Merge pull request #13 from github/s-samadi/banned

Add the queries defined in the Banned package for the C language.

Author: rvermeulen

.vscode/tasks.json

@@ -163,6 +163,7 @@
             "type": "pickString",
             "options": [
                 "Allocations",
+                "Banned",
                 "BannedFunctions",
                 "BannedSyntax",
                 "BannedTypes",

c/cert/src/rules/ENV33-C/DoNotCallSystem.md

@@ -0,0 +1,23 @@
+/**
+ * @id c/cert/do-not-call-system
+ * @name ENV33-C: Do not call 'system'
+ * @description Use of the 'system' function may result in exploitable vulnerabilities.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/cert/id/env33-c
+ *       security
+ *       external/cert/obligtion/rule
+ */
+
+import cpp
+import codingstandards.c.cert
+import semmle.code.cpp.security.CommandExecution
+
+from FunctionCall call, SystemFunction target
+where
+  not isExcluded(call, BannedPackage::doNotCallSystemQuery()) and
+  call.getTarget() = target and
+  // Exclude calls to `system` with a `NULL` pointer, because it is allowed to determine the presence of a command processor.
+  (target.getName() = "system" implies not call.getAnArgument().(Literal).getValue() = "0")
+select call, "Call to banned function $@.", target, target.getName()

c/cert/src/rules/ENV33-C/DoNotCallSystem.ql

@@ -0,0 +1,5 @@
+| test.c:10:3:10:8 | call to system | Call to banned function $@. | test.c:4:5:4:10 | system | system |
+| test.c:12:8:12:12 | call to popen | Call to banned function $@. | test.c:6:7:6:11 | popen | popen |
+| test.c:20:3:20:8 | call to system | Call to banned function $@. | test.c:4:5:4:10 | system | system |
+| test.c:21:3:21:8 | call to system | Call to banned function $@. | test.c:4:5:4:10 | system | system |
+| test.c:22:3:22:7 | call to popen | Call to banned function $@. | test.c:6:7:6:11 | popen | popen |

c/cert/test/rules/ENV33-C/DoNotCallSystem.expected

@@ -0,0 +1 @@
+rules/ENV33-C/DoNotCallSystem.ql

c/cert/test/rules/ENV33-C/DoNotCallSystem.qlref

@@ -0,0 +1 @@
+c/common/test/rules/systemused/SystemUsed.ql

c/cert/test/rules/ENV33-C/DoNotCallSystem.testref

@@ -0,0 +1,23 @@
+typedef struct _FILE FILE;
+#define NULL (void *)0
+
+int system(const char *);
+void abort(void);
+FILE *popen(const char *, const char *);
+
+void f1(const char *p1) {
+  FILE *l1;
+  system(p1); // NON_COMPLIANT
+  abort();
+  l1 = popen("ls *", "r"); // NON_COMPLIANT
+}
+
+void f2() {
+  const int *l1 = NULL;
+
+  system(0);         // COMPLIANT
+  system(NULL);      // COMPLIANT
+  system(l1);        // NON_COMPLIANT
+  system("ls -la");  // NON_COMPLIANT
+  popen(NULL, NULL); // NON_COMPLIANT
+}

c/cert/test/rules/ENV33-C/test.c

@@ -9,10 +9,10 @@ extern "C" {
 
 #include <bits/alltypes.h>
 
-#define va_start(v,l)   __builtin_va_start(v,l)
-#define va_end(v)       __builtin_va_end(v)
-#define va_arg(v,l)     __builtin_va_arg(v,l)
-#define va_copy(d,s)    __builtin_va_copy(d,s)
+#define va_start(v, l) __builtin_va_start(v, l)
+#define va_end(v) __builtin_va_end(v)
+#define va_arg(v, l) __builtin_va_arg(v, l)
+#define va_copy(d, s) __builtin_va_copy(d, s)
 
 #ifdef __cplusplus
 }

c/common/test/includes/standard-library/stdarg.h

@@ -0,0 +1 @@
+| test.c:6:13:6:22 | ... , ... | Use of banned ',' expression. |

c/common/test/rules/commaoperatorused/CommaOperatorUsed.expected

@@ -0,0 +1,2 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.commaoperatorused.CommaOperatorUsed