Skip to content

Commit 6333476

Browse files
jketemajketema
committed
C++: Rewrite cpp/path-injection to not use DefaultTaintTracking 
1 parent f3dca95 commit 6333476

File tree

3 files changed

+38
-29
lines changed

3 files changed

+38
-29
lines changed

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql‎

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,9 @@
1717
import cpp
1818
import semmle.code.cpp.security.FunctionWithWrappers
1919
import semmle.code.cpp.security.Security
20-
import semmle.code.cpp.security.TaintTracking
21-
import TaintedWithPath
20+
import semmle.code.cpp.ir.IR
21+
import semmle.code.cpp.ir.dataflow.TaintTracking
22+
import DataFlow::PathGraph
2223

2324
/**
2425
* A function for opening a file.
@@ -46,18 +47,42 @@ class FileFunction extends FunctionWithWrappers {
4647
override predicate interestingArg(int arg) { arg = 0 }
4748
}
4849

49-
class TaintedPathConfiguration extends TaintTrackingConfiguration {
50-
override predicate isSink(Element tainted) {
51-
exists(FileFunction fileFunction | fileFunction.outermostWrapperFunctionCall(tainted, _))
50+
Expr asSourceExpr(DataFlow::Node node) {
51+
result in [node.asConvertedExpr(), node.asDefiningArgument()]
52+
}
53+
54+
Expr asSinkExpr(DataFlow::Node node) {
55+
result = node.asConvertedExpr()
56+
or
57+
result =
58+
node.asOperand()
59+
.(SideEffectOperand)
60+
.getUse()
61+
.(ReadSideEffectInstruction)
62+
.getArgumentDef()
63+
.getUnconvertedResultExpression()
64+
}
65+
66+
class TaintedPathConfiguration extends TaintTracking::Configuration {
67+
TaintedPathConfiguration() { this = "TaintedPathConfiguration" }
68+
69+
override predicate isSource(DataFlow::Node node) { isUserInput(asSourceExpr(node), _) }
70+
71+
override predicate isSink(DataFlow::Node node) {
72+
exists(FileFunction fileFunction |
73+
fileFunction.outermostWrapperFunctionCall(asSinkExpr(node), _)
74+
)
5275
}
5376
}
5477

5578
from
56-
FileFunction fileFunction, Expr taintedArg, Expr taintSource, PathNode sourceNode,
57-
PathNode sinkNode, string taintCause, string callChain
79+
FileFunction fileFunction, Expr taintedArg, Expr taintSource, TaintedPathConfiguration cfg,
80+
DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode, string taintCause, string callChain
5881
where
82+
taintedArg = asSinkExpr(sinkNode.getNode()) and
5983
fileFunction.outermostWrapperFunctionCall(taintedArg, callChain) and
60-
taintedWithPath(taintSource, taintedArg, sourceNode, sinkNode) and
84+
cfg.hasFlowPath(sourceNode, sinkNode) and
85+
taintSource = asSourceExpr(sourceNode.getNode()) and
6186
isUserInput(taintSource, taintCause)
6287
select taintedArg, sourceNode, sinkNode,
6388
"This argument to a file access function is derived from $@ and then passed to " + callChain + ".",

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,11 @@
11
edges
2-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... |
3-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data |
4-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data |
5-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection |
6-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... |
7-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data |
82
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data |
93
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection |
10-
subpaths
114
nodes
12-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | semmle.label | ... + ... |
135
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | semmle.label | fgets output argument |
14-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... | semmle.label | (const char *)... |
15-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | semmle.label | data |
166
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | semmle.label | data |
177
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | semmle.label | data indirection |
8+
subpaths
189
#select
19-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |
10+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |
11+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,11 @@
11
edges
2-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | (const char *)... |
3-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | (const char *)... |
42
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
5-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
6-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
7-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
8-
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection |
93
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection |
10-
subpaths
114
nodes
125
| test.c:9:23:9:26 | argv | semmle.label | argv |
13-
| test.c:9:23:9:26 | argv | semmle.label | argv |
14-
| test.c:17:11:17:18 | (const char *)... | semmle.label | (const char *)... |
15-
| test.c:17:11:17:18 | fileName | semmle.label | fileName |
166
| test.c:17:11:17:18 | fileName | semmle.label | fileName |
177
| test.c:17:11:17:18 | fileName indirection | semmle.label | fileName indirection |
8+
subpaths
189
#select
1910
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (argv) |
11+
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (argv) |

0 commit comments

Comments
 (0)