Nora Dimitrijević
194d9a9f44
[DIFF-INFORMED] C++: UnsafeCreateProcessCall
2025-08-15 12:01:23 +02:00
Anders Schack-Mulligen
72415c7c2c
C++: Rename references.
2023-03-23 13:06:19 +01:00
Ed Minnix
2d5944fb0e
Refactor DataFlow configurations to use "Config" naming convention
2023-03-19 17:44:07 -04:00
Jeroen Ketema
53aa34bdd3
C++: Update UnsafeCreateProcessCall with DataFlow::ConfigSig
2023-03-08 15:04:53 +01:00
Jeroen Ketema
ecdeb9a970
C++: Revert semmle.code.cpp.dataflow to its old state
...
While here make sure all queries and tests use IR dataflow when appropriate.
2023-02-10 14:21:44 +01:00
Tony Torralba
3fcc99e5cb
C++: Remove omittable exists variables
2023-01-10 13:36:01 +01:00
Mathias Vorreiter Pedersen
e3cb7cf9fe
C++: Remove internal 'microsoft' tags from queries.
2022-08-01 17:30:23 +01:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Henning Makholm
2d615ef503
Fix ReDOS in cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
...
The sub-regex `(\s|.)*` aims to capture arbitrary string content
(in contrast to `.*` which doesn't match newlines), but it is
unsafe, since non-newline whitespace can match both alternatives.
This caused an evaluator crash in the wild.
Replace with `[\s\S]*`, which matches everything in a safe way.
2021-04-06 20:10:57 +02:00
Anders Schack-Mulligen
96e4a57edd
C++: Autoformat.
2020-01-29 13:11:50 +01:00
Jonas Jensen
4ef5c9af62
C++: Autoformat everything
...
Some files that will change in #1736 have been spared.
./build -j4 target/jars/qlformat
find ql/cpp/ql -name "*.ql" -print0 | xargs -0 target/jars/qlformat --input
find ql/cpp/ql -name "*.qll" -print0 | xargs -0 target/jars/qlformat --input
(cd ql && git checkout 'cpp/ql/src/semmle/code/cpp/ir/implementation/**/*SSA*.qll')
buildutils-internal/scripts/pr-checks/sync-identical-files.py --latest
2019-09-09 11:25:53 +02:00
Jonas Jensen
8654ebcbbd
C++: Avoid using nullValue predicate
...
The `nullValue` predicate performs a slow custom data-flow analysis to
find possible null values. It's so slow that it timed out after 1200s on
Wireshark.
In `UnsafeCreateProcessCall.ql`, the values found with `nullValue` were
used as sources in another data-flow analysis. By using the `NullValue`
class as sink instead of `nullValue`, we avoid the slow-down of doing
data flow twice. The `NullValue` class is essentially the base case of
`nullValue`. Confusing names, yes.
2018-11-29 13:33:45 +01:00
Raul Garcia
7ab723ae79
Fixing typos & incorporating feedback.
...
(MSFT feedback) Adding a new tag in the header @msrc.severity important
2018-10-16 10:00:51 -07:00
Raul Garcia
22d54801e5
Removed one false-positive scenario (no space on lpCommandLine)
...
Improved the query to avoid multiple calls to hasGlobalName
Fixed typos
Simplified the test case file
2018-10-15 15:53:02 -07:00
Raul Garcia
cd5e788aa7
Update UnsafeCreateProcessCall.ql
2018-10-15 13:41:21 -07:00
Raul Garcia
1d853691eb
Update UnsafeCreateProcessCall.qhelp
2018-10-15 13:40:40 -07:00
Raul Garcia
b8f8c99529
Update UnsafeCreateProcessCall.qhelp
2018-10-15 13:39:46 -07:00
Raul Garcia
85283d63ce
C++ : NULL application name with an unquoted path in call to CreateProcess
...
Calling a function of the CreatePorcess* family of functions, which may result in a security vulnerability if the path contains spaces.
2018-10-12 15:57:01 -07:00
