Erik Krogh Kristensen
69353bb014
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
Geoffrey White
fc6f42296a
C++: Upgrade cpp/system-data-exposure.
2022-03-07 17:39:04 +00:00
Mathias Vorreiter Pedersen
624795cbbf
Merge pull request #8059 from rdmarsh2/rdmarsh2/cpp/insufficient-key-strength
...
C++: new query for insufficient key strength
2022-03-04 17:11:44 +00:00
Robert Marsh
60532e631e
C++: fix missing paren
2022-03-03 14:45:43 -05:00
Robert Marsh
9fb94d85b4
C++: performance tweaks for InsufficientKeySize
2022-03-02 15:59:42 -05:00
Geoffrey White
5402b02fd7
Merge branch 'main' into cwe497
2022-03-01 11:58:24 +00:00
Robert Marsh
a60fe9f4b8
C++: exclude 0 earlier in InsufficientKeySize
2022-02-24 14:26:37 -05:00
Geoffrey White
899ae90ba4
C++: Add GVN.
2022-02-24 17:22:37 +00:00
Geoffrey White
6c40cda68d
C++: Pragmatic solution to include more sinks (plus autoformat changes).
2022-02-24 12:10:34 +00:00
Geoffrey White
fc8ebdaeb2
C++: Increase the query to precision high.
2022-02-24 10:54:09 +00:00
Geoffrey White
c16302be13
C++: Fix the FP.
2022-02-24 10:54:08 +00:00
Robert Marsh
a37f746dff
C++: fix FP and add paths in InsufficientKeySize
2022-02-22 15:38:50 -05:00
Robert Marsh
103796dfa8
C++: respond to PR comments on InsufficientKeySize
2022-02-16 14:58:29 -05:00
Robert Marsh
cfd9c9d137
C++: Update doc for `getMinimumKeySize
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2022-02-16 14:53:09 -05:00
Robert Marsh
d3665f935e
C++: add sample code for InsufficientKeySize.qhelp
2022-02-16 12:30:41 -05:00
Geoffrey White
703f18b82f
C++: Better deduplication.
2022-02-15 17:52:27 +00:00
Robert Marsh
0e50c4b186
C++: Add openssl low-level API
2022-02-14 14:47:55 -05:00
Geoffrey White
c4d9c1d9e7
C++: Reduce result duplication.
2022-02-11 16:03:38 +00:00
Geoffrey White
00ba76b7e4
C++: Convert to IR taint tracking.
2022-02-11 13:00:42 +00:00
Robert Marsh
dbe4770c7d
C++: add initial insufficient key size query
2022-02-10 14:53:40 -05:00
Geoffrey White
20ad92a82e
C++: Filter noisiest sources.
2022-02-10 11:11:30 +00:00
Geoffrey White
7b5b2fdcd1
C++: Modernize cpp/system-data-exposure as a path-problem using IR taint, RemoteFlowSinkFunction.
2022-02-10 11:11:26 +00:00
Geoffrey White
6005f3d2d4
C++: Add pragma[noinline].
2022-02-08 09:13:51 +00:00
Geoffrey White
6727069893
C++: Autoformat.
2022-02-07 17:33:11 +00:00
Geoffrey White
d1b6871314
C++: Restrict type.
2022-02-07 17:32:52 +00:00
Geoffrey White
005dfdffdb
C++: Speed up cpp/cleartext-transmission ('Encrypted' class).
2022-02-07 17:19:25 +00:00
Jeroen Ketema
1f2865c7cc
Merge pull request #7798 from jketema/missing-open-arg
...
C++: Add query for missing mode argument in `open`/`openat` calls
2022-02-07 12:01:44 +01:00
Jeroen Ketema
b967eaf25d
Add documentation for parseHex
2022-02-04 12:35:13 +01:00
Jeroen Ketema
9f4e261625
Set precision of cpp/open-call-with-mode-argument to high
2022-02-04 10:01:25 +01:00
Jeroen Ketema
ef2a70e00c
Limit open/openat target to global/std scope
2022-02-04 09:51:10 +01:00
Geoffrey White
8031c3f699
Merge branch 'main' into clrtxt9
2022-02-03 17:01:59 +00:00
Geoffrey White
02b1774d7f
C++: Switch from GVN to localFlow.
2022-02-03 16:00:26 +00:00
Jeroen Ketema
0b9b6d7b98
Address review comments
2022-02-03 12:09:18 +01:00
Jeroen Ketema
4d03082f16
Ensure that O_CREAT and O_TMPFILE are unique
2022-02-03 11:24:20 +01:00
Jeroen Ketema
5a2ce225f4
Check that all bits are set when checking for a flag
...
The `O_...` macro definitions somtimes set multiple bits, while
the bits individually represent the values of different `O_...`
macros. This lead to false postives on codebases built against
Musl libc, which defines `O_TMPFILE` as `020200000` and
`O_DIRECTORY` as `0200000`.
2022-02-03 10:29:13 +01:00
Geoffrey White
708da8cd62
C++: Increase the query precision to 'high'.
2022-02-02 18:03:25 +00:00
Geoffrey White
4048ba0a1c
C++: Fix false positives around terminal output.
2022-02-02 17:59:28 +00:00
Geoffrey White
39a2ffd438
C++: Fix false positives around 'stdin'.
2022-02-02 17:39:14 +00:00
Jeroen Ketema
aa4651312e
Fix naming conflicts in cpp/world-writable-file-creation
2022-02-02 17:36:14 +01:00
Jeroen Ketema
f32500306a
Address review comments
2022-02-02 17:24:55 +01:00
Jeroen Ketema
0773ab37a5
Use matches to check for 0x prefix
2022-02-02 15:26:46 +01:00
Jeroen Ketema
92d9e51d2a
Extract the value of O_CREAT and O_TMPFILE from the defining macro
...
There are operating systems that define `O_CREAT` with a different
value than Linux, which uses `0x40`. For example, OpenBSD uses `0x0200`.
Hence, we cannot use a hardcoded value.
Also handle `O_TMPFILE` while here.
2022-02-02 15:16:26 +01:00
Mathias Vorreiter Pedersen
1aa32b09be
Merge pull request #7802 from geoffw0/clrtxt8
...
C++: Recognize password struct fields.
2022-02-02 14:10:40 +00:00
Jeroen Ketema
bd859d99bf
Address review comments
2022-02-02 10:09:47 +01:00
Jeroen Ketema
ff1c971100
Add query for missing mode argument in open/openat calls
2022-02-01 14:52:22 +01:00
Jeroen Ketema
dbac927721
Take into account that the 4th argument of openat may be omitted
...
This matches what is done for `open`.
2022-02-01 11:41:07 +01:00
Mathias Vorreiter Pedersen
bb2feda8fb
Merge pull request #7703 from geoffw0/getslocal
2022-01-28 19:35:15 +00:00
Geoffrey White
8a1b49f816
C++: Recognize password struct fields.
2022-01-28 19:10:46 +00:00
Geoffrey White
036e1495b8
Merge branch 'main' into getslocal
2022-01-28 15:58:13 +00:00
Geoffrey White
b73dc98191
C++: Exclude write to stdout etc.
2022-01-28 11:57:31 +00:00
