Skip to content

Commit cbe330e

Browse files
MathiasVPMathiasVP
authored
Merge pull request #11693 from jketema/argv-param-flowsource
C++: Define the `argv` flow source in terms the input parameter
2 parents edc768b + 0c71047 commit cbe330e

File tree

15 files changed

+69
-47
lines changed

15 files changed

+69
-47
lines changed

‎cpp/ql/lib/change-notes/2022-12-19-argv-as-parameter-flowsource.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `ArgvSource` flow source now uses the second parameter of `main` as its source instead of the uses of this parameter.

‎cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ private class ArgvSource extends LocalFlowSource {
9292
exists(Function main, Parameter argv |
9393
main.hasGlobalName("main") and
9494
main.getParameter(1) = argv and
95-
this.asExpr() = argv.getAnAccess()
95+
this.asParameter() = argv
9696
)
9797
}
9898

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,6 @@ class TaintedPathConfiguration extends TaintTracking::Configuration {
9191
)
9292
}
9393

94-
override predicate isSanitizerIn(DataFlow::Node node) { this.isSource(node) }
95-
9694
override predicate isSanitizer(DataFlow::Node node) {
9795
node.asExpr().(Call).getTarget().getUnspecifiedType() instanceof ArithmeticType
9896
or

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.expected‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
edges
2-
| test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | (const char *)... |
3-
| test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | filePath |
2+
| test.cpp:22:27:22:30 | argv | test.cpp:29:13:29:20 | (const char *)... |
3+
| test.cpp:22:27:22:30 | argv | test.cpp:29:13:29:20 | filePath |
44
nodes
5-
| test.cpp:23:20:23:23 | argv | semmle.label | argv |
5+
| test.cpp:22:27:22:30 | argv | semmle.label | argv |
66
| test.cpp:29:13:29:20 | (const char *)... | semmle.label | (const char *)... |
77
| test.cpp:29:13:29:20 | filePath | semmle.label | filePath |
88
subpaths
99
#select
10-
| test.cpp:29:13:29:20 | (const char *)... | test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | (const char *)... | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
11-
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
10+
| test.cpp:29:13:29:20 | (const char *)... | test.cpp:22:27:22:30 | argv | test.cpp:29:13:29:20 | (const char *)... | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
11+
| test.cpp:29:13:29:20 | filePath | test.cpp:22:27:22:30 | argv | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,19 @@
11
edges
2-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection |
3-
| test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName indirection |
2+
| test.c:8:27:8:30 | argv | test.c:17:11:17:18 | fileName indirection |
3+
| test.c:8:27:8:30 | argv | test.c:32:11:32:18 | fileName indirection |
44
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | fileName indirection |
55
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName indirection |
66
nodes
7-
| test.c:9:23:9:26 | argv | semmle.label | argv |
7+
| test.c:8:27:8:30 | argv | semmle.label | argv |
88
| test.c:17:11:17:18 | fileName indirection | semmle.label | fileName indirection |
9-
| test.c:31:22:31:25 | argv | semmle.label | argv |
109
| test.c:32:11:32:18 | fileName indirection | semmle.label | fileName indirection |
1110
| test.c:37:17:37:24 | scanf output argument | semmle.label | scanf output argument |
1211
| test.c:38:11:38:18 | fileName indirection | semmle.label | fileName indirection |
1312
| test.c:43:17:43:24 | scanf output argument | semmle.label | scanf output argument |
1413
| test.c:44:11:44:18 | fileName indirection | semmle.label | fileName indirection |
1514
subpaths
1615
#select
17-
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (a command-line argument) |
18-
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv | user input (a command-line argument) |
16+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
17+
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv | test.c:32:11:32:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
1918
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
2019
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
edges
2-
| test.cpp:16:20:16:23 | argv | test.cpp:22:45:22:52 | userName indirection |
2+
| test.cpp:15:27:15:30 | argv | test.cpp:22:45:22:52 | userName indirection |
33
| test.cpp:22:13:22:20 | sprintf output argument | test.cpp:23:12:23:19 | command1 indirection |
44
| test.cpp:22:45:22:52 | userName indirection | test.cpp:22:13:22:20 | sprintf output argument |
55
| test.cpp:47:21:47:26 | call to getenv | test.cpp:50:35:50:43 | envCflags indirection |
@@ -74,7 +74,7 @@ edges
7474
| test.cpp:220:19:220:26 | filename indirection | test.cpp:220:10:220:16 | strncat output argument |
7575
| test.cpp:220:19:220:26 | filename indirection | test.cpp:220:10:220:16 | strncat output argument |
7676
nodes
77-
| test.cpp:16:20:16:23 | argv | semmle.label | argv |
77+
| test.cpp:15:27:15:30 | argv | semmle.label | argv |
7878
| test.cpp:22:13:22:20 | sprintf output argument | semmle.label | sprintf output argument |
7979
| test.cpp:22:45:22:52 | userName indirection | semmle.label | userName indirection |
8080
| test.cpp:23:12:23:19 | command1 indirection | semmle.label | command1 indirection |
@@ -161,7 +161,7 @@ subpaths
161161
| test.cpp:196:26:196:33 | filename indirection | test.cpp:186:47:186:54 | *filename | test.cpp:188:11:188:17 | command [post update] | test.cpp:196:10:196:16 | command [post update] |
162162
| test.cpp:196:26:196:33 | filename indirection | test.cpp:186:47:186:54 | *filename | test.cpp:188:11:188:17 | command [post update] | test.cpp:196:10:196:16 | command [post update] |
163163
#select
164-
| test.cpp:23:12:23:19 | command1 | test.cpp:16:20:16:23 | argv | test.cpp:23:12:23:19 | command1 indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:16:20:16:23 | argv | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
164+
| test.cpp:23:12:23:19 | command1 | test.cpp:15:27:15:30 | argv | test.cpp:23:12:23:19 | command1 indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:15:27:15:30 | argv | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
165165
| test.cpp:51:10:51:16 | command | test.cpp:47:21:47:26 | call to getenv | test.cpp:51:10:51:16 | command indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:47:21:47:26 | call to getenv | user input (an environment variable) | test.cpp:50:11:50:17 | sprintf output argument | sprintf output argument |
166166
| test.cpp:65:10:65:16 | command | test.cpp:62:9:62:16 | fread output argument | test.cpp:65:10:65:16 | command indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:62:9:62:16 | fread output argument | user input (string read by fread) | test.cpp:64:11:64:17 | strncat output argument | strncat output argument |
167167
| test.cpp:85:32:85:38 | command | test.cpp:82:9:82:16 | fread output argument | test.cpp:85:32:85:38 | command indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to execl. | test.cpp:82:9:82:16 | fread output argument | user input (string read by fread) | test.cpp:84:11:84:17 | strncat output argument | strncat output argument |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.expected‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
edges
2-
| overflowdestination.cpp:27:9:27:12 | argv | overflowdestination.cpp:30:17:30:20 | (const char *)... |
2+
| main.cpp:6:27:6:30 | argv | main.cpp:7:33:7:36 | argv |
3+
| main.cpp:6:27:6:30 | argv | main.cpp:7:33:7:36 | argv indirection |
4+
| main.cpp:7:33:7:36 | argv | overflowdestination.cpp:23:45:23:48 | argv |
5+
| main.cpp:7:33:7:36 | argv indirection | overflowdestination.cpp:23:45:23:48 | *argv |
6+
| overflowdestination.cpp:23:45:23:48 | *argv | overflowdestination.cpp:30:17:30:20 | (const char *)... |
7+
| overflowdestination.cpp:23:45:23:48 | argv | overflowdestination.cpp:30:17:30:20 | (const char *)... |
38
| overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | (const void *)... |
49
| overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:50:52:50:54 | ReturnIndirection |
510
| overflowdestination.cpp:50:52:50:54 | src | overflowdestination.cpp:53:15:53:17 | (const void *)... |
@@ -17,7 +22,11 @@ edges
1722
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:57:52:57:54 | src |
1823
| overflowdestination.cpp:76:30:76:32 | src indirection | overflowdestination.cpp:57:52:57:54 | *src |
1924
nodes
20-
| overflowdestination.cpp:27:9:27:12 | argv | semmle.label | argv |
25+
| main.cpp:6:27:6:30 | argv | semmle.label | argv |
26+
| main.cpp:7:33:7:36 | argv | semmle.label | argv |
27+
| main.cpp:7:33:7:36 | argv indirection | semmle.label | argv indirection |
28+
| overflowdestination.cpp:23:45:23:48 | *argv | semmle.label | *argv |
29+
| overflowdestination.cpp:23:45:23:48 | argv | semmle.label | argv |
2130
| overflowdestination.cpp:30:17:30:20 | (const char *)... | semmle.label | (const char *)... |
2231
| overflowdestination.cpp:43:8:43:10 | fgets output argument | semmle.label | fgets output argument |
2332
| overflowdestination.cpp:46:15:46:17 | (const void *)... | semmle.label | (const void *)... |
@@ -37,7 +46,7 @@ nodes
3746
subpaths
3847
| overflowdestination.cpp:75:30:75:32 | src indirection | overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:50:52:50:54 | ReturnIndirection | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
3948
#select
40-
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv | overflowdestination.cpp:30:17:30:20 | (const char *)... | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
49+
| overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | argv | overflowdestination.cpp:30:17:30:20 | (const char *)... | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
4150
| overflowdestination.cpp:46:2:46:7 | call to memcpy | overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | (const void *)... | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
4251
| overflowdestination.cpp:53:2:53:7 | call to memcpy | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:53:15:53:17 | (const void *)... | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
4352
| overflowdestination.cpp:64:2:64:7 | call to memcpy | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:64:16:64:19 | (const void *)... | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/main.cpp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
int overflowdesination_main(int argc, char **argv);
2+
int test_buffer_overrun_main(int argc, char **argv);
3+
int tests_restrict_main(int argc, char **argv);
4+
int tests_main(int argc, char **argv);
5+
6+
int main(int argc, char **argv) {
7+
overflowdesination_main(argc, argv);
8+
test_buffer_overrun_main(argc, argv);
9+
tests_restrict_main(argc, argv);
10+
tests_main(argc, argv);
11+
return 0;
12+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/overflowdestination.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ inline size_t min(size_t a, size_t b) {
2020
}
2121
}
2222

23-
int main(int argc, char* argv[]) {
23+
int overflowdesination_main(int argc, char* argv[]) {
2424
char param[20];
2525
char *arg1;
2626

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ void test_buffer_overrun_in_while_loop_using_array_indexing()
2929
}
3030
}
3131

32-
int main(int argc, char *argv[])
32+
int test_buffer_overrun_main(int argc, char *argv[])
3333
{
3434
test_buffer_overrun_in_for_loop();
3535
test_buffer_overrun_in_while_loop_using_pointer_arithmetic();

0 commit comments

Comments
 (0)