hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Exclude results that are used as file names.

Browse Source
This commit is contained in:
Geoffrey White
2021-07-22 14:18:08 +01:00
parent 1d582182b0
commit f8fed263e6
3 changed files with 29 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
View File

@@ -15,10 +15,37 @@ import cpp
import semmle.code.cpp.security.SensitiveExprs
import semmle.code.cpp.security.FileWrite
import semmle.code.cpp.dataflow.DataFlow
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
/**
* An operation on a filename.
*/
predicate filenameOperation(FunctionCall op, Expr path) {
exists(string name | name = op.getTarget().getName() |
name =
[
"remove", "unlink", "rmdir", "rename", "fopen", "open", "freopen", "_open", "_wopen",
"_wfopen", "_fsopen", "_wfsopen", "chmod", "chown", "stat", "lstat", "fstat", "access", "_access", "_waccess", "_access_s", "_waccess_s"
] and
path = op.getArgument(0)
or
name = ["fopen_s", "wfopen_s", "rename"] and
path = op.getArgument(1)
)
}
predicate isFileName(GVN gvn)
{
exists(FunctionCall op, Expr path |
filenameOperation(op, path) and
gvn = globalValueNumber(path)
)
}
from FileWrite w, SensitiveExpr source, Expr dest
where
DataFlow::localFlow(DataFlow::exprNode(source), DataFlow::exprNode(w.getASource())) and
dest = w.getDest()
dest = w.getDest() and
not isFileName(globalValueNumber(source)) // file names are not passwords
select w, "This write into file '" + dest.toString() + "' may contain unencrypted data from $@",
source, "this source."

1
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.expected
View File

@@ -6,7 +6,6 @@
| test2.cpp:57:2:57:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:57:39:57:49 | call to getPassword | this source. |
| test2.cpp:65:3:65:9 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:62:18:62:25 | password | this source. |
| test2.cpp:79:2:79:8 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:79:36:79:43 | password | this source. |
| test2.cpp:84:4:84:10 | call to fprintf | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:84:50:84:63 | passwd_config2 | this source. |
| test.cpp:45:3:45:7 | call to fputs | This write into file 'file' may contain unencrypted data from $@ | test.cpp:45:9:45:19 | thePassword | this source. |
| test.cpp:70:35:70:35 | call to operator<< | This write into file 'mystream' may contain unencrypted data from $@ | test.cpp:70:38:70:48 | thePassword | this source. |
| test.cpp:73:37:73:41 | call to write | This write into file 'mystream' may contain unencrypted data from $@ | test.cpp:73:43:73:53 | thePassword | this source. |

2
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp
View File

@@ -81,7 +81,7 @@ void tests(FILE *log, myStruct &s)
{
if (fopen(s.passwd_config2, "rt") == 0)
{
fprintf(log, "could not open file '%s'.\n", s.passwd_config2); // GOOD [FALSE POSITIVE]
fprintf(log, "could not open file '%s'.\n", s.passwd_config2); // GOOD
}
}