mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
4dd07f475b
An auto-generated patch that enables diff-informed data flow in the obvious cases. Builds on https://github.com/github/codeql/pull/18342 and https://github.com/github/codeql-patch/pull/88
58 lines
1.8 KiB
Plaintext
58 lines
1.8 KiB
Plaintext
/**
|
|
* @name XML external entity expansion
|
|
* @description Parsing user-controlled XML documents and allowing expansion of
|
|
* external entity references may lead to disclosure of
|
|
* confidential data or denial of service.
|
|
* @kind path-problem
|
|
* @id cpp/external-entity-expansion
|
|
* @problem.severity warning
|
|
* @security-severity 9.1
|
|
* @precision high
|
|
* @tags security
|
|
* external/cwe/cwe-611
|
|
*/
|
|
|
|
import cpp
|
|
import XML
|
|
import XxeFlow::PathGraph
|
|
|
|
/**
|
|
* A configuration for tracking XML objects and their states.
|
|
*/
|
|
module XxeConfig implements DataFlow::StateConfigSig {
|
|
class FlowState = TXxeFlowState;
|
|
|
|
predicate isSource(DataFlow::Node node, FlowState flowstate) {
|
|
any(XmlLibrary l).configurationSource(node, flowstate)
|
|
}
|
|
|
|
predicate isSink(DataFlow::Node node, FlowState flowstate) {
|
|
any(XmlLibrary l).configurationSink(node, flowstate)
|
|
}
|
|
|
|
predicate isAdditionalFlowStep(
|
|
DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
|
|
) {
|
|
// create additional flow steps for `XxeFlowStateTransformer`s
|
|
state2 = node2.asIndirectExpr().(XxeFlowStateTransformer).transform(state1) and
|
|
DataFlow::simpleLocalFlowStep(node1, node2, _)
|
|
}
|
|
|
|
predicate isBarrier(DataFlow::Node node, FlowState flowstate) {
|
|
// when the flowstate is transformed at a call node, block the original
|
|
// flowstate value.
|
|
node.asIndirectExpr().(XxeFlowStateTransformer).transform(flowstate) != flowstate
|
|
}
|
|
|
|
predicate neverSkip(DataFlow::Node node) { none() }
|
|
|
|
predicate observeDiffInformedIncrementalMode() { any() }
|
|
}
|
|
|
|
module XxeFlow = DataFlow::GlobalWithState<XxeConfig>;
|
|
|
|
from XxeFlow::PathNode source, XxeFlow::PathNode sink
|
|
where XxeFlow::flowPath(source, sink)
|
|
select sink, source, sink,
|
|
"This $@ is not configured to prevent an XML external entity (XXE) attack.", source, "XML parser"
|