73:38:79 | &const7 [&ref, element] | provenance | | +| test_cipher.rs:41:9:41:14 | const8 [&ref, element] | test_cipher.rs:42:73:42:78 | const8 [&ref, element] | provenance | | +| test_cipher.rs:41:28:41:76 | &... [&ref, element] | test_cipher.rs:41:9:41:14 | const8 [&ref, element] | provenance | | +| test_cipher.rs:41:29:41:76 | [...] [element] | test_cipher.rs:41:28:41:76 | &... [&ref, element] | provenance | | +| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | +| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:42:73:42:78 | const8 [&ref, element] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | test_cipher.rs:73:18:73:26 | &... [&ref, element] | provenance | | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:54 Sink:MaD:54 Sink:MaD:54 | +| test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:84 Sink:MaD:84 Sink:MaD:84 | nodes +| test_cipher.rs:18:9:18:14 | const1 [&ref, element] | semmle.label | const1 [&ref, element] | +| test_cipher.rs:18:28:18:36 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | semmle.label | [0u8; 16] [element] | +| test_cipher.rs:18:30:18:32 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:19:30:19:47 | ...::new | semmle.label | ...::new | +| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:19:73:19:78 | const1 [&ref, element] | semmle.label | const1 [&ref, element] | +| test_cipher.rs:25:9:25:14 | const4 [&ref, element] | semmle.label | const4 [&ref, element] | +| test_cipher.rs:25:28:25:36 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | semmle.label | [0u8; 16] [element] | +| test_cipher.rs:25:30:25:32 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:26:30:26:40 | ...::new | semmle.label | ...::new | +| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:26:66:26:71 | const4 [&ref, element] | semmle.label | const4 [&ref, element] | +| test_cipher.rs:29:9:29:14 | const5 [&ref, element] | semmle.label | const5 [&ref, element] | +| test_cipher.rs:29:28:29:36 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | semmle.label | [0u8; 16] [element] | +| test_cipher.rs:29:30:29:32 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:30:30:30:40 | ...::new | semmle.label | ...::new | +| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:30:95:30:100 | const5 [&ref, element] | semmle.label | const5 [&ref, element] | +| test_cipher.rs:37:9:37:14 | const7 [element] | semmle.label | const7 [element] | +| test_cipher.rs:37:27:37:74 | [...] [element] | semmle.label | [...] [element] | +| test_cipher.rs:37:28:37:28 | 0 | semmle.label | 0 | +| test_cipher.rs:37:31:37:31 | 0 | semmle.label | 0 | +| test_cipher.rs:37:34:37:34 | 0 | semmle.label | 0 | +| test_cipher.rs:37:37:37:37 | 0 | semmle.label | 0 | +| test_cipher.rs:37:40:37:40 | 0 | semmle.label | 0 | +| test_cipher.rs:37:43:37:43 | 0 | semmle.label | 0 | +| test_cipher.rs:37:46:37:46 | 0 | semmle.label | 0 | +| test_cipher.rs:37:49:37:49 | 0 | semmle.label | 0 | +| test_cipher.rs:37:52:37:52 | 0 | semmle.label | 0 | +| test_cipher.rs:37:55:37:55 | 0 | semmle.label | 0 | +| test_cipher.rs:37:58:37:58 | 0 | semmle.label | 0 | +| test_cipher.rs:37:61:37:61 | 0 | semmle.label | 0 | +| test_cipher.rs:37:64:37:64 | 0 | semmle.label | 0 | +| test_cipher.rs:37:67:37:67 | 0 | semmle.label | 0 | +| test_cipher.rs:37:70:37:70 | 0 | semmle.label | 0 | +| test_cipher.rs:37:73:37:73 | 0 | semmle.label | 0 | +| test_cipher.rs:38:30:38:47 | ...::new | semmle.label | ...::new | +| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:38:73:38:79 | &const7 [&ref, element] | semmle.label | &const7 [&ref, element] | +| test_cipher.rs:38:74:38:79 | const7 [element] | semmle.label | const7 [element] | +| test_cipher.rs:41:9:41:14 | const8 [&ref, element] | semmle.label | const8 [&ref, element] | +| test_cipher.rs:41:28:41:76 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:41:29:41:76 | [...] [element] | semmle.label | [...] [element] | +| test_cipher.rs:41:30:41:30 | 0 | semmle.label | 0 | +| test_cipher.rs:41:33:41:33 | 0 | semmle.label | 0 | +| test_cipher.rs:41:36:41:36 | 0 | semmle.label | 0 | +| test_cipher.rs:41:39:41:39 | 0 | semmle.label | 0 | +| test_cipher.rs:41:42:41:42 | 0 | semmle.label | 0 | +| test_cipher.rs:41:45:41:45 | 0 | semmle.label | 0 | +| test_cipher.rs:41:48:41:48 | 0 | semmle.label | 0 | +| test_cipher.rs:41:51:41:51 | 0 | semmle.label | 0 | +| test_cipher.rs:41:54:41:54 | 0 | semmle.label | 0 | +| test_cipher.rs:41:57:41:57 | 0 | semmle.label | 0 | +| test_cipher.rs:41:60:41:60 | 0 | semmle.label | 0 | +| test_cipher.rs:41:63:41:63 | 0 | semmle.label | 0 | +| test_cipher.rs:41:66:41:66 | 0 | semmle.label | 0 | +| test_cipher.rs:41:69:41:69 | 0 | semmle.label | 0 | +| test_cipher.rs:41:72:41:72 | 0 | semmle.label | 0 | +| test_cipher.rs:41:75:41:75 | 0 | semmle.label | 0 | +| test_cipher.rs:42:30:42:47 | ...::new | semmle.label | ...::new | +| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:42:73:42:78 | const8 [&ref, element] | semmle.label | const8 [&ref, element] | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs index cfd07d688a1..cfa20ab13c2 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -15,31 +15,31 @@ fn test_stream_cipher_rabbit( let mut rabbit_cipher1 = RabbitKeyOnly::new(rabbit::Key::from_slice(key)); rabbit_cipher1.apply_keystream(&mut data); - let const1: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher2 = RabbitKeyOnly::new(rabbit::Key::from_slice(const1)); + let const1: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher2 = RabbitKeyOnly::new(rabbit::Key::from_slice(const1)); // $ Sink rabbit_cipher2.apply_keystream(&mut data); let mut rabbit_cipher3 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(iv)); rabbit_cipher3.apply_keystream(&mut data); - let const4: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const4), rabbit::Iv::from_slice(iv)); + let const4: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const4), rabbit::Iv::from_slice(iv)); // $ Sink rabbit_cipher4.apply_keystream(&mut data); - let const5: &[u8;16] = &[0u8;16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const5)); + let const5: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const5)); // $ Sink rabbit_cipher5.apply_keystream(&mut data); // various expressions of constant arrays let const6: &[u8;16] = &[0u8;16]; // (unused, so good) - let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher7 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const7)); + let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher7 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const7)); // $ Sink rabbit_cipher7.apply_keystream(&mut data); - let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher8 = RabbitKeyOnly::new(rabbit::Key::from_slice(const8)); + let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher8 = RabbitKeyOnly::new(rabbit::Key::from_slice(const8)); // $ Sink rabbit_cipher8.apply_keystream(&mut data); let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] From aacbfc0fd88af543a665bc7d2fa27b884091e98c Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Wed, 5 Mar 2025 10:38:04 +0000 Subject: [PATCH 005/286] Rust: Improve alert messages. --- .../HardcodedCryptographicValueExtensions.qll | 34 ++++++--- .../CWE-798/HardcodedCryptographicValue.ql | 2 +- .../HardcodedCryptographicValue.expected | 72 +++++++++---------- 3 files changed, 62 insertions(+), 46 deletions(-) diff --git a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll index 006f4fd8139..246d138f91b 100644 --- a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll @@ -8,6 +8,26 @@ private import codeql.rust.dataflow.DataFlow private import codeql.rust.dataflow.internal.DataFlowImpl private import codeql.rust.security.SensitiveData +/** + * A kind of cryptographic value. + */ +class CryptographicValueKind extends string { + CryptographicValueKind() { this = ["password", "key", "iv", "salt"] } + + /** + * Gets a description of this value kind for user-facing messages. + */ + string getDescription() { + this = "password" and result = "a password" + or + this = "key" and result = "a key" + or + this = "iv" and result = "an initialization vector" + or + this = "salt" and result = "a salt" + } +} + /** * Provides default sources, sinks and barriers for detecting hardcoded cryptographic * value vulnerabilities, as well as extension points for adding your own. @@ -23,10 +43,9 @@ module HardcodedCryptographicValue { */ abstract class Sink extends DataFlow::Node { /** - * Gets the kind of credential this sink is interpreted as, - * for example "password", "key", "iv", "salt". + * Gets the kind of credential this sink is interpreted as. */ - abstract string getKind(); + abstract CryptographicValueKind getKind(); } /** @@ -45,13 +64,10 @@ module HardcodedCryptographicValue { * A sink for hardcoded cryptographic value from model data. */ private class ModelsAsDataSinks extends Sink { - string kind; + CryptographicValueKind kind; - ModelsAsDataSinks() { - kind = ["password", "key", "iv", "salt"] and - sinkNode(this, "credentials-" + kind) - } + ModelsAsDataSinks() { sinkNode(this, "credentials-" + kind) } - override string getKind() { result = kind } + override CryptographicValueKind getKind() { result = kind } } } diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql index 2ec8ea8c257..716604ee484 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql @@ -47,4 +47,4 @@ from HardcodedCryptographicValueFlow::PathNode source, HardcodedCryptographicValueFlow::PathNode sink where HardcodedCryptographicValueFlow::flowPath(source, sink) select source.getNode(), source, sink, "This hard-coded value is used as $@.", sink, - sink.getNode().(HardcodedCryptographicValueConfig::Sink).getKind() + sink.getNode().(HardcodedCryptographicValueConfig::Sink).getKind().getDescription() diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index f7ab5392e75..9a52e7e2f5d 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -1,40 +1,40 @@ #select -| test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:19:30:19:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:19:30:19:47 | ...::new | key | -| test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:26:30:26:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:26:30:26:40 | ...::new | key | -| test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | iv | -| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key | -| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key | -| test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | key | +| test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:19:30:19:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:19:30:19:47 | ...::new | a key | +| test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:26:30:26:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:26:30:26:40 | ...::new | a key | +| test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | an initialization vector | +| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | a key | edges | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | provenance | | | test_cipher.rs:18:28:18:36 | &... [&ref, element] | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | provenance | | From 055baf2769bda0d87bdffc853095038cbe4807c8 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 15:46:51 +0000 Subject: [PATCH 006/286] Rust: Improve results on arrays (less duplication). --- .../HardcodedCryptographicValueExtensions.qll | 12 ++ .../CWE-798/HardcodedCryptographicValue.ql | 7 + .../HardcodedCryptographicValue.expected | 138 +++--------------- 3 files changed, 41 insertions(+), 116 deletions(-) diff --git a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll index 246d138f91b..f7f26032b51 100644 --- a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll @@ -60,6 +60,18 @@ module HardcodedCryptographicValue { LiteralSource() { this.asExpr().getExpr() instanceof LiteralExpr } } + /** + * An array initialized from a list of literals, considered as a single flow source. For example: + * ``` + * `[0, 0, 0, 0]` + * ``` + */ + private class ArrayListSource extends Source { + ArrayListSource() { + this.asExpr().getExpr().(ArrayListExpr).getExpr(_) instanceof LiteralExpr + } + } + /** * A sink for hardcoded cryptographic value from model data. */ diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql index 716604ee484..441c22f679a 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql @@ -32,6 +32,13 @@ module HardcodedCryptographicValueConfig implements DataFlow::ConfigSig { predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier } + predicate isBarrierIn(DataFlow::Node node) { + // make sources barriers so that we only report the closest instance + // (this combined with sources for `ArrayListExpr` means we only get one source in + // case like `[0, 0, 0, 0]`) + isSource(node) + } + predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) { // flow out from reference content at sinks. isSink(node) and diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index 9a52e7e2f5d..2ed68852eb5 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -2,38 +2,8 @@ | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:19:30:19:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:19:30:19:47 | ...::new | a key | | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:26:30:26:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:26:30:26:40 | ...::new | a key | | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | an initialization vector | -| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | -| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | -| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | +| test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | a key | edges | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | provenance | | @@ -54,48 +24,16 @@ edges | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | provenance | | | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:83 Sink:MaD:83 Sink:MaD:83 | | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | -| test_cipher.rs:37:9:37:14 | const7 [element] | test_cipher.rs:38:74:38:79 | const7 [element] | provenance | | -| test_cipher.rs:37:27:37:74 | [...] [element] | test_cipher.rs:37:9:37:14 | const7 [element] | provenance | | -| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:27:37:74 | [...] [element] | provenance | | -| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref, element] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | -| test_cipher.rs:38:73:38:79 | &const7 [&ref, element] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | -| test_cipher.rs:38:74:38:79 | const7 [element] | test_cipher.rs:38:73:38:79 | &const7 [&ref, element] | provenance | | -| test_cipher.rs:41:9:41:14 | const8 [&ref, element] | test_cipher.rs:42:73:42:78 | const8 [&ref, element] | provenance | | -| test_cipher.rs:41:28:41:76 | &... [&ref, element] | test_cipher.rs:41:9:41:14 | const8 [&ref, element] | provenance | | -| test_cipher.rs:41:29:41:76 | [...] [element] | test_cipher.rs:41:28:41:76 | &... [&ref, element] | provenance | | -| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:29:41:76 | [...] [element] | provenance | | -| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | -| test_cipher.rs:42:73:42:78 | const8 [&ref, element] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:37:9:37:14 | const7 | test_cipher.rs:38:74:38:79 | const7 | provenance | | +| test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:9:37:14 | const7 | provenance | | +| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:58 Sink:MaD:58 | +| test_cipher.rs:38:73:38:79 | &const7 [&ref] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | provenance | MaD:0 | +| test_cipher.rs:38:74:38:79 | const7 | test_cipher.rs:38:73:38:79 | &const7 [&ref] | provenance | | +| test_cipher.rs:41:9:41:14 | const8 [&ref] | test_cipher.rs:42:73:42:78 | const8 [&ref] | provenance | | +| test_cipher.rs:41:28:41:76 | &... [&ref] | test_cipher.rs:41:9:41:14 | const8 [&ref] | provenance | | +| test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:28:41:76 | &... [&ref] | provenance | | +| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:58 Sink:MaD:58 | +| test_cipher.rs:42:73:42:78 | const8 [&ref] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | provenance | MaD:0 | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | test_cipher.rs:73:18:73:26 | &... [&ref, element] | provenance | | @@ -123,50 +61,18 @@ nodes | test_cipher.rs:30:30:30:40 | ...::new | semmle.label | ...::new | | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | semmle.label | const5 [&ref, element] | -| test_cipher.rs:37:9:37:14 | const7 [element] | semmle.label | const7 [element] | -| test_cipher.rs:37:27:37:74 | [...] [element] | semmle.label | [...] [element] | -| test_cipher.rs:37:28:37:28 | 0 | semmle.label | 0 | -| test_cipher.rs:37:31:37:31 | 0 | semmle.label | 0 | -| test_cipher.rs:37:34:37:34 | 0 | semmle.label | 0 | -| test_cipher.rs:37:37:37:37 | 0 | semmle.label | 0 | -| test_cipher.rs:37:40:37:40 | 0 | semmle.label | 0 | -| test_cipher.rs:37:43:37:43 | 0 | semmle.label | 0 | -| test_cipher.rs:37:46:37:46 | 0 | semmle.label | 0 | -| test_cipher.rs:37:49:37:49 | 0 | semmle.label | 0 | -| test_cipher.rs:37:52:37:52 | 0 | semmle.label | 0 | -| test_cipher.rs:37:55:37:55 | 0 | semmle.label | 0 | -| test_cipher.rs:37:58:37:58 | 0 | semmle.label | 0 | -| test_cipher.rs:37:61:37:61 | 0 | semmle.label | 0 | -| test_cipher.rs:37:64:37:64 | 0 | semmle.label | 0 | -| test_cipher.rs:37:67:37:67 | 0 | semmle.label | 0 | -| test_cipher.rs:37:70:37:70 | 0 | semmle.label | 0 | -| test_cipher.rs:37:73:37:73 | 0 | semmle.label | 0 | +| test_cipher.rs:37:9:37:14 | const7 | semmle.label | const7 | +| test_cipher.rs:37:27:37:74 | [...] | semmle.label | [...] | | test_cipher.rs:38:30:38:47 | ...::new | semmle.label | ...::new | -| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | -| test_cipher.rs:38:73:38:79 | &const7 [&ref, element] | semmle.label | &const7 [&ref, element] | -| test_cipher.rs:38:74:38:79 | const7 [element] | semmle.label | const7 [element] | -| test_cipher.rs:41:9:41:14 | const8 [&ref, element] | semmle.label | const8 [&ref, element] | -| test_cipher.rs:41:28:41:76 | &... [&ref, element] | semmle.label | &... [&ref, element] | -| test_cipher.rs:41:29:41:76 | [...] [element] | semmle.label | [...] [element] | -| test_cipher.rs:41:30:41:30 | 0 | semmle.label | 0 | -| test_cipher.rs:41:33:41:33 | 0 | semmle.label | 0 | -| test_cipher.rs:41:36:41:36 | 0 | semmle.label | 0 | -| test_cipher.rs:41:39:41:39 | 0 | semmle.label | 0 | -| test_cipher.rs:41:42:41:42 | 0 | semmle.label | 0 | -| test_cipher.rs:41:45:41:45 | 0 | semmle.label | 0 | -| test_cipher.rs:41:48:41:48 | 0 | semmle.label | 0 | -| test_cipher.rs:41:51:41:51 | 0 | semmle.label | 0 | -| test_cipher.rs:41:54:41:54 | 0 | semmle.label | 0 | -| test_cipher.rs:41:57:41:57 | 0 | semmle.label | 0 | -| test_cipher.rs:41:60:41:60 | 0 | semmle.label | 0 | -| test_cipher.rs:41:63:41:63 | 0 | semmle.label | 0 | -| test_cipher.rs:41:66:41:66 | 0 | semmle.label | 0 | -| test_cipher.rs:41:69:41:69 | 0 | semmle.label | 0 | -| test_cipher.rs:41:72:41:72 | 0 | semmle.label | 0 | -| test_cipher.rs:41:75:41:75 | 0 | semmle.label | 0 | +| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | semmle.label | ...::from_slice(...) [&ref] | +| test_cipher.rs:38:73:38:79 | &const7 [&ref] | semmle.label | &const7 [&ref] | +| test_cipher.rs:38:74:38:79 | const7 | semmle.label | const7 | +| test_cipher.rs:41:9:41:14 | const8 [&ref] | semmle.label | const8 [&ref] | +| test_cipher.rs:41:28:41:76 | &... [&ref] | semmle.label | &... [&ref] | +| test_cipher.rs:41:29:41:76 | [...] | semmle.label | [...] | | test_cipher.rs:42:30:42:47 | ...::new | semmle.label | ...::new | -| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | -| test_cipher.rs:42:73:42:78 | const8 [&ref, element] | semmle.label | const8 [&ref, element] | +| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | semmle.label | ...::from_slice(...) [&ref] | +| test_cipher.rs:42:73:42:78 | const8 [&ref] | semmle.label | const8 [&ref] | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | From ac94ac6584cc0a8ab4e4c59793b412229b254a18 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 16:25:27 +0000 Subject: [PATCH 007/286] Rust: Model even more sinks + flows. --- .../rustcrypto/rustcrypto.model.yml | 2 + .../frameworks/stdlib/lang-core.model.yml | 4 + .../HardcodedCryptographicValueExtensions.qll | 4 +- .../HardcodedCryptographicValue.expected | 123 ++++++++++++++++++ .../security/CWE-798/test_cipher.rs | 32 ++--- 5 files changed, 148 insertions(+), 17 deletions(-) diff --git a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml index 5b5b42ca309..2047cfa9ebc 100644 --- a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml +++ b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml @@ -40,3 +40,5 @@ extensions: - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new", "Argument[1]", "credentials-iv", "manual"] - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new_from_slices", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/traits:crypto-common", "<_ as crate::KeyIvInit>::new_from_slices", "Argument[1]", "credentials-iv", "manual"] + - ["repo:https://github.com/RustCrypto/AEADs:aes-gcm", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:aead", "<_ as crate::Aead>::encrypt", "Argument[0]", "credentials-nonce", "manual"] diff --git a/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml b/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml index 062576e46bb..d8bbe389eaa 100644 --- a/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml +++ b/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml @@ -3,6 +3,10 @@ extensions: pack: codeql/rust-all extensible: summaryModel data: + # Conversions + - ["lang:core", "<_ as crate::convert::Into>::into", "Argument[self].Element", "ReturnValue.Element", "taint", "manual"] + - ["lang:core", "<_ as crate::convert::Into>::into", "Argument[self].Reference.Element", "ReturnValue.Element", "taint", "manual"] + - ["lang:core", "<[_]>::align_to", "Argument[self].Element", "ReturnValue.Field[0,1,2].Reference.Element", "taint", "manual"] # Fmt - ["lang:alloc", "crate::fmt::format", "Argument[0]", "ReturnValue", "taint", "manual"] # Iterator diff --git a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll index f7f26032b51..fbabffc3e28 100644 --- a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll @@ -12,7 +12,7 @@ private import codeql.rust.security.SensitiveData * A kind of cryptographic value. */ class CryptographicValueKind extends string { - CryptographicValueKind() { this = ["password", "key", "iv", "salt"] } + CryptographicValueKind() { this = ["password", "key", "iv", "nonce", "salt"] } /** * Gets a description of this value kind for user-facing messages. @@ -24,6 +24,8 @@ class CryptographicValueKind extends string { or this = "iv" and result = "an initialization vector" or + this = "nonce" and result = "a nonce" + or this = "salt" and result = "a salt" } } diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index 2ed68852eb5..0d29ab6921c 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -4,7 +4,15 @@ | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | an initialization vector | | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | +| test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:47:30:47:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:47:30:47:47 | ...::new | a key | +| test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:67:23:67:33 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:67:23:67:33 | ...::new | a key | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | a key | +| test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:81:23:81:61 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:81:23:81:61 | ...::new | a key | +| test_cipher.rs:84:20:84:22 | 0u8 | test_cipher.rs:84:20:84:22 | 0u8 | test_cipher.rs:85:23:85:61 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:85:23:85:61 | ...::new | an initialization vector | +| test_cipher.rs:124:26:124:26 | 0 | test_cipher.rs:124:26:124:26 | 0 | test_cipher.rs:126:19:126:32 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:126:19:126:32 | ...::new | a key | +| test_cipher.rs:125:19:125:19 | 0 | test_cipher.rs:125:19:125:19 | 0 | test_cipher.rs:127:21:127:27 | encrypt | This hard-coded value is used as $@. | test_cipher.rs:127:21:127:27 | encrypt | a nonce | +| test_cipher.rs:129:34:129:37 | 0xff | test_cipher.rs:129:34:129:37 | 0xff | test_cipher.rs:132:19:132:32 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:132:19:132:32 | ...::new | a key | +| test_cipher.rs:131:28:131:31 | 0xff | test_cipher.rs:131:28:131:31 | 0xff | test_cipher.rs:133:21:133:27 | encrypt | This hard-coded value is used as $@. | test_cipher.rs:133:21:133:27 | encrypt | a nonce | edges | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | provenance | | | test_cipher.rs:18:28:18:36 | &... [&ref, element] | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | provenance | | @@ -34,11 +42,65 @@ edges | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:28:41:76 | &... [&ref] | provenance | | | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:58 Sink:MaD:58 | | test_cipher.rs:42:73:42:78 | const8 [&ref] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | provenance | MaD:0 | +| test_cipher.rs:45:9:45:14 | const9 | test_cipher.rs:46:32:46:37 | const9 | provenance | | +| test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:45:9:45:14 | const9 | provenance | | +| test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | provenance | | +| test_cipher.rs:46:32:46:37 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:103 | +| test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | provenance | | +| test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | provenance | | +| test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | test_cipher.rs:47:30:47:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:40 | const2 [&ref, element] | provenance | | +| test_cipher.rs:66:18:66:26 | &... [&ref, element] | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | provenance | | +| test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | test_cipher.rs:66:18:66:26 | &... [&ref, element] | provenance | | +| test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | provenance | | +| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:67:35:67:47 | const2.into(...) [element] | test_cipher.rs:67:23:67:33 | ...::new | provenance | MaD:76 Sink:MaD:76 | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | test_cipher.rs:73:18:73:26 | &... [&ref, element] | provenance | | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | provenance | | | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:84 Sink:MaD:84 Sink:MaD:84 | +| test_cipher.rs:80:9:80:14 | const6 [&ref, element] | test_cipher.rs:81:63:81:68 | const6 [&ref, element] | provenance | | +| test_cipher.rs:80:18:80:26 | &... [&ref, element] | test_cipher.rs:80:9:80:14 | const6 [&ref, element] | provenance | | +| test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | test_cipher.rs:80:18:80:26 | &... [&ref, element] | provenance | | +| test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | provenance | | +| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:81:63:81:75 | const6.into(...) [element] | test_cipher.rs:81:23:81:61 | ...::new | provenance | MaD:86 Sink:MaD:86 | +| test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:80 | const7 [&ref, element] | provenance | | +| test_cipher.rs:84:18:84:27 | &... [&ref, element] | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | provenance | | +| test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | test_cipher.rs:84:18:84:27 | &... [&ref, element] | provenance | | +| test_cipher.rs:84:20:84:22 | 0u8 | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | provenance | | +| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:85:75:85:87 | const7.into(...) [element] | test_cipher.rs:85:23:85:61 | ...::new | provenance | MaD:87 Sink:MaD:87 | +| test_cipher.rs:124:9:124:12 | key2 [element] | test_cipher.rs:126:35:126:38 | key2 [element] | provenance | | +| test_cipher.rs:124:25:124:30 | [0; 32] [element] | test_cipher.rs:124:9:124:12 | key2 [element] | provenance | | +| test_cipher.rs:124:26:124:26 | 0 | test_cipher.rs:124:25:124:30 | [0; 32] [element] | provenance | | +| test_cipher.rs:125:9:125:14 | nonce2 [element] | test_cipher.rs:127:30:127:35 | nonce2 [element] | provenance | | +| test_cipher.rs:125:18:125:23 | [0; 12] [element] | test_cipher.rs:125:9:125:14 | nonce2 [element] | provenance | | +| test_cipher.rs:125:19:125:19 | 0 | test_cipher.rs:125:18:125:23 | [0; 12] [element] | provenance | | +| test_cipher.rs:126:34:126:45 | &... [&ref, element] | test_cipher.rs:126:19:126:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | +| test_cipher.rs:126:35:126:38 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:101 | +| test_cipher.rs:126:35:126:45 | key2.into(...) [element] | test_cipher.rs:126:34:126:45 | &... [&ref, element] | provenance | | +| test_cipher.rs:127:29:127:42 | &... [&ref, element] | test_cipher.rs:127:21:127:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | +| test_cipher.rs:127:30:127:35 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:101 | +| test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | test_cipher.rs:127:29:127:42 | &... [&ref, element] | provenance | | +| test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | provenance | | +| test_cipher.rs:129:32:129:41 | &... [&ref, element] | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | provenance | | +| test_cipher.rs:129:33:129:41 | [0xff; 32] [element] | test_cipher.rs:129:32:129:41 | &... [&ref, element] | provenance | | +| test_cipher.rs:129:34:129:37 | 0xff | test_cipher.rs:129:33:129:41 | [0xff; 32] [element] | provenance | | +| test_cipher.rs:130:9:130:12 | key3 [&ref, element] | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | provenance | | +| test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | test_cipher.rs:130:9:130:12 | key3 [&ref, element] | provenance | | +| test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:131:9:131:14 | nonce3 [element] | test_cipher.rs:133:30:133:35 | nonce3 [element] | provenance | | +| test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | test_cipher.rs:131:9:131:14 | nonce3 [element] | provenance | | +| test_cipher.rs:131:28:131:31 | 0xff | test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | provenance | | +| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | +| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 Sink:MaD:90 | +| test_cipher.rs:132:35:132:38 | key3 [&ref, element] | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | provenance | | +| test_cipher.rs:133:29:133:42 | &... [&ref, element] | test_cipher.rs:133:21:133:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | +| test_cipher.rs:133:30:133:35 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:101 | +| test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | test_cipher.rs:133:29:133:42 | &... [&ref, element] | provenance | | nodes | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | semmle.label | const1 [&ref, element] | | test_cipher.rs:18:28:18:36 | &... [&ref, element] | semmle.label | &... [&ref, element] | @@ -73,10 +135,71 @@ nodes | test_cipher.rs:42:30:42:47 | ...::new | semmle.label | ...::new | | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | semmle.label | ...::from_slice(...) [&ref] | | test_cipher.rs:42:73:42:78 | const8 [&ref] | semmle.label | const8 [&ref] | +| test_cipher.rs:45:9:45:14 | const9 | semmle.label | const9 | +| test_cipher.rs:45:27:45:50 | [...] | semmle.label | [...] | +| test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | semmle.label | const9_conv [&ref, element] | +| test_cipher.rs:46:32:46:37 | const9 | semmle.label | const9 | +| test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | semmle.label | const9.align_to(...) [tuple.1, &ref, element] | +| test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | semmle.label | ... .1 [&ref, element] | +| test_cipher.rs:47:30:47:47 | ...::new | semmle.label | ...::new | +| test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | semmle.label | const9_conv [&ref, element] | +| test_cipher.rs:66:9:66:14 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | +| test_cipher.rs:66:18:66:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | +| test_cipher.rs:66:20:66:22 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:67:23:67:33 | ...::new | semmle.label | ...::new | +| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | +| test_cipher.rs:67:35:67:47 | const2.into(...) [element] | semmle.label | const2.into(...) [element] | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | | test_cipher.rs:73:20:73:22 | 0u8 | semmle.label | 0u8 | | test_cipher.rs:74:23:74:44 | ...::new_from_slice | semmle.label | ...::new_from_slice | | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | +| test_cipher.rs:80:9:80:14 | const6 [&ref, element] | semmle.label | const6 [&ref, element] | +| test_cipher.rs:80:18:80:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | +| test_cipher.rs:80:20:80:22 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:81:23:81:61 | ...::new | semmle.label | ...::new | +| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | semmle.label | const6 [&ref, element] | +| test_cipher.rs:81:63:81:75 | const6.into(...) [element] | semmle.label | const6.into(...) [element] | +| test_cipher.rs:84:9:84:14 | const7 [&ref, element] | semmle.label | const7 [&ref, element] | +| test_cipher.rs:84:18:84:27 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | semmle.label | [0u8; 16] [element] | +| test_cipher.rs:84:20:84:22 | 0u8 | semmle.label | 0u8 | +| test_cipher.rs:85:23:85:61 | ...::new | semmle.label | ...::new | +| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | semmle.label | const7 [&ref, element] | +| test_cipher.rs:85:75:85:87 | const7.into(...) [element] | semmle.label | const7.into(...) [element] | +| test_cipher.rs:124:9:124:12 | key2 [element] | semmle.label | key2 [element] | +| test_cipher.rs:124:25:124:30 | [0; 32] [element] | semmle.label | [0; 32] [element] | +| test_cipher.rs:124:26:124:26 | 0 | semmle.label | 0 | +| test_cipher.rs:125:9:125:14 | nonce2 [element] | semmle.label | nonce2 [element] | +| test_cipher.rs:125:18:125:23 | [0; 12] [element] | semmle.label | [0; 12] [element] | +| test_cipher.rs:125:19:125:19 | 0 | semmle.label | 0 | +| test_cipher.rs:126:19:126:32 | ...::new | semmle.label | ...::new | +| test_cipher.rs:126:34:126:45 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:126:35:126:38 | key2 [element] | semmle.label | key2 [element] | +| test_cipher.rs:126:35:126:45 | key2.into(...) [element] | semmle.label | key2.into(...) [element] | +| test_cipher.rs:127:21:127:27 | encrypt | semmle.label | encrypt | +| test_cipher.rs:127:29:127:42 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:127:30:127:35 | nonce2 [element] | semmle.label | nonce2 [element] | +| test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | semmle.label | nonce2.into(...) [element] | +| test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | semmle.label | key3_array [&ref, element] | +| test_cipher.rs:129:32:129:41 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:129:33:129:41 | [0xff; 32] [element] | semmle.label | [0xff; 32] [element] | +| test_cipher.rs:129:34:129:37 | 0xff | semmle.label | 0xff | +| test_cipher.rs:130:9:130:12 | key3 [&ref, element] | semmle.label | key3 [&ref, element] | +| test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | semmle.label | key3_array [&ref, element] | +| test_cipher.rs:131:9:131:14 | nonce3 [element] | semmle.label | nonce3 [element] | +| test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | semmle.label | [0xff; 12] [element] | +| test_cipher.rs:131:28:131:31 | 0xff | semmle.label | 0xff | +| test_cipher.rs:132:19:132:32 | ...::new | semmle.label | ...::new | +| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | semmle.label | &key3 [&ref, &ref, element] | +| test_cipher.rs:132:35:132:38 | key3 [&ref, element] | semmle.label | key3 [&ref, element] | +| test_cipher.rs:133:21:133:27 | encrypt | semmle.label | encrypt | +| test_cipher.rs:133:29:133:42 | &... [&ref, element] | semmle.label | &... [&ref, element] | +| test_cipher.rs:133:30:133:35 | nonce3 [element] | semmle.label | nonce3 [element] | +| test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | semmle.label | nonce3.into(...) [element] | subpaths diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs index cfa20ab13c2..d85fffcf58a 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -42,9 +42,9 @@ fn test_stream_cipher_rabbit( let mut rabbit_cipher8 = RabbitKeyOnly::new(rabbit::Key::from_slice(const8)); // $ Sink rabbit_cipher8.apply_keystream(&mut data); - let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value] let const9_conv = unsafe { const9.align_to::().1 }; // convert [u16;8] -> [u8;8] - let mut rabbit_cipher9 = RabbitKeyOnly::new(rabbit::Key::from_slice(const9_conv)); + let mut rabbit_cipher9 = RabbitKeyOnly::new(rabbit::Key::from_slice(const9_conv)); // $ Sink rabbit_cipher9.apply_keystream(&mut data); let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ MISSING: Alert[rust/hardcoded-crytographic-value] @@ -63,8 +63,8 @@ fn test_block_cipher_aes( let aes_cipher1 = Aes256::new(key256.into()); aes_cipher1.encrypt_block(block128.into()); - let const2 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher2 = Aes256::new(const2.into()); + let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value] + let aes_cipher2 = Aes256::new(const2.into()); // $ Sink aes_cipher2.encrypt_block(block128.into()); let aes_cipher3 = Aes256::new_from_slice(key256).unwrap(); @@ -77,12 +77,12 @@ fn test_block_cipher_aes( let aes_cipher5 = cfb_mode::Encryptor::::new(key.into(), iv.into()); _ = aes_cipher5.encrypt_b2b(input, output).unwrap(); - let const6 = &[0u8;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher6 = cfb_mode::Encryptor::::new(const6.into(), iv.into()); + let const6 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value] + let aes_cipher6 = cfb_mode::Encryptor::::new(const6.into(), iv.into()); // $ Sink _ = aes_cipher6.encrypt_b2b(input, output).unwrap(); - let const7 = &[0u8; 16]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let aes_cipher7 = cfb_mode::Encryptor::::new(key.into(), const7.into()); + let const7 = &[0u8; 16]; // $ Alert[rust/hardcoded-crytographic-value] + let aes_cipher7 = cfb_mode::Encryptor::::new(key.into(), const7.into()); // $ Sink _ = aes_cipher7.encrypt_b2b(input, output).unwrap(); // various string conversions @@ -121,14 +121,14 @@ fn test_aes_gcm( let cipher1 = Aes256Gcm::new(&key1); let _ = cipher1.encrypt(&nonce1, b"plaintext".as_ref()).unwrap(); - let key2: [u8;32] = [0;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let nonce2 = [0;12]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let cipher2 = Aes256Gcm::new(&key2.into()); - let _ = cipher2.encrypt(&nonce2.into(), b"plaintext".as_ref()).unwrap(); + let key2: [u8;32] = [0;32]; // $ Alert[rust/hardcoded-crytographic-value] + let nonce2 = [0;12]; // $ Alert[rust/hardcoded-crytographic-value] + let cipher2 = Aes256Gcm::new(&key2.into()); // $ Sink + let _ = cipher2.encrypt(&nonce2.into(), b"plaintext".as_ref()).unwrap(); // $ Sink - let key3_array: &[u8;32] = &[0xff;32]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let key3_array: &[u8;32] = &[0xff;32]; // $ Alert[rust/hardcoded-crytographic-value] let key3 = Key::::from_slice(key3_array); - let nonce3: [u8;12] = [0xff;12]; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let cipher3 = Aes256Gcm::new(&key3); - let _ = cipher3.encrypt(&nonce3.into(), b"plaintext".as_ref()).unwrap(); + let nonce3: [u8;12] = [0xff;12]; // $ Alert[rust/hardcoded-crytographic-value] + let cipher3 = Aes256Gcm::new(&key3); // $ Sink + let _ = cipher3.encrypt(&nonce3.into(), b"plaintext".as_ref()).unwrap(); // $ Sink } From b4a6063e203222ea4319380f01e380fd1a0754ca Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 17:13:51 +0000 Subject: [PATCH 008/286] Rust: Add std::mem::zeroed as a source. --- .../frameworks/stdlib/lang-core.model.yml | 5 ++++ .../HardcodedCryptographicValueExtensions.qll | 11 ++++++-- .../HardcodedCryptographicValue.expected | 28 ++++++++++++++----- .../security/CWE-798/test_cipher.rs | 4 +-- 4 files changed, 36 insertions(+), 12 deletions(-) diff --git a/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml b/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml index d8bbe389eaa..37f574dd2b8 100644 --- a/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml +++ b/rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml @@ -1,4 +1,9 @@ extensions: + - addsTo: + pack: codeql/rust-all + extensible: sourceModel + data: + - ["lang:core", "crate::mem::zeroed", "ReturnValue.Element", "constant-source", "manual"] - addsTo: pack: codeql/rust-all extensible: summaryModel diff --git a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll index fbabffc3e28..4d6210cb97b 100644 --- a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll @@ -69,9 +69,14 @@ module HardcodedCryptographicValue { * ``` */ private class ArrayListSource extends Source { - ArrayListSource() { - this.asExpr().getExpr().(ArrayListExpr).getExpr(_) instanceof LiteralExpr - } + ArrayListSource() { this.asExpr().getExpr().(ArrayListExpr).getExpr(_) instanceof LiteralExpr } + } + + /** + * An externally modeled source for constant values. + */ + private class ModeledSource extends Source { + ModeledSource() { sourceNode(this, "constant-source") } } /** diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index 0d29ab6921c..a09f89d2127 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -5,6 +5,7 @@ | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key | | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key | | test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:47:30:47:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:47:30:47:47 | ...::new | a key | +| test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:51:31:51:48 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:51:31:51:48 | ...::new | a key | | test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:67:23:67:33 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:67:23:67:33 | ...::new | a key | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | a key | | test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:81:23:81:61 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:81:23:81:61 | ...::new | a key | @@ -45,16 +46,22 @@ edges | test_cipher.rs:45:9:45:14 | const9 | test_cipher.rs:46:32:46:37 | const9 | provenance | | | test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:45:9:45:14 | const9 | provenance | | | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | provenance | | -| test_cipher.rs:46:32:46:37 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:103 | +| test_cipher.rs:46:32:46:37 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:104 | | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | provenance | | | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | provenance | | | test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | test_cipher.rs:47:30:47:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:50:9:50:15 | const10 [element] | test_cipher.rs:51:75:51:81 | const10 [element] | provenance | | +| test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | provenance | Src:MaD:101 | +| test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | test_cipher.rs:50:9:50:15 | const10 [element] | provenance | | +| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | test_cipher.rs:51:31:51:48 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | +| test_cipher.rs:51:75:51:81 | const10 [element] | test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | provenance | | | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:40 | const2 [&ref, element] | provenance | | | test_cipher.rs:66:18:66:26 | &... [&ref, element] | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | test_cipher.rs:66:18:66:26 | &... [&ref, element] | provenance | | | test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:103 | | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | test_cipher.rs:67:23:67:33 | ...::new | provenance | MaD:76 Sink:MaD:76 | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | @@ -65,13 +72,13 @@ edges | test_cipher.rs:80:18:80:26 | &... [&ref, element] | test_cipher.rs:80:9:80:14 | const6 [&ref, element] | provenance | | | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | test_cipher.rs:80:18:80:26 | &... [&ref, element] | provenance | | | test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:103 | | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | test_cipher.rs:81:23:81:61 | ...::new | provenance | MaD:86 Sink:MaD:86 | | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:80 | const7 [&ref, element] | provenance | | | test_cipher.rs:84:18:84:27 | &... [&ref, element] | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | provenance | | | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | test_cipher.rs:84:18:84:27 | &... [&ref, element] | provenance | | | test_cipher.rs:84:20:84:22 | 0u8 | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:103 | | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | test_cipher.rs:85:23:85:61 | ...::new | provenance | MaD:87 Sink:MaD:87 | | test_cipher.rs:124:9:124:12 | key2 [element] | test_cipher.rs:126:35:126:38 | key2 [element] | provenance | | | test_cipher.rs:124:25:124:30 | [0; 32] [element] | test_cipher.rs:124:9:124:12 | key2 [element] | provenance | | @@ -80,10 +87,10 @@ edges | test_cipher.rs:125:18:125:23 | [0; 12] [element] | test_cipher.rs:125:9:125:14 | nonce2 [element] | provenance | | | test_cipher.rs:125:19:125:19 | 0 | test_cipher.rs:125:18:125:23 | [0; 12] [element] | provenance | | | test_cipher.rs:126:34:126:45 | &... [&ref, element] | test_cipher.rs:126:19:126:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | -| test_cipher.rs:126:35:126:38 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:101 | +| test_cipher.rs:126:35:126:38 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | test_cipher.rs:126:34:126:45 | &... [&ref, element] | provenance | | | test_cipher.rs:127:29:127:42 | &... [&ref, element] | test_cipher.rs:127:21:127:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | -| test_cipher.rs:127:30:127:35 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:101 | +| test_cipher.rs:127:30:127:35 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | test_cipher.rs:127:29:127:42 | &... [&ref, element] | provenance | | | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | provenance | | | test_cipher.rs:129:32:129:41 | &... [&ref, element] | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | provenance | | @@ -99,7 +106,7 @@ edges | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 Sink:MaD:90 | | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | provenance | | | test_cipher.rs:133:29:133:42 | &... [&ref, element] | test_cipher.rs:133:21:133:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | -| test_cipher.rs:133:30:133:35 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:101 | +| test_cipher.rs:133:30:133:35 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | test_cipher.rs:133:29:133:42 | &... [&ref, element] | provenance | | nodes | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | semmle.label | const1 [&ref, element] | @@ -144,6 +151,13 @@ nodes | test_cipher.rs:47:30:47:47 | ...::new | semmle.label | ...::new | | test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | semmle.label | const9_conv [&ref, element] | +| test_cipher.rs:50:9:50:15 | const10 [element] | semmle.label | const10 [element] | +| test_cipher.rs:50:37:50:52 | ...::zeroed | semmle.label | ...::zeroed | +| test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | semmle.label | ...::zeroed(...) [element] | +| test_cipher.rs:51:31:51:48 | ...::new | semmle.label | ...::new | +| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | semmle.label | ...::from_slice(...) [&ref, element] | +| test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | semmle.label | &const10 [&ref, element] | +| test_cipher.rs:51:75:51:81 | const10 [element] | semmle.label | const10 [element] | | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | semmle.label | const2 [&ref, element] | | test_cipher.rs:66:18:66:26 | &... [&ref, element] | semmle.label | &... [&ref, element] | | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | semmle.label | [0u8; 32] [element] | diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs index d85fffcf58a..cf96cf047b5 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -47,8 +47,8 @@ fn test_stream_cipher_rabbit( let mut rabbit_cipher9 = RabbitKeyOnly::new(rabbit::Key::from_slice(const9_conv)); // $ Sink rabbit_cipher9.apply_keystream(&mut data); - let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ MISSING: Alert[rust/hardcoded-crytographic-value] - let mut rabbit_cipher10 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const10)); + let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ Alert[rust/hardcoded-crytographic-value] + let mut rabbit_cipher10 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const10)); // $ Sink rabbit_cipher10.apply_keystream(&mut data); } From 95be12ed80f96af4df5d8658037630485e42975b Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 17:45:34 +0000 Subject: [PATCH 009/286] Rust: Add qhelp and examples. --- .../CWE-798/HardcodedCryptographicValue.qhelp | 58 +++++++++++++++++++ .../CWE-798/HardcodedCryptographicValueBad.rs | 2 + .../HardcodedCryptographicValueGood.rs | 2 + 3 files changed, 62 insertions(+) create mode 100644 rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp create mode 100644 rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueBad.rs create mode 100644 rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueGood.rs diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp new file mode 100644 index 00000000000..408d4bd002a --- /dev/null +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp @@ -0,0 +1,58 @@ + + + + +

+Hardcoded passwords, keys, initialization vectors and salts should not be used for cryptographic operations. +

+
    +
  • + Attackers can easily recover hardcoded values if they have access to the source code or compiled executable. +
  • +
  • + Some hardcoded values may be easily guessable. +
  • +
  • + Hardcoded values may leave cryptographic operations vulnerable to dictionary attacks, rainbow tables, and other forms of cryptanalysis. +
  • +
+ +
+ + +

+Use randomly generated key material, initialization vectors and salts. Use strong passwords that are not hardcoded in source code. +

+ +
+ + +

+The following example shows instantiating a cipher with hardcoded key material, making the encrypted data vulnerable to recovery. +

+ + + +

+In the fixed code below, the key material is randomly generated and not hardcoded, which protects the encrypted data against recovery. A real application would also need a strategy for secure key management after the key has been generated. +

+ + + +
+ + +
  • +OWASP: Use of hard-coded password. +
  • +
  • +OWASP: Key Management Cheat Sheet. +
  • +
  • +O'Reilly: Using Salts, Nonces, and Initialization Vectors. +
  • + +
    +
    diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueBad.rs b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueBad.rs new file mode 100644 index 00000000000..c1923df1730 --- /dev/null +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueBad.rs @@ -0,0 +1,2 @@ +let key: [u8;32] = [0;32]; // BAD: Using hardcoded keys for encryption +let cipher = Aes256Gcm::new(&key.into()); diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueGood.rs b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueGood.rs new file mode 100644 index 00000000000..06dc1af836d --- /dev/null +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValueGood.rs @@ -0,0 +1,2 @@ +let key = Aes256Gcm::generate_key(aes_gcm::aead::OsRng); // GOOD: Using randomly generated keys for encryption +let cipher = Aes256Gcm::new(&key); From e564c410439eb8898ec829ca6487883ca8122bc5 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 18:36:55 +0000 Subject: [PATCH 010/286] Rust: Compute security-severity tag. --- .../src/queries/security/CWE-798/HardcodedCryptographicValue.ql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql index 441c22f679a..49e8b0cf342 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql @@ -4,7 +4,7 @@ * vectors is not secure. * @kind path-problem * @problem.severity warning - * @security-severity TODO + * @security-severity 9.8 * @precision high * @id rust/hardcoded-crytographic-value * @tags security From 952e417d13b6a18f01386e3d7773ebad76c5b8a3 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 18:46:37 +0000 Subject: [PATCH 011/286] Rust: Tweak some wording. --- .../rust/security/HardcodedCryptographicValueExtensions.qll | 2 +- .../security/CWE-798/HardcodedCryptographicValue.qhelp | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll index 4d6210cb97b..32f64051fcb 100644 --- a/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll @@ -80,7 +80,7 @@ module HardcodedCryptographicValue { } /** - * A sink for hardcoded cryptographic value from model data. + * An externally modeled sink for hardcoded cryptographic value vulnerabilities. */ private class ModelsAsDataSinks extends Sink { CryptographicValueKind kind; diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp index 408d4bd002a..b44a98013c8 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp @@ -12,10 +12,10 @@ Hardcoded passwords, keys, initialization vectors and salts should not be used f Attackers can easily recover hardcoded values if they have access to the source code or compiled executable.
  • - Some hardcoded values may be easily guessable. + Some hardcoded values are easily guessable.
  • - Hardcoded values may leave cryptographic operations vulnerable to dictionary attacks, rainbow tables, and other forms of cryptanalysis. + Use of hardcoded values may leave cryptographic operations vulnerable to dictionary attacks, rainbow tables, and other forms of cryptanalysis.
  • @@ -23,7 +23,7 @@ Hardcoded passwords, keys, initialization vectors and salts should not be used f

    -Use randomly generated key material, initialization vectors and salts. Use strong passwords that are not hardcoded in source code. +Use randomly generated key material, initialization vectors and salts. Use strong passwords that are not hardcoded.

    From 9af2d0218b777520f33f0a836bfc0efbdc172430 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 18:48:26 +0000 Subject: [PATCH 012/286] Rust: Add the new sinks to stats. --- rust/ql/src/queries/summary/Stats.qll | 3 +++ rust/ql/test/query-tests/diagnostics/SummaryStats.expected | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/rust/ql/src/queries/summary/Stats.qll b/rust/ql/src/queries/summary/Stats.qll index 4054b0bc132..bc6e38ba67a 100644 --- a/rust/ql/src/queries/summary/Stats.qll +++ b/rust/ql/src/queries/summary/Stats.qll @@ -11,6 +11,7 @@ private import codeql.rust.controlflow.internal.CfgConsistency as CfgConsistency private import codeql.rust.dataflow.internal.DataFlowConsistency as DataFlowConsistency private import codeql.rust.security.SqlInjectionExtensions private import codeql.rust.security.CleartextLoggingExtensions +private import codeql.rust.security.HardcodedCryptographicValueExtensions /** * Gets a count of the total number of lines of code in the database. @@ -62,6 +63,8 @@ string getAQuerySinkKind(DataFlow::Node n) { n instanceof SqlInjection::Sink and result = "SqlInjection" or n instanceof CleartextLogging::Sink and result = "CleartextLogging" + or + n instanceof HardcodedCryptographicValue::Sink and result = "HardcodedCryptographicValue" } /** diff --git a/rust/ql/test/query-tests/diagnostics/SummaryStats.expected b/rust/ql/test/query-tests/diagnostics/SummaryStats.expected index 7abbbba7c1b..c87c80da8c7 100644 --- a/rust/ql/test/query-tests/diagnostics/SummaryStats.expected +++ b/rust/ql/test/query-tests/diagnostics/SummaryStats.expected @@ -14,7 +14,7 @@ | Macro calls - resolved | 8 | | Macro calls - total | 9 | | Macro calls - unresolved | 1 | -| Taint edges - number of edges | 1471 | +| Taint edges - number of edges | 1475 | | Taint reach - nodes tainted | 0 | | Taint reach - per million nodes | 0 | | Taint sinks - cryptographic operations | 0 | From 42e7d1e983465b4da3ced5805e21c51efec84aaa Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Thu, 6 Mar 2025 19:09:01 +0000 Subject: [PATCH 013/286] Rust: Fix typo. --- .../CWE-798/HardcodedCryptographicValue.ql | 2 +- .../security/CWE-798/test_cipher.rs | 36 +++++++++---------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql index 49e8b0cf342..3fb9d4d74a2 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql @@ -6,7 +6,7 @@ * @problem.severity warning * @security-severity 9.8 * @precision high - * @id rust/hardcoded-crytographic-value + * @id rust/hardcoded-cryptographic-value * @tags security * external/cwe/cwe-259 * external/cwe/cwe-321 diff --git a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs index cf96cf047b5..7a5ef0572fd 100644 --- a/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs +++ b/rust/ql/test/query-tests/security/CWE-798/test_cipher.rs @@ -15,18 +15,18 @@ fn test_stream_cipher_rabbit( let mut rabbit_cipher1 = RabbitKeyOnly::new(rabbit::Key::from_slice(key)); rabbit_cipher1.apply_keystream(&mut data); - let const1: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value] + let const1: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-cryptographic-value] let mut rabbit_cipher2 = RabbitKeyOnly::new(rabbit::Key::from_slice(const1)); // $ Sink rabbit_cipher2.apply_keystream(&mut data); let mut rabbit_cipher3 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(iv)); rabbit_cipher3.apply_keystream(&mut data); - let const4: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value] + let const4: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-cryptographic-value] let mut rabbit_cipher4 = Rabbit::new(rabbit::Key::from_slice(const4), rabbit::Iv::from_slice(iv)); // $ Sink rabbit_cipher4.apply_keystream(&mut data); - let const5: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-crytographic-value] + let const5: &[u8;16] = &[0u8;16]; // $ Alert[rust/hardcoded-cryptographic-value] let mut rabbit_cipher5 = Rabbit::new(rabbit::Key::from_slice(key), rabbit::Iv::from_slice(const5)); // $ Sink rabbit_cipher5.apply_keystream(&mut data); @@ -34,20 +34,20 @@ fn test_stream_cipher_rabbit( let const6: &[u8;16] = &[0u8;16]; // (unused, so good) - let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value] + let const7: [u8;16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-cryptographic-value] let mut rabbit_cipher7 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const7)); // $ Sink rabbit_cipher7.apply_keystream(&mut data); - let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value] + let const8: &[u8;16] = &[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-cryptographic-value] let mut rabbit_cipher8 = RabbitKeyOnly::new(rabbit::Key::from_slice(const8)); // $ Sink rabbit_cipher8.apply_keystream(&mut data); - let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-crytographic-value] + let const9: [u16;8] = [0, 0, 0, 0, 0, 0, 0, 0]; // $ Alert[rust/hardcoded-cryptographic-value] let const9_conv = unsafe { const9.align_to::().1 }; // convert [u16;8] -> [u8;8] let mut rabbit_cipher9 = RabbitKeyOnly::new(rabbit::Key::from_slice(const9_conv)); // $ Sink rabbit_cipher9.apply_keystream(&mut data); - let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ Alert[rust/hardcoded-crytographic-value] + let const10: [u8;16] = unsafe { std::mem::zeroed() }; // $ Alert[rust/hardcoded-cryptographic-value] let mut rabbit_cipher10 = RabbitKeyOnly::new(rabbit::Key::from_slice(&const10)); // $ Sink rabbit_cipher10.apply_keystream(&mut data); } @@ -63,25 +63,25 @@ fn test_block_cipher_aes( let aes_cipher1 = Aes256::new(key256.into()); aes_cipher1.encrypt_block(block128.into()); - let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value] + let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-cryptographic-value] let aes_cipher2 = Aes256::new(const2.into()); // $ Sink aes_cipher2.encrypt_block(block128.into()); let aes_cipher3 = Aes256::new_from_slice(key256).unwrap(); aes_cipher3.encrypt_block(block128.into()); - let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value] + let const2 = &[0u8;32]; // $ Alert[rust/hardcoded-cryptographic-value] let aes_cipher4 = Aes256::new_from_slice(const2).unwrap(); // $ Sink aes_cipher4.encrypt_block(block128.into()); let aes_cipher5 = cfb_mode::Encryptor::::new(key.into(), iv.into()); _ = aes_cipher5.encrypt_b2b(input, output).unwrap(); - let const6 = &[0u8;32]; // $ Alert[rust/hardcoded-crytographic-value] + let const6 = &[0u8;32]; // $ Alert[rust/hardcoded-cryptographic-value] let aes_cipher6 = cfb_mode::Encryptor::::new(const6.into(), iv.into()); // $ Sink _ = aes_cipher6.encrypt_b2b(input, output).unwrap(); - let const7 = &[0u8; 16]; // $ Alert[rust/hardcoded-crytographic-value] + let const7 = &[0u8; 16]; // $ Alert[rust/hardcoded-cryptographic-value] let aes_cipher7 = cfb_mode::Encryptor::::new(key.into(), const7.into()); // $ Sink _ = aes_cipher7.encrypt_b2b(input, output).unwrap(); @@ -91,18 +91,18 @@ fn test_block_cipher_aes( let aes_cipher8 = cfb_mode::Encryptor::::new(key8.into(), iv.into()); _ = aes_cipher8.encrypt_b2b(input, output).unwrap(); - let key9: &[u8] = "1234567890123456".as_bytes(); // $ MISSING: Alert[rust/hardcoded-crytographic-value] + let key9: &[u8] = "1234567890123456".as_bytes(); // $ MISSING: Alert[rust/hardcoded-cryptographic-value] let aes_cipher9 = cfb_mode::Encryptor::::new(key9.into(), iv.into()); _ = aes_cipher9.encrypt_b2b(input, output).unwrap(); let key10: [u8; 32] = match base64::engine::general_purpose::STANDARD.decode(key_str) { Ok(x) => x.try_into().unwrap(), - Err(_) => "1234567890123456".as_bytes().try_into().unwrap() // $ MISSING: Alert[rust/hardcoded-crytographic-value] + Err(_) => "1234567890123456".as_bytes().try_into().unwrap() // $ MISSING: Alert[rust/hardcoded-cryptographic-value] }; let aes_cipher10 = Aes256::new(&key10.into()); aes_cipher10.encrypt_block(block128.into()); - if let Ok(const11) = base64::engine::general_purpose::STANDARD.decode("1234567890123456") { // $ MISSING: Alert[rust/hardcoded-crytographic-value] + if let Ok(const11) = base64::engine::general_purpose::STANDARD.decode("1234567890123456") { // $ MISSING: Alert[rust/hardcoded-cryptographic-value] let key11: [u8; 32] = const11.try_into().unwrap(); let aes_cipher11 = Aes256::new(&key11.into()); aes_cipher11.encrypt_block(block128.into()); @@ -121,14 +121,14 @@ fn test_aes_gcm( let cipher1 = Aes256Gcm::new(&key1); let _ = cipher1.encrypt(&nonce1, b"plaintext".as_ref()).unwrap(); - let key2: [u8;32] = [0;32]; // $ Alert[rust/hardcoded-crytographic-value] - let nonce2 = [0;12]; // $ Alert[rust/hardcoded-crytographic-value] + let key2: [u8;32] = [0;32]; // $ Alert[rust/hardcoded-cryptographic-value] + let nonce2 = [0;12]; // $ Alert[rust/hardcoded-cryptographic-value] let cipher2 = Aes256Gcm::new(&key2.into()); // $ Sink let _ = cipher2.encrypt(&nonce2.into(), b"plaintext".as_ref()).unwrap(); // $ Sink - let key3_array: &[u8;32] = &[0xff;32]; // $ Alert[rust/hardcoded-crytographic-value] + let key3_array: &[u8;32] = &[0xff;32]; // $ Alert[rust/hardcoded-cryptographic-value] let key3 = Key::::from_slice(key3_array); - let nonce3: [u8;12] = [0xff;12]; // $ Alert[rust/hardcoded-crytographic-value] + let nonce3: [u8;12] = [0xff;12]; // $ Alert[rust/hardcoded-cryptographic-value] let cipher3 = Aes256Gcm::new(&key3); // $ Sink let _ = cipher3.encrypt(&nonce3.into(), b"plaintext".as_ref()).unwrap(); // $ Sink } From 19416a9ee3038a6c3d4bb62ce25af6c7d83c5972 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Fri, 7 Mar 2025 15:43:34 +0000 Subject: [PATCH 014/286] Rust: Correct test results. --- .../diagnostics/SummaryStats.expected | 6 +-- .../HardcodedCryptographicValue.expected | 39 ++++++++----------- 2 files changed, 18 insertions(+), 27 deletions(-) diff --git a/rust/ql/test/query-tests/diagnostics/SummaryStats.expected b/rust/ql/test/query-tests/diagnostics/SummaryStats.expected index b9a96cdecfd..972c5f26177 100644 --- a/rust/ql/test/query-tests/diagnostics/SummaryStats.expected +++ b/rust/ql/test/query-tests/diagnostics/SummaryStats.expected @@ -14,11 +14,7 @@ | Macro calls - resolved | 8 | | Macro calls - total | 9 | | Macro calls - unresolved | 1 | -<<<<<<< HEAD -| Taint edges - number of edges | 1475 | -======= -| Taint edges - number of edges | 1670 | ->>>>>>> main +| Taint edges - number of edges | 1674 | | Taint reach - nodes tainted | 0 | | Taint reach - per million nodes | 0 | | Taint sinks - cryptographic operations | 0 | diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index a09f89d2127..a8ce502c403 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -19,49 +19,49 @@ edges | test_cipher.rs:18:28:18:36 | &... [&ref, element] | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | provenance | | | test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | test_cipher.rs:18:28:18:36 | &... [&ref, element] | provenance | | | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:19:30:19:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:19:30:19:47 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:25:9:25:14 | const4 [&ref, element] | test_cipher.rs:26:66:26:71 | const4 [&ref, element] | provenance | | | test_cipher.rs:25:28:25:36 | &... [&ref, element] | test_cipher.rs:25:9:25:14 | const4 [&ref, element] | provenance | | | test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | test_cipher.rs:25:28:25:36 | &... [&ref, element] | provenance | | | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | test_cipher.rs:26:30:26:40 | ...::new | provenance | MaD:82 Sink:MaD:82 Sink:MaD:82 | +| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | test_cipher.rs:26:30:26:40 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | | test_cipher.rs:26:66:26:71 | const4 [&ref, element] | test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:29:9:29:14 | const5 [&ref, element] | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | provenance | | | test_cipher.rs:29:28:29:36 | &... [&ref, element] | test_cipher.rs:29:9:29:14 | const5 [&ref, element] | provenance | | | test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | test_cipher.rs:29:28:29:36 | &... [&ref, element] | provenance | | | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:83 Sink:MaD:83 Sink:MaD:83 | +| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:61 Sink:MaD:61 Sink:MaD:61 | | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:37:9:37:14 | const7 | test_cipher.rs:38:74:38:79 | const7 | provenance | | | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:9:37:14 | const7 | provenance | | -| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:58 Sink:MaD:58 | +| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:60 Sink:MaD:60 | | test_cipher.rs:38:73:38:79 | &const7 [&ref] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | provenance | MaD:0 | | test_cipher.rs:38:74:38:79 | const7 | test_cipher.rs:38:73:38:79 | &const7 [&ref] | provenance | | | test_cipher.rs:41:9:41:14 | const8 [&ref] | test_cipher.rs:42:73:42:78 | const8 [&ref] | provenance | | | test_cipher.rs:41:28:41:76 | &... [&ref] | test_cipher.rs:41:9:41:14 | const8 [&ref] | provenance | | | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:28:41:76 | &... [&ref] | provenance | | -| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:58 Sink:MaD:58 | +| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:60 Sink:MaD:60 | | test_cipher.rs:42:73:42:78 | const8 [&ref] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | provenance | MaD:0 | -| test_cipher.rs:45:9:45:14 | const9 | test_cipher.rs:46:32:46:37 | const9 | provenance | | +| test_cipher.rs:45:9:45:14 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:104 | | test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:45:9:45:14 | const9 | provenance | | | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | provenance | | -| test_cipher.rs:46:32:46:37 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:104 | | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | provenance | | | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | provenance | | -| test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | test_cipher.rs:47:30:47:47 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | test_cipher.rs:47:30:47:47 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:50:9:50:15 | const10 [element] | test_cipher.rs:51:75:51:81 | const10 [element] | provenance | | | test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | provenance | Src:MaD:101 | | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | test_cipher.rs:50:9:50:15 | const10 [element] | provenance | | -| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | test_cipher.rs:51:31:51:48 | ...::new | provenance | MaD:58 Sink:MaD:58 Sink:MaD:58 | +| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | test_cipher.rs:51:31:51:48 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | | test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:51:75:51:81 | const10 [element] | test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | provenance | | | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:40 | const2 [&ref, element] | provenance | | +| test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:103 | | test_cipher.rs:66:18:66:26 | &... [&ref, element] | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | test_cipher.rs:66:18:66:26 | &... [&ref, element] | provenance | | | test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:103 | +| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | test_cipher.rs:67:23:67:33 | ...::new | provenance | MaD:76 Sink:MaD:76 | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | @@ -69,28 +69,28 @@ edges | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | provenance | | | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:84 Sink:MaD:84 Sink:MaD:84 | | test_cipher.rs:80:9:80:14 | const6 [&ref, element] | test_cipher.rs:81:63:81:68 | const6 [&ref, element] | provenance | | +| test_cipher.rs:80:9:80:14 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:103 | | test_cipher.rs:80:18:80:26 | &... [&ref, element] | test_cipher.rs:80:9:80:14 | const6 [&ref, element] | provenance | | | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | test_cipher.rs:80:18:80:26 | &... [&ref, element] | provenance | | | test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:103 | +| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | test_cipher.rs:81:23:81:61 | ...::new | provenance | MaD:86 Sink:MaD:86 | | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:80 | const7 [&ref, element] | provenance | | +| test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:103 | | test_cipher.rs:84:18:84:27 | &... [&ref, element] | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | provenance | | | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | test_cipher.rs:84:18:84:27 | &... [&ref, element] | provenance | | | test_cipher.rs:84:20:84:22 | 0u8 | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:103 | +| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | test_cipher.rs:85:23:85:61 | ...::new | provenance | MaD:87 Sink:MaD:87 | -| test_cipher.rs:124:9:124:12 | key2 [element] | test_cipher.rs:126:35:126:38 | key2 [element] | provenance | | +| test_cipher.rs:124:9:124:12 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:124:25:124:30 | [0; 32] [element] | test_cipher.rs:124:9:124:12 | key2 [element] | provenance | | | test_cipher.rs:124:26:124:26 | 0 | test_cipher.rs:124:25:124:30 | [0; 32] [element] | provenance | | -| test_cipher.rs:125:9:125:14 | nonce2 [element] | test_cipher.rs:127:30:127:35 | nonce2 [element] | provenance | | +| test_cipher.rs:125:9:125:14 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:125:18:125:23 | [0; 12] [element] | test_cipher.rs:125:9:125:14 | nonce2 [element] | provenance | | | test_cipher.rs:125:19:125:19 | 0 | test_cipher.rs:125:18:125:23 | [0; 12] [element] | provenance | | | test_cipher.rs:126:34:126:45 | &... [&ref, element] | test_cipher.rs:126:19:126:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | -| test_cipher.rs:126:35:126:38 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | test_cipher.rs:126:34:126:45 | &... [&ref, element] | provenance | | | test_cipher.rs:127:29:127:42 | &... [&ref, element] | test_cipher.rs:127:21:127:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | -| test_cipher.rs:127:30:127:35 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | test_cipher.rs:127:29:127:42 | &... [&ref, element] | provenance | | | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | provenance | | | test_cipher.rs:129:32:129:41 | &... [&ref, element] | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | provenance | | @@ -99,14 +99,13 @@ edges | test_cipher.rs:130:9:130:12 | key3 [&ref, element] | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | provenance | | | test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | test_cipher.rs:130:9:130:12 | key3 [&ref, element] | provenance | | | test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | -| test_cipher.rs:131:9:131:14 | nonce3 [element] | test_cipher.rs:133:30:133:35 | nonce3 [element] | provenance | | +| test_cipher.rs:131:9:131:14 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | test_cipher.rs:131:9:131:14 | nonce3 [element] | provenance | | | test_cipher.rs:131:28:131:31 | 0xff | test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | provenance | | | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 Sink:MaD:90 | | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | provenance | | | test_cipher.rs:133:29:133:42 | &... [&ref, element] | test_cipher.rs:133:21:133:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | -| test_cipher.rs:133:30:133:35 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:102 | | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | test_cipher.rs:133:29:133:42 | &... [&ref, element] | provenance | | nodes | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | semmle.label | const1 [&ref, element] | @@ -145,7 +144,6 @@ nodes | test_cipher.rs:45:9:45:14 | const9 | semmle.label | const9 | | test_cipher.rs:45:27:45:50 | [...] | semmle.label | [...] | | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | semmle.label | const9_conv [&ref, element] | -| test_cipher.rs:46:32:46:37 | const9 | semmle.label | const9 | | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | semmle.label | const9.align_to(...) [tuple.1, &ref, element] | | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | semmle.label | ... .1 [&ref, element] | | test_cipher.rs:47:30:47:47 | ...::new | semmle.label | ...::new | @@ -193,11 +191,9 @@ nodes | test_cipher.rs:125:19:125:19 | 0 | semmle.label | 0 | | test_cipher.rs:126:19:126:32 | ...::new | semmle.label | ...::new | | test_cipher.rs:126:34:126:45 | &... [&ref, element] | semmle.label | &... [&ref, element] | -| test_cipher.rs:126:35:126:38 | key2 [element] | semmle.label | key2 [element] | | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | semmle.label | key2.into(...) [element] | | test_cipher.rs:127:21:127:27 | encrypt | semmle.label | encrypt | | test_cipher.rs:127:29:127:42 | &... [&ref, element] | semmle.label | &... [&ref, element] | -| test_cipher.rs:127:30:127:35 | nonce2 [element] | semmle.label | nonce2 [element] | | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | semmle.label | nonce2.into(...) [element] | | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | semmle.label | key3_array [&ref, element] | | test_cipher.rs:129:32:129:41 | &... [&ref, element] | semmle.label | &... [&ref, element] | @@ -214,6 +210,5 @@ nodes | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | semmle.label | key3 [&ref, element] | | test_cipher.rs:133:21:133:27 | encrypt | semmle.label | encrypt | | test_cipher.rs:133:29:133:42 | &... [&ref, element] | semmle.label | &... [&ref, element] | -| test_cipher.rs:133:30:133:35 | nonce3 [element] | semmle.label | nonce3 [element] | | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | semmle.label | nonce3.into(...) [element] | subpaths From c63c1be11ca844b686cb71c16cb0e45f668d6450 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Fri, 7 Mar 2025 16:12:31 +0000 Subject: [PATCH 015/286] Rust: Accept integration test .expected changes. --- rust/ql/integration-tests/hello-project/summary.expected | 2 +- .../ql/integration-tests/hello-workspace/summary.cargo.expected | 2 +- .../hello-workspace/summary.rust-project.expected | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/rust/ql/integration-tests/hello-project/summary.expected b/rust/ql/integration-tests/hello-project/summary.expected index 2ffb1f4e34f..68ee47035bc 100644 --- a/rust/ql/integration-tests/hello-project/summary.expected +++ b/rust/ql/integration-tests/hello-project/summary.expected @@ -14,7 +14,7 @@ | Macro calls - resolved | 2 | | Macro calls - total | 2 | | Macro calls - unresolved | 0 | -| Taint edges - number of edges | 1670 | +| Taint edges - number of edges | 1674 | | Taint reach - nodes tainted | 0 | | Taint reach - per million nodes | 0 | | Taint sinks - cryptographic operations | 0 | diff --git a/rust/ql/integration-tests/hello-workspace/summary.cargo.expected b/rust/ql/integration-tests/hello-workspace/summary.cargo.expected index d08ce1a4116..caf7b2b8cd9 100644 --- a/rust/ql/integration-tests/hello-workspace/summary.cargo.expected +++ b/rust/ql/integration-tests/hello-workspace/summary.cargo.expected @@ -14,7 +14,7 @@ | Macro calls - resolved | 2 | | Macro calls - total | 2 | | Macro calls - unresolved | 0 | -| Taint edges - number of edges | 1670 | +| Taint edges - number of edges | 1674 | | Taint reach - nodes tainted | 0 | | Taint reach - per million nodes | 0 | | Taint sinks - cryptographic operations | 0 | diff --git a/rust/ql/integration-tests/hello-workspace/summary.rust-project.expected b/rust/ql/integration-tests/hello-workspace/summary.rust-project.expected index d08ce1a4116..caf7b2b8cd9 100644 --- a/rust/ql/integration-tests/hello-workspace/summary.rust-project.expected +++ b/rust/ql/integration-tests/hello-workspace/summary.rust-project.expected @@ -14,7 +14,7 @@ | Macro calls - resolved | 2 | | Macro calls - total | 2 | | Macro calls - unresolved | 0 | -| Taint edges - number of edges | 1670 | +| Taint edges - number of edges | 1674 | | Taint reach - nodes tainted | 0 | | Taint reach - per million nodes | 0 | | Taint sinks - cryptographic operations | 0 | From 3dc35f1fabe6435eb65a38b5aa21f4326a3563d7 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Fri, 7 Mar 2025 17:02:26 +0000 Subject: [PATCH 016/286] Rust: Accept more test changes. --- .../dataflow/local/DataFlowStep.expected | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected index e403311345c..26ffdc13df6 100644 --- a/rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected +++ b/rust/ql/test/library-tests/dataflow/local/DataFlowStep.expected @@ -1946,6 +1946,10 @@ models | 1058 | Summary: lang:std; crate::thread::current::set_current; Argument[0]; ReturnValue.Field[crate::result::Result::Err(0)]; value | | 1059 | Summary: lang:std; crate::thread::current::try_with_current; Argument[0].ReturnValue; ReturnValue; value | | 1060 | Summary: lang:std; crate::thread::with_current_name; Argument[0].ReturnValue; ReturnValue; value | +| 1061 | Summary: repo:https://github.com/fizyk20/generic-array.git:generic-array; ::from_mut_slice; Argument[0].Reference; ReturnValue.Reference; value | +| 1062 | Summary: repo:https://github.com/fizyk20/generic-array.git:generic-array; ::from_slice; Argument[0].Reference; ReturnValue.Reference; value | +| 1063 | Summary: repo:https://github.com/fizyk20/generic-array.git:generic-array; ::try_from_mut_slice; Argument[0].Reference; ReturnValue.Field[crate::result::Result::Ok(0)].Reference; value | +| 1064 | Summary: repo:https://github.com/fizyk20/generic-array.git:generic-array; ::try_from_slice; Argument[0].Reference; ReturnValue.Field[crate::result::Result::Ok(0)].Reference; value | storeStep | file://:0:0:0:0 | [summary] to write: Argument[0].Field[crate::option::Option::Some(0)] in lang:core::_::::zip_with | Some | file://:0:0:0:0 | [post] [summary param] 0 in lang:core::_::::zip_with | | file://:0:0:0:0 | [summary] to write: Argument[0].Parameter[0].Reference in lang:alloc::_::::retain | &ref | file://:0:0:0:0 | [summary] to write: Argument[0].Parameter[0] in lang:alloc::_::::retain | @@ -2034,6 +2038,7 @@ storeStep | file://:0:0:0:0 | [summary] to write: Argument[self].Reference.Reference in lang:std::_::<&[u8] as crate::io::Read>::read_to_end | &ref | file://:0:0:0:0 | [summary] to write: Argument[self].Reference in lang:std::_::<&[u8] as crate::io::Read>::read_to_end | | file://:0:0:0:0 | [summary] to write: Argument[self].Reference.Reference in lang:std::_::<&[u8] as crate::io::Read>::read_to_string | &ref | file://:0:0:0:0 | [summary] to write: Argument[self].Reference in lang:std::_::<&[u8] as crate::io::Read>::read_to_string | | file://:0:0:0:0 | [summary] to write: Argument[self].Reference.Reference in lang:std::_::<&[u8] as crate::io::copy::BufferedReaderSpec>::copy_to | &ref | file://:0:0:0:0 | [summary] to write: Argument[self].Reference in lang:std::_::<&[u8] as crate::io::copy::BufferedReaderSpec>::copy_to | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Element in lang:core::_::<_ as crate::convert::Into>::into | element | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::<_ as crate::convert::Into>::into | | file://:0:0:0:0 | [summary] to write: ReturnValue.Element in lang:core::_::::collect | element | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::::collect | | file://:0:0:0:0 | [summary] to write: ReturnValue.Element in lang:core::_::crate::cmp::minmax | element | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::crate::cmp::minmax | | file://:0:0:0:0 | [summary] to write: ReturnValue.Element in lang:core::_::crate::cmp::minmax_by | element | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::crate::cmp::minmax_by | @@ -2071,12 +2076,20 @@ storeStep | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0] in lang:core::_::::overflowing_div_euclid | tuple.0 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::::overflowing_div_euclid | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0] in lang:std::_::::into_parts | tuple.0 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::::into_parts | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0].Field[crate::option::Option::Some(0)] in lang:core::_::::unzip | Some | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0] in lang:core::_::::unzip | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0].Reference in lang:core::_::<[_]>::align_to | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0] in lang:core::_::<[_]>::align_to | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0].Reference.Element in lang:core::_::<[_]>::align_to | element | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[0].Reference in lang:core::_::<[_]>::align_to | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:alloc::_::::find_lower_bound_edge | tuple.1 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::::find_lower_bound_edge | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:alloc::_::::find_upper_bound_edge | tuple.1 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::::find_upper_bound_edge | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:core::_::<[_]>::align_to | tuple.1 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::<[_]>::align_to | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:core::_::::unzip | tuple.1 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::::unzip | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:core::_::crate::slice::sort::shared::find_existing_run | tuple.1 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::crate::slice::sort::shared::find_existing_run | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:std::_::::into_parts | tuple.1 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::::into_parts | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1].Field[crate::option::Option::Some(0)] in lang:core::_::::unzip | Some | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:core::_::::unzip | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1].Reference in lang:core::_::<[_]>::align_to | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1] in lang:core::_::<[_]>::align_to | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1].Reference.Element in lang:core::_::<[_]>::align_to | element | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[1].Reference in lang:core::_::<[_]>::align_to | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[2] in lang:core::_::<[_]>::align_to | tuple.2 | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::<[_]>::align_to | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[2].Reference in lang:core::_::<[_]>::align_to | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[2] in lang:core::_::<[_]>::align_to | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[2].Reference.Element in lang:core::_::<[_]>::align_to | element | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[2].Reference in lang:core::_::<[_]>::align_to | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::option::Option::Some(0)] in lang:core::_::::then | Some | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::::then | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::option::Option::Some(0)] in lang:core::_::::then_some | Some | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::::then_some | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::option::Option::Some(0)] in lang:core::_::::nth_back | Some | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:core::_::::nth_back | @@ -2209,6 +2222,8 @@ storeStep | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in lang:std::_::::wait_while | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::::wait_while | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in lang:std::_::::try_with | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::::try_with | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in lang:std::_::crate::sys::pal::unix::cvt | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::crate::sys::pal::unix::cvt | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_mut_slice | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_mut_slice | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_slice | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_slice | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/seanmonstar/reqwest:reqwest::_::::bytes | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/seanmonstar/reqwest:reqwest::_::::bytes | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/seanmonstar/reqwest:reqwest::_::::text | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/seanmonstar/reqwest:reqwest::_::::text | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/seanmonstar/reqwest:reqwest::_::::text_with_charset | Ok | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/seanmonstar/reqwest:reqwest::_::::text_with_charset | @@ -2225,6 +2240,8 @@ storeStep | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)].Reference in lang:core::_::::try_insert | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in lang:core::_::::try_insert | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)].Reference in lang:core::_::::as_mut | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in lang:core::_::::as_mut | | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)].Reference in lang:core::_::::as_ref | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in lang:core::_::::as_ref | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)].Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_mut_slice | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_mut_slice | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)].Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_slice | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue.Field[crate::result::Result::Ok(0)] in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_slice | | file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in lang:alloc::_::::borrow | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::::borrow | | file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in lang:alloc::_::::borrow | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::::borrow | | file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in lang:alloc::_::::borrow_mut | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:alloc::_::::borrow_mut | @@ -2304,6 +2321,8 @@ storeStep | file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in lang:std::_::::as_file_desc | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::::as_file_desc | | file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in lang:std::_::<{486}::StaticStrPayload as crate::panic::PanicPayload>::get | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::<{486}::StaticStrPayload as crate::panic::PanicPayload>::get | | file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in lang:std::_::<{491}::RewrapBox as crate::panic::PanicPayload>::get | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in lang:std::_::<{491}::RewrapBox as crate::panic::PanicPayload>::get | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_mut_slice | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_mut_slice | +| file://:0:0:0:0 | [summary] to write: ReturnValue.Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_slice | &ref | file://:0:0:0:0 | [summary] to write: ReturnValue in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_slice | | main.rs:97:14:97:22 | source(...) | tuple.0 | main.rs:97:13:97:26 | TupleExpr | | main.rs:97:25:97:25 | 2 | tuple.1 | main.rs:97:13:97:26 | TupleExpr | | main.rs:103:14:103:14 | 2 | tuple.0 | main.rs:103:13:103:30 | TupleExpr | @@ -2493,6 +2512,10 @@ readStep | file://:0:0:0:0 | [summary param] 0 in lang:std::_::crate::sys_common::ignore_notfound | Err | file://:0:0:0:0 | [summary] read: Argument[0].Field[crate::result::Result::Err(0)] in lang:std::_::crate::sys_common::ignore_notfound | | file://:0:0:0:0 | [summary param] 0 in lang:std::_::crate::thread::current::try_with_current | function return | file://:0:0:0:0 | [summary] read: Argument[0].ReturnValue in lang:std::_::crate::thread::current::try_with_current | | file://:0:0:0:0 | [summary param] 0 in lang:std::_::crate::thread::with_current_name | function return | file://:0:0:0:0 | [summary] read: Argument[0].ReturnValue in lang:std::_::crate::thread::with_current_name | +| file://:0:0:0:0 | [summary param] 0 in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_mut_slice | &ref | file://:0:0:0:0 | [summary] read: Argument[0].Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_mut_slice | +| file://:0:0:0:0 | [summary param] 0 in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_slice | &ref | file://:0:0:0:0 | [summary] read: Argument[0].Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::from_slice | +| file://:0:0:0:0 | [summary param] 0 in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_mut_slice | &ref | file://:0:0:0:0 | [summary] read: Argument[0].Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_mut_slice | +| file://:0:0:0:0 | [summary param] 0 in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_slice | &ref | file://:0:0:0:0 | [summary] read: Argument[0].Reference in repo:https://github.com/fizyk20/generic-array.git:generic-array::_::::try_from_slice | | file://:0:0:0:0 | [summary param] 1 in lang:alloc::_::::fold | function return | file://:0:0:0:0 | [summary] read: Argument[1].ReturnValue in lang:alloc::_::::fold | | file://:0:0:0:0 | [summary param] 1 in lang:alloc::_::crate::collections::btree::mem::replace | function return | file://:0:0:0:0 | [summary] read: Argument[1].ReturnValue in lang:alloc::_::crate::collections::btree::mem::replace | | file://:0:0:0:0 | [summary param] 1 in lang:alloc::_::crate::collections::btree::mem::take_mut | function return | file://:0:0:0:0 | [summary] read: Argument[1].ReturnValue in lang:alloc::_::crate::collections::btree::mem::take_mut | @@ -2629,6 +2652,9 @@ readStep | file://:0:0:0:0 | [summary param] self in lang:core::_::<&mut _ as crate::borrow::BorrowMut>::borrow_mut | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<&mut _ as crate::borrow::BorrowMut>::borrow_mut | | file://:0:0:0:0 | [summary param] self in lang:core::_::<&mut _ as crate::ops::deref::Deref>::deref | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<&mut _ as crate::ops::deref::Deref>::deref | | file://:0:0:0:0 | [summary param] self in lang:core::_::<&mut _ as crate::ops::deref::DerefMut>::deref_mut | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<&mut _ as crate::ops::deref::DerefMut>::deref_mut | +| file://:0:0:0:0 | [summary param] self in lang:core::_::<[_]>::align_to | element | file://:0:0:0:0 | [summary] read: Argument[self].Element in lang:core::_::<[_]>::align_to | +| file://:0:0:0:0 | [summary param] self in lang:core::_::<_ as crate::convert::Into>::into | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<_ as crate::convert::Into>::into | +| file://:0:0:0:0 | [summary param] self in lang:core::_::<_ as crate::convert::Into>::into | element | file://:0:0:0:0 | [summary] read: Argument[self].Element in lang:core::_::<_ as crate::convert::Into>::into | | file://:0:0:0:0 | [summary param] self in lang:core::_::<_ as crate::str::pattern::MultiCharEq>::matches | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<_ as crate::str::pattern::MultiCharEq>::matches | | file://:0:0:0:0 | [summary param] self in lang:core::_::::clone | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::::clone | | file://:0:0:0:0 | [summary param] self in lang:core::_::::clone | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::::clone | @@ -2923,6 +2949,7 @@ readStep | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<&_ as crate::borrow::Borrow>::borrow | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference.Reference in lang:core::_::<&_ as crate::borrow::Borrow>::borrow | | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<&mut _ as crate::borrow::Borrow>::borrow | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference.Reference in lang:core::_::<&mut _ as crate::borrow::Borrow>::borrow | | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<&mut _ as crate::borrow::BorrowMut>::borrow_mut | &ref | file://:0:0:0:0 | [summary] read: Argument[self].Reference.Reference in lang:core::_::<&mut _ as crate::borrow::BorrowMut>::borrow_mut | +| file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<_ as crate::convert::Into>::into | element | file://:0:0:0:0 | [summary] read: Argument[self].Reference.Element in lang:core::_::<_ as crate::convert::Into>::into | | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::<_ as crate::str::pattern::MultiCharEq>::matches | function return | file://:0:0:0:0 | [summary] read: Argument[self].Reference.ReturnValue in lang:core::_::<_ as crate::str::pattern::MultiCharEq>::matches | | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::::as_mut | Some | file://:0:0:0:0 | [summary] read: Argument[self].Reference.Field[crate::option::Option::Some(0)] in lang:core::_::::as_mut | | file://:0:0:0:0 | [summary] read: Argument[self].Reference in lang:core::_::::as_ref | Some | file://:0:0:0:0 | [summary] read: Argument[self].Reference.Field[crate::option::Option::Some(0)] in lang:core::_::::as_ref | From b4e710f459636b286cc344f9e0b31c9040ab5481 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Fri, 7 Mar 2025 21:25:15 +0000 Subject: [PATCH 017/286] Rust: Add missing models (for some platforms???). --- .../rustcrypto/rustcrypto.model.yml | 3 ++ .../HardcodedCryptographicValue.expected | 54 +++++++++---------- 2 files changed, 30 insertions(+), 27 deletions(-) diff --git a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml index 2047cfa9ebc..3c588473514 100644 --- a/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml +++ b/rust/ql/lib/codeql/rust/frameworks/rustcrypto/rustcrypto.model.yml @@ -9,6 +9,7 @@ extensions: - ["repo:https://github.com/RustCrypto/traits:digest", "<_ as crate::digest::Digest>::digest", "Argument[0]", "hasher-input", "manual"] - ["repo:https://github.com/stainless-steel/md5:md5", "crate::compute", "Argument[0]", "hasher-input", "manual"] - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[1]", "credentials-iv", "manual"] - ["repo:https://github.com/RustCrypto/traits:cipher", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/traits:cipher", "::new", "Argument[1]", "credentials-iv", "manual"] @@ -28,6 +29,8 @@ extensions: - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] + - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new_from_slice", "Argument[0]", "credentials-key", "manual"] - ["repo:https://github.com/RustCrypto/block-ciphers:aes", "::new", "Argument[0]", "credentials-key", "manual"] diff --git a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected index a8ce502c403..726934d5d98 100644 --- a/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected +++ b/rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected @@ -19,78 +19,78 @@ edges | test_cipher.rs:18:28:18:36 | &... [&ref, element] | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | provenance | | | test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | test_cipher.rs:18:28:18:36 | &... [&ref, element] | provenance | | | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:29:18:36 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:19:30:19:47 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | +| test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | test_cipher.rs:19:30:19:47 | ...::new | provenance | MaD:61 Sink:MaD:61 Sink:MaD:61 | | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | test_cipher.rs:19:49:19:79 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:25:9:25:14 | const4 [&ref, element] | test_cipher.rs:26:66:26:71 | const4 [&ref, element] | provenance | | | test_cipher.rs:25:28:25:36 | &... [&ref, element] | test_cipher.rs:25:9:25:14 | const4 [&ref, element] | provenance | | | test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | test_cipher.rs:25:28:25:36 | &... [&ref, element] | provenance | | | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:29:25:36 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | test_cipher.rs:26:30:26:40 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | +| test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | test_cipher.rs:26:30:26:40 | ...::new | provenance | MaD:61 Sink:MaD:61 Sink:MaD:61 | | test_cipher.rs:26:66:26:71 | const4 [&ref, element] | test_cipher.rs:26:42:26:72 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:29:9:29:14 | const5 [&ref, element] | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | provenance | | | test_cipher.rs:29:28:29:36 | &... [&ref, element] | test_cipher.rs:29:9:29:14 | const5 [&ref, element] | provenance | | | test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | test_cipher.rs:29:28:29:36 | &... [&ref, element] | provenance | | | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:29:29:36 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:61 Sink:MaD:61 Sink:MaD:61 | +| test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | test_cipher.rs:30:30:30:40 | ...::new | provenance | MaD:62 Sink:MaD:62 Sink:MaD:62 | | test_cipher.rs:30:95:30:100 | const5 [&ref, element] | test_cipher.rs:30:72:30:101 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:37:9:37:14 | const7 | test_cipher.rs:38:74:38:79 | const7 | provenance | | | test_cipher.rs:37:27:37:74 | [...] | test_cipher.rs:37:9:37:14 | const7 | provenance | | -| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:60 Sink:MaD:60 | +| test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | test_cipher.rs:38:30:38:47 | ...::new | provenance | MaD:61 Sink:MaD:61 | | test_cipher.rs:38:73:38:79 | &const7 [&ref] | test_cipher.rs:38:49:38:80 | ...::from_slice(...) [&ref] | provenance | MaD:0 | | test_cipher.rs:38:74:38:79 | const7 | test_cipher.rs:38:73:38:79 | &const7 [&ref] | provenance | | | test_cipher.rs:41:9:41:14 | const8 [&ref] | test_cipher.rs:42:73:42:78 | const8 [&ref] | provenance | | | test_cipher.rs:41:28:41:76 | &... [&ref] | test_cipher.rs:41:9:41:14 | const8 [&ref] | provenance | | | test_cipher.rs:41:29:41:76 | [...] | test_cipher.rs:41:28:41:76 | &... [&ref] | provenance | | -| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:60 Sink:MaD:60 | +| test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | test_cipher.rs:42:30:42:47 | ...::new | provenance | MaD:61 Sink:MaD:61 | | test_cipher.rs:42:73:42:78 | const8 [&ref] | test_cipher.rs:42:49:42:79 | ...::from_slice(...) [&ref] | provenance | MaD:0 | -| test_cipher.rs:45:9:45:14 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:104 | +| test_cipher.rs:45:9:45:14 | const9 | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | provenance | MaD:107 | | test_cipher.rs:45:27:45:50 | [...] | test_cipher.rs:45:9:45:14 | const9 | provenance | | | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | provenance | | | test_cipher.rs:46:32:46:54 | const9.align_to(...) [tuple.1, &ref, element] | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | provenance | | | test_cipher.rs:46:32:46:56 | ... .1 [&ref, element] | test_cipher.rs:46:9:46:19 | const9_conv [&ref, element] | provenance | | -| test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | test_cipher.rs:47:30:47:47 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | +| test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | test_cipher.rs:47:30:47:47 | ...::new | provenance | MaD:61 Sink:MaD:61 Sink:MaD:61 | | test_cipher.rs:47:73:47:83 | const9_conv [&ref, element] | test_cipher.rs:47:49:47:84 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:50:9:50:15 | const10 [element] | test_cipher.rs:51:75:51:81 | const10 [element] | provenance | | -| test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | provenance | Src:MaD:101 | +| test_cipher.rs:50:37:50:52 | ...::zeroed | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | provenance | Src:MaD:104 | | test_cipher.rs:50:37:50:54 | ...::zeroed(...) [element] | test_cipher.rs:50:9:50:15 | const10 [element] | provenance | | -| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | test_cipher.rs:51:31:51:48 | ...::new | provenance | MaD:60 Sink:MaD:60 Sink:MaD:60 | +| test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | test_cipher.rs:51:31:51:48 | ...::new | provenance | MaD:61 Sink:MaD:61 Sink:MaD:61 | | test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | test_cipher.rs:51:50:51:82 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | | test_cipher.rs:51:75:51:81 | const10 [element] | test_cipher.rs:51:74:51:81 | &const10 [&ref, element] | provenance | | | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:40 | const2 [&ref, element] | provenance | | -| test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:103 | +| test_cipher.rs:66:9:66:14 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:106 | | test_cipher.rs:66:18:66:26 | &... [&ref, element] | test_cipher.rs:66:9:66:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | test_cipher.rs:66:18:66:26 | &... [&ref, element] | provenance | | | test_cipher.rs:66:20:66:22 | 0u8 | test_cipher.rs:66:19:66:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:102 | -| test_cipher.rs:67:35:67:47 | const2.into(...) [element] | test_cipher.rs:67:23:67:33 | ...::new | provenance | MaD:76 Sink:MaD:76 | +| test_cipher.rs:67:35:67:40 | const2 [&ref, element] | test_cipher.rs:67:35:67:47 | const2.into(...) [element] | provenance | MaD:105 | +| test_cipher.rs:67:35:67:47 | const2.into(...) [element] | test_cipher.rs:67:23:67:33 | ...::new | provenance | MaD:77 Sink:MaD:77 | | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | test_cipher.rs:74:46:74:51 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:18:73:26 | &... [&ref, element] | test_cipher.rs:73:9:73:14 | const2 [&ref, element] | provenance | | | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | test_cipher.rs:73:18:73:26 | &... [&ref, element] | provenance | | | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:19:73:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:84 Sink:MaD:84 Sink:MaD:84 | +| test_cipher.rs:74:46:74:51 | const2 [&ref, element] | test_cipher.rs:74:23:74:44 | ...::new_from_slice | provenance | MaD:87 Sink:MaD:87 Sink:MaD:87 | | test_cipher.rs:80:9:80:14 | const6 [&ref, element] | test_cipher.rs:81:63:81:68 | const6 [&ref, element] | provenance | | -| test_cipher.rs:80:9:80:14 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:103 | +| test_cipher.rs:80:9:80:14 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:106 | | test_cipher.rs:80:18:80:26 | &... [&ref, element] | test_cipher.rs:80:9:80:14 | const6 [&ref, element] | provenance | | | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | test_cipher.rs:80:18:80:26 | &... [&ref, element] | provenance | | | test_cipher.rs:80:20:80:22 | 0u8 | test_cipher.rs:80:19:80:26 | [0u8; 32] [element] | provenance | | -| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:102 | -| test_cipher.rs:81:63:81:75 | const6.into(...) [element] | test_cipher.rs:81:23:81:61 | ...::new | provenance | MaD:86 Sink:MaD:86 | +| test_cipher.rs:81:63:81:68 | const6 [&ref, element] | test_cipher.rs:81:63:81:75 | const6.into(...) [element] | provenance | MaD:105 | +| test_cipher.rs:81:63:81:75 | const6.into(...) [element] | test_cipher.rs:81:23:81:61 | ...::new | provenance | MaD:89 Sink:MaD:89 | | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:80 | const7 [&ref, element] | provenance | | -| test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:103 | +| test_cipher.rs:84:9:84:14 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:106 | | test_cipher.rs:84:18:84:27 | &... [&ref, element] | test_cipher.rs:84:9:84:14 | const7 [&ref, element] | provenance | | | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | test_cipher.rs:84:18:84:27 | &... [&ref, element] | provenance | | | test_cipher.rs:84:20:84:22 | 0u8 | test_cipher.rs:84:19:84:27 | [0u8; 16] [element] | provenance | | -| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:102 | -| test_cipher.rs:85:75:85:87 | const7.into(...) [element] | test_cipher.rs:85:23:85:61 | ...::new | provenance | MaD:87 Sink:MaD:87 | -| test_cipher.rs:124:9:124:12 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:85:75:85:80 | const7 [&ref, element] | test_cipher.rs:85:75:85:87 | const7.into(...) [element] | provenance | MaD:105 | +| test_cipher.rs:85:75:85:87 | const7.into(...) [element] | test_cipher.rs:85:23:85:61 | ...::new | provenance | MaD:90 Sink:MaD:90 | +| test_cipher.rs:124:9:124:12 | key2 [element] | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | provenance | MaD:105 | | test_cipher.rs:124:25:124:30 | [0; 32] [element] | test_cipher.rs:124:9:124:12 | key2 [element] | provenance | | | test_cipher.rs:124:26:124:26 | 0 | test_cipher.rs:124:25:124:30 | [0; 32] [element] | provenance | | -| test_cipher.rs:125:9:125:14 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:125:9:125:14 | nonce2 [element] | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | provenance | MaD:105 | | test_cipher.rs:125:18:125:23 | [0; 12] [element] | test_cipher.rs:125:9:125:14 | nonce2 [element] | provenance | | | test_cipher.rs:125:19:125:19 | 0 | test_cipher.rs:125:18:125:23 | [0; 12] [element] | provenance | | -| test_cipher.rs:126:34:126:45 | &... [&ref, element] | test_cipher.rs:126:19:126:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | +| test_cipher.rs:126:34:126:45 | &... [&ref, element] | test_cipher.rs:126:19:126:32 | ...::new | provenance | MaD:93 Sink:MaD:93 Sink:MaD:93 | | test_cipher.rs:126:35:126:45 | key2.into(...) [element] | test_cipher.rs:126:34:126:45 | &... [&ref, element] | provenance | | -| test_cipher.rs:127:29:127:42 | &... [&ref, element] | test_cipher.rs:127:21:127:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | +| test_cipher.rs:127:29:127:42 | &... [&ref, element] | test_cipher.rs:127:21:127:27 | encrypt | provenance | MaD:94 Sink:MaD:94 Sink:MaD:94 | | test_cipher.rs:127:30:127:42 | nonce2.into(...) [element] | test_cipher.rs:127:29:127:42 | &... [&ref, element] | provenance | | | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | provenance | | | test_cipher.rs:129:32:129:41 | &... [&ref, element] | test_cipher.rs:129:9:129:18 | key3_array [&ref, element] | provenance | | @@ -99,13 +99,13 @@ edges | test_cipher.rs:130:9:130:12 | key3 [&ref, element] | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | provenance | | | test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | test_cipher.rs:130:9:130:12 | key3 [&ref, element] | provenance | | | test_cipher.rs:130:45:130:54 | key3_array [&ref, element] | test_cipher.rs:130:16:130:55 | ...::from_slice(...) [&ref, element] | provenance | MaD:0 | -| test_cipher.rs:131:9:131:14 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:102 | +| test_cipher.rs:131:9:131:14 | nonce3 [element] | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | provenance | MaD:105 | | test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | test_cipher.rs:131:9:131:14 | nonce3 [element] | provenance | | | test_cipher.rs:131:28:131:31 | 0xff | test_cipher.rs:131:27:131:35 | [0xff; 12] [element] | provenance | | -| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 | -| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:90 Sink:MaD:90 Sink:MaD:90 Sink:MaD:90 | +| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:93 Sink:MaD:93 Sink:MaD:93 | +| test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | test_cipher.rs:132:19:132:32 | ...::new | provenance | MaD:93 Sink:MaD:93 Sink:MaD:93 Sink:MaD:93 | | test_cipher.rs:132:35:132:38 | key3 [&ref, element] | test_cipher.rs:132:34:132:38 | &key3 [&ref, &ref, element] | provenance | | -| test_cipher.rs:133:29:133:42 | &... [&ref, element] | test_cipher.rs:133:21:133:27 | encrypt | provenance | MaD:91 Sink:MaD:91 Sink:MaD:91 | +| test_cipher.rs:133:29:133:42 | &... [&ref, element] | test_cipher.rs:133:21:133:27 | encrypt | provenance | MaD:94 Sink:MaD:94 Sink:MaD:94 | | test_cipher.rs:133:30:133:42 | nonce3.into(...) [element] | test_cipher.rs:133:29:133:42 | &... [&ref, element] | provenance | | nodes | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | semmle.label | const1 [&ref, element] | From e84a98bd975a4bd23ccaa6e375b205cac0d076c5 Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Mon, 10 Mar 2025 11:15:23 +0000 Subject: [PATCH 018/286] Apply suggestions from code review Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> --- .../security/CWE-798/HardcodedCryptographicValue.qhelp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp index b44a98013c8..f3b2d831944 100644 --- a/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp +++ b/rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.qhelp @@ -5,7 +5,7 @@

    -Hardcoded passwords, keys, initialization vectors and salts should not be used for cryptographic operations. +Hardcoded passwords, keys, initialization vectors, and salts should not be used for cryptographic operations.