mirror of
https://github.com/github/codeql.git
synced 2026-04-30 19:26:02 +02:00
32 lines
784 B
Plaintext
32 lines
784 B
Plaintext
/**
|
|
* @name Use of potentially dangerous function
|
|
* @description Use of a standard library function that is not thread-safe.
|
|
* @kind problem
|
|
* @problem.severity warning
|
|
* @precision high
|
|
* @id cpp/potentially-dangerous-function
|
|
* @tags reliability
|
|
* security
|
|
* external/cwe/cwe-676
|
|
*/
|
|
import cpp
|
|
|
|
predicate potentiallyDangerousFunction(Function f, string message) {
|
|
exists(string name | f.hasGlobalName(name) |
|
|
(
|
|
name = "gmtime" or
|
|
name = "localtime" or
|
|
name = "ctime" or
|
|
name = "asctime"
|
|
) and
|
|
message = "Call to " + name + " is potentially dangerous"
|
|
)
|
|
}
|
|
|
|
|
|
from FunctionCall call, Function target, string message
|
|
where
|
|
call.getTarget() = target and
|
|
potentiallyDangerousFunction(target, message)
|
|
select call, message
|