Skip to content

Commit 58366b1

Browse files
jbjjbj
committed
C++: Path explanations in the last two queries
For some reason I thought that these two queries were special because they manipulate `SecurityOptions` to change the taint-tracking sources. It turns out it was just the opposite: the queries used to be special because they invalidated the cache for the `tainted` predicate, but that predicate is no longer used, so these queries are no longer special.
1 parent 54a23a4 commit 58366b1

File tree

3 files changed

+158
-31
lines changed

3 files changed

+158
-31
lines changed

‎cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Uncontrolled data in arithmetic expression
33
* @description Arithmetic operations on uncontrolled data that is not
44
* validated can cause overflows.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity warning
77
* @precision medium
88
* @id cpp/uncontrolled-arithmetic
@@ -15,6 +15,7 @@ import cpp
1515
import semmle.code.cpp.security.Overflow
1616
import semmle.code.cpp.security.Security
1717
import semmle.code.cpp.security.TaintTracking
18+
import TaintedWithPath
1819

1920
predicate isRandCall(FunctionCall fc) { fc.getTarget().getName() = "rand" }
2021

@@ -40,29 +41,40 @@ class SecurityOptionsArith extends SecurityOptions {
4041
}
4142
}
4243

43-
predicate taintedVarAccess(Expr origin, VariableAccess va) {
44-
isUserInput(origin, _) and
45-
tainted(origin, va)
44+
predicate isDiv(VariableAccess va) { exists(AssignDivExpr div | div.getLValue() = va) }
45+
46+
predicate missingGuard(VariableAccess va, string effect) {
47+
exists(Operation op | op.getAnOperand() = va |
48+
missingGuardAgainstUnderflow(op, va) and effect = "underflow"
49+
or
50+
missingGuardAgainstOverflow(op, va) and effect = "overflow"
51+
)
52+
}
53+
54+
class Configuration extends TaintTrackingConfiguration {
55+
override predicate isSink(Element e) {
56+
isDiv(e)
57+
or
58+
missingGuard(e, _)
59+
}
4660
}
4761

4862
/**
4963
* A value that undergoes division is likely to be bounded within a safe
5064
* range.
5165
*/
5266
predicate guardedByAssignDiv(Expr origin) {
53-
isUserInput(origin, _) and
54-
exists(AssignDivExpr div, VariableAccess va | tainted(origin, va) and div.getLValue() = va)
67+
exists(VariableAccess va |
68+
taintedWithPath(origin, va, _, _) and
69+
isDiv(va)
70+
)
5571
}
5672

57-
from Expr origin, Operation op, VariableAccess va, string effect
73+
from Expr origin, VariableAccess va, string effect, PathNode sourceNode, PathNode sinkNode
5874
where
59-
taintedVarAccess(origin, va) and
60-
op.getAnOperand() = va and
61-
(
62-
missingGuardAgainstUnderflow(op, va) and effect = "underflow"
63-
or
64-
missingGuardAgainstOverflow(op, va) and effect = "overflow"
65-
) and
75+
taintedWithPath(origin, va, sourceNode, sinkNode) and
76+
missingGuard(va, effect) and
6677
not guardedByAssignDiv(origin)
67-
select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
68-
origin, "Uncontrolled value"
78+
select va, sourceNode, sinkNode,
79+
"$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".", origin,
80+
"Uncontrolled value"

‎cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Cleartext storage of sensitive information in an SQLite database
33
* @description Storing sensitive information in a non-encrypted
44
* database can expose it to an attacker.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity warning
77
* @precision medium
88
* @id cpp/cleartext-storage-database
@@ -13,6 +13,7 @@
1313
import cpp
1414
import semmle.code.cpp.security.SensitiveExprs
1515
import semmle.code.cpp.security.TaintTracking
16+
import TaintedWithPath
1617

1718
class UserInputIsSensitiveExpr extends SecurityOptions {
1819
override predicate isUserInput(Expr expr, string cause) {
@@ -32,10 +33,21 @@ predicate sqlite_encryption_used() {
3233
any(FunctionCall fc).getTarget().getName().matches("sqlite%\\_key\\_%")
3334
}
3435

35-
from SensitiveExpr taintSource, Expr taintedArg, SqliteFunctionCall sqliteCall
36+
class Configuration extends TaintTrackingConfiguration {
37+
override predicate isSink(Element taintedArg) {
38+
exists(SqliteFunctionCall sqliteCall |
39+
taintedArg = sqliteCall.getASource() and
40+
not sqlite_encryption_used()
41+
)
42+
}
43+
}
44+
45+
from
46+
SensitiveExpr taintSource, Expr taintedArg, SqliteFunctionCall sqliteCall, PathNode sourceNode,
47+
PathNode sinkNode
3648
where
37-
tainted(taintSource, taintedArg) and
38-
taintedArg = sqliteCall.getASource() and
39-
not sqlite_encryption_used()
40-
select sqliteCall, "This SQLite call may store $@ in a non-encrypted SQLite database", taintSource,
49+
taintedWithPath(taintSource, taintedArg, sourceNode, sinkNode) and
50+
taintedArg = sqliteCall.getASource()
51+
select sqliteCall, sourceNode, sinkNode,
52+
"This SQLite call may store $@ in a non-encrypted SQLite database", taintSource,
4153
"sensitive information"

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected

Lines changed: 112 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,112 @@
1-
| test.c:21:17:21:17 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:18:13:18:16 | call to rand | Uncontrolled value |
2-
| test.c:35:5:35:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:34:13:34:18 | call to rand | Uncontrolled value |
3-
| test.c:40:5:40:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:39:13:39:21 | ... % ... | Uncontrolled value |
4-
| test.c:45:5:45:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:44:13:44:16 | call to rand | Uncontrolled value |
5-
| test.c:56:5:56:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:54:13:54:16 | call to rand | Uncontrolled value |
6-
| test.c:67:5:67:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:66:13:66:16 | call to rand | Uncontrolled value |
7-
| test.c:77:9:77:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:75:13:75:19 | ... ^ ... | Uncontrolled value |
8-
| test.c:100:5:100:5 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:99:14:99:19 | call to rand | Uncontrolled value |
9-
| test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value |
1+
edges
2+
| test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r |
3+
| test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r |
4+
| test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r |
5+
| test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r |
6+
| test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r |
7+
| test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r |
8+
| test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r |
9+
| test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r |
10+
| test.c:39:13:39:21 | ... % ... | test.c:40:5:40:5 | r |
11+
| test.c:39:13:39:21 | ... % ... | test.c:40:5:40:5 | r |
12+
| test.c:39:13:39:21 | ... % ... | test.c:40:5:40:5 | r |
13+
| test.c:39:13:39:21 | ... % ... | test.c:40:5:40:5 | r |
14+
| test.c:44:13:44:16 | call to rand | test.c:45:5:45:5 | r |
15+
| test.c:44:13:44:16 | call to rand | test.c:45:5:45:5 | r |
16+
| test.c:44:13:44:16 | call to rand | test.c:45:5:45:5 | r |
17+
| test.c:44:13:44:16 | call to rand | test.c:45:5:45:5 | r |
18+
| test.c:54:13:54:16 | call to rand | test.c:56:5:56:5 | r |
19+
| test.c:54:13:54:16 | call to rand | test.c:56:5:56:5 | r |
20+
| test.c:54:13:54:16 | call to rand | test.c:56:5:56:5 | r |
21+
| test.c:54:13:54:16 | call to rand | test.c:56:5:56:5 | r |
22+
| test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
23+
| test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
24+
| test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
25+
| test.c:60:13:60:16 | call to rand | test.c:61:5:61:5 | r |
26+
| test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
27+
| test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
28+
| test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
29+
| test.c:60:13:60:16 | call to rand | test.c:62:5:62:5 | r |
30+
| test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
31+
| test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
32+
| test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
33+
| test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r |
34+
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
35+
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
36+
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
37+
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
38+
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
39+
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
40+
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
41+
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
42+
| test.cpp:8:9:8:12 | Store | test.cpp:24:11:24:18 | call to get_rand |
43+
| test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
44+
| test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
45+
| test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
46+
| test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
47+
nodes
48+
| test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
49+
| test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
50+
| test.c:21:17:21:17 | r | semmle.label | r |
51+
| test.c:21:17:21:17 | r | semmle.label | r |
52+
| test.c:21:17:21:17 | r | semmle.label | r |
53+
| test.c:34:13:34:18 | call to rand | semmle.label | call to rand |
54+
| test.c:34:13:34:18 | call to rand | semmle.label | call to rand |
55+
| test.c:35:5:35:5 | r | semmle.label | r |
56+
| test.c:35:5:35:5 | r | semmle.label | r |
57+
| test.c:35:5:35:5 | r | semmle.label | r |
58+
| test.c:39:13:39:21 | ... % ... | semmle.label | ... % ... |
59+
| test.c:39:13:39:21 | ... % ... | semmle.label | ... % ... |
60+
| test.c:40:5:40:5 | r | semmle.label | r |
61+
| test.c:40:5:40:5 | r | semmle.label | r |
62+
| test.c:40:5:40:5 | r | semmle.label | r |
63+
| test.c:44:13:44:16 | call to rand | semmle.label | call to rand |
64+
| test.c:44:13:44:16 | call to rand | semmle.label | call to rand |
65+
| test.c:45:5:45:5 | r | semmle.label | r |
66+
| test.c:45:5:45:5 | r | semmle.label | r |
67+
| test.c:45:5:45:5 | r | semmle.label | r |
68+
| test.c:54:13:54:16 | call to rand | semmle.label | call to rand |
69+
| test.c:54:13:54:16 | call to rand | semmle.label | call to rand |
70+
| test.c:56:5:56:5 | r | semmle.label | r |
71+
| test.c:56:5:56:5 | r | semmle.label | r |
72+
| test.c:56:5:56:5 | r | semmle.label | r |
73+
| test.c:60:13:60:16 | call to rand | semmle.label | call to rand |
74+
| test.c:60:13:60:16 | call to rand | semmle.label | call to rand |
75+
| test.c:61:5:61:5 | r | semmle.label | r |
76+
| test.c:61:5:61:5 | r | semmle.label | r |
77+
| test.c:61:5:61:5 | r | semmle.label | r |
78+
| test.c:62:5:62:5 | r | semmle.label | r |
79+
| test.c:62:5:62:5 | r | semmle.label | r |
80+
| test.c:62:5:62:5 | r | semmle.label | r |
81+
| test.c:66:13:66:16 | call to rand | semmle.label | call to rand |
82+
| test.c:66:13:66:16 | call to rand | semmle.label | call to rand |
83+
| test.c:67:5:67:5 | r | semmle.label | r |
84+
| test.c:67:5:67:5 | r | semmle.label | r |
85+
| test.c:67:5:67:5 | r | semmle.label | r |
86+
| test.c:75:13:75:19 | ... ^ ... | semmle.label | ... ^ ... |
87+
| test.c:75:13:75:19 | ... ^ ... | semmle.label | ... ^ ... |
88+
| test.c:77:9:77:9 | r | semmle.label | r |
89+
| test.c:77:9:77:9 | r | semmle.label | r |
90+
| test.c:77:9:77:9 | r | semmle.label | r |
91+
| test.c:99:14:99:19 | call to rand | semmle.label | call to rand |
92+
| test.c:99:14:99:19 | call to rand | semmle.label | call to rand |
93+
| test.c:100:5:100:5 | r | semmle.label | r |
94+
| test.c:100:5:100:5 | r | semmle.label | r |
95+
| test.c:100:5:100:5 | r | semmle.label | r |
96+
| test.cpp:8:9:8:12 | Store | semmle.label | Store |
97+
| test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
98+
| test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
99+
| test.cpp:24:11:24:18 | call to get_rand | semmle.label | call to get_rand |
100+
| test.cpp:25:7:25:7 | r | semmle.label | r |
101+
| test.cpp:25:7:25:7 | r | semmle.label | r |
102+
| test.cpp:25:7:25:7 | r | semmle.label | r |
103+
#select
104+
| test.c:21:17:21:17 | r | test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:18:13:18:16 | call to rand | Uncontrolled value |
105+
| test.c:35:5:35:5 | r | test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:34:13:34:18 | call to rand | Uncontrolled value |
106+
| test.c:40:5:40:5 | r | test.c:39:13:39:21 | ... % ... | test.c:40:5:40:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:39:13:39:21 | ... % ... | Uncontrolled value |
107+
| test.c:45:5:45:5 | r | test.c:44:13:44:16 | call to rand | test.c:45:5:45:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:44:13:44:16 | call to rand | Uncontrolled value |
108+
| test.c:56:5:56:5 | r | test.c:54:13:54:16 | call to rand | test.c:56:5:56:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:54:13:54:16 | call to rand | Uncontrolled value |
109+
| test.c:67:5:67:5 | r | test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:66:13:66:16 | call to rand | Uncontrolled value |
110+
| test.c:77:9:77:9 | r | test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:75:13:75:19 | ... ^ ... | Uncontrolled value |
111+
| test.c:100:5:100:5 | r | test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:99:14:99:19 | call to rand | Uncontrolled value |
112+
| test.cpp:25:7:25:7 | r | test.cpp:8:9:8:12 | call to rand | test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value |

0 commit comments

Comments
 (0)