Skip to content

Commit 00ba76b

Browse files
geoffw0geoffw0
committed
C++: Convert to IR taint tracking.
1 parent 85d03fd commit 00ba76b

File tree

3 files changed

+51
-13
lines changed

3 files changed

+51
-13
lines changed

‎cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
import cpp
1616
import semmle.code.cpp.commons.Environment
17-
import semmle.code.cpp.dataflow.TaintTracking
17+
import semmle.code.cpp.ir.dataflow.TaintTracking
1818
import semmle.code.cpp.models.interfaces.FlowSource
1919
import DataFlow::PathGraph
2020

‎cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected

Lines changed: 49 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,64 @@
11
edges
2-
| tests2.cpp:76:18:76:38 | call to mysql_get_client_info | tests2.cpp:79:14:79:19 | buffer |
3-
| tests2.cpp:107:3:107:4 | c1 [post update] [ptr] | tests2.cpp:109:14:109:15 | c1 [ptr] |
4-
| tests2.cpp:107:3:107:36 | ... = ... | tests2.cpp:107:3:107:4 | c1 [post update] [ptr] |
5-
| tests2.cpp:107:12:107:17 | call to getenv | tests2.cpp:107:3:107:36 | ... = ... |
6-
| tests2.cpp:109:14:109:15 | c1 [ptr] | tests2.cpp:109:17:109:19 | ptr |
2+
| tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:26 | (const char *)... |
3+
| tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:26 | (const char *)... |
4+
| tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:26 | (const char *)... |
5+
| tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:26 | (const char *)... |
6+
| tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:26 | (const char *)... |
7+
| tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:26 | (const char *)... |
8+
| tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:26 | (const char *)... |
9+
| tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:26 | (const char *)... |
10+
| tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:30 | (const char *)... |
11+
| tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:30 | (const char *)... |
12+
| tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:30 | (const char *)... |
13+
| tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:30 | (const char *)... |
14+
| tests2.cpp:76:18:76:38 | call to mysql_get_client_info | tests2.cpp:79:14:79:19 | (const char *)... |
15+
| tests2.cpp:78:14:78:34 | call to mysql_get_client_info | tests2.cpp:78:14:78:34 | call to mysql_get_client_info |
16+
| tests2.cpp:78:14:78:34 | call to mysql_get_client_info | tests2.cpp:78:14:78:34 | call to mysql_get_client_info |
17+
| tests2.cpp:89:42:89:45 | str1 | tests2.cpp:91:14:91:17 | str1 |
18+
| tests2.cpp:107:3:107:4 | c1 [post update] [ptr] | tests2.cpp:109:14:109:15 | c1 [read] [ptr] |
19+
| tests2.cpp:107:6:107:8 | ptr [post update] | tests2.cpp:107:3:107:4 | c1 [post update] [ptr] |
20+
| tests2.cpp:107:12:107:17 | call to getenv | tests2.cpp:107:6:107:8 | ptr [post update] |
21+
| tests2.cpp:109:14:109:15 | c1 [read] [ptr] | tests2.cpp:109:14:109:19 | (const char *)... |
722
nodes
823
| tests2.cpp:63:13:63:18 | call to getenv | semmle.label | call to getenv |
24+
| tests2.cpp:63:13:63:18 | call to getenv | semmle.label | call to getenv |
25+
| tests2.cpp:63:13:63:26 | (const char *)... | semmle.label | (const char *)... |
26+
| tests2.cpp:63:13:63:26 | (const char *)... | semmle.label | (const char *)... |
27+
| tests2.cpp:64:13:64:18 | call to getenv | semmle.label | call to getenv |
928
| tests2.cpp:64:13:64:18 | call to getenv | semmle.label | call to getenv |
29+
| tests2.cpp:64:13:64:26 | (const char *)... | semmle.label | (const char *)... |
30+
| tests2.cpp:64:13:64:26 | (const char *)... | semmle.label | (const char *)... |
31+
| tests2.cpp:65:13:65:18 | call to getenv | semmle.label | call to getenv |
1032
| tests2.cpp:65:13:65:18 | call to getenv | semmle.label | call to getenv |
33+
| tests2.cpp:65:13:65:30 | (const char *)... | semmle.label | (const char *)... |
34+
| tests2.cpp:65:13:65:30 | (const char *)... | semmle.label | (const char *)... |
1135
| tests2.cpp:76:18:76:38 | call to mysql_get_client_info | semmle.label | call to mysql_get_client_info |
1236
| tests2.cpp:78:14:78:34 | call to mysql_get_client_info | semmle.label | call to mysql_get_client_info |
13-
| tests2.cpp:79:14:79:19 | buffer | semmle.label | buffer |
37+
| tests2.cpp:78:14:78:34 | call to mysql_get_client_info | semmle.label | call to mysql_get_client_info |
38+
| tests2.cpp:79:14:79:19 | (const char *)... | semmle.label | (const char *)... |
39+
| tests2.cpp:89:42:89:45 | str1 | semmle.label | str1 |
40+
| tests2.cpp:91:14:91:17 | str1 | semmle.label | str1 |
1441
| tests2.cpp:107:3:107:4 | c1 [post update] [ptr] | semmle.label | c1 [post update] [ptr] |
15-
| tests2.cpp:107:3:107:36 | ... = ... | semmle.label | ... = ... |
42+
| tests2.cpp:107:6:107:8 | ptr [post update] | semmle.label | ptr [post update] |
1643
| tests2.cpp:107:12:107:17 | call to getenv | semmle.label | call to getenv |
17-
| tests2.cpp:109:14:109:15 | c1 [ptr] | semmle.label | c1 [ptr] |
18-
| tests2.cpp:109:17:109:19 | ptr | semmle.label | ptr |
44+
| tests2.cpp:109:14:109:15 | c1 [read] [ptr] | semmle.label | c1 [read] [ptr] |
45+
| tests2.cpp:109:14:109:19 | (const char *)... | semmle.label | (const char *)... |
1946
subpaths
2047
#select
2148
| tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:63:13:63:18 | call to getenv | call to getenv |
49+
| tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:26 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:63:13:63:18 | call to getenv | call to getenv |
50+
| tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:26 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:63:13:63:26 | (const char *)... | (const char *)... |
51+
| tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:26 | (const char *)... | tests2.cpp:63:13:63:26 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:63:13:63:26 | (const char *)... | (const char *)... |
2252
| tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:64:13:64:18 | call to getenv | call to getenv |
53+
| tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:26 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:64:13:64:18 | call to getenv | call to getenv |
54+
| tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:26 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:64:13:64:26 | (const char *)... | (const char *)... |
55+
| tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:26 | (const char *)... | tests2.cpp:64:13:64:26 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:64:13:64:26 | (const char *)... | (const char *)... |
2356
| tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:65:13:65:18 | call to getenv | call to getenv |
57+
| tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:30 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:65:13:65:18 | call to getenv | call to getenv |
58+
| tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:30 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:65:13:65:30 | (const char *)... | (const char *)... |
59+
| tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:30 | (const char *)... | tests2.cpp:65:13:65:30 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:65:13:65:30 | (const char *)... | (const char *)... |
60+
| tests2.cpp:78:14:78:34 | call to mysql_get_client_info | tests2.cpp:78:14:78:34 | call to mysql_get_client_info | tests2.cpp:78:14:78:34 | call to mysql_get_client_info | This operation exposes system data from $@. | tests2.cpp:78:14:78:34 | call to mysql_get_client_info | call to mysql_get_client_info |
2461
| tests2.cpp:78:14:78:34 | call to mysql_get_client_info | tests2.cpp:78:14:78:34 | call to mysql_get_client_info | tests2.cpp:78:14:78:34 | call to mysql_get_client_info | This operation exposes system data from $@. | tests2.cpp:78:14:78:34 | call to mysql_get_client_info | call to mysql_get_client_info |
25-
| tests2.cpp:79:14:79:19 | buffer | tests2.cpp:76:18:76:38 | call to mysql_get_client_info | tests2.cpp:79:14:79:19 | buffer | This operation exposes system data from $@. | tests2.cpp:76:18:76:38 | call to mysql_get_client_info | call to mysql_get_client_info |
26-
| tests2.cpp:109:17:109:19 | ptr | tests2.cpp:107:12:107:17 | call to getenv | tests2.cpp:109:17:109:19 | ptr | This operation exposes system data from $@. | tests2.cpp:107:12:107:17 | call to getenv | call to getenv |
62+
| tests2.cpp:79:14:79:19 | (const char *)... | tests2.cpp:76:18:76:38 | call to mysql_get_client_info | tests2.cpp:79:14:79:19 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:76:18:76:38 | call to mysql_get_client_info | call to mysql_get_client_info |
63+
| tests2.cpp:91:14:91:17 | str1 | tests2.cpp:89:42:89:45 | str1 | tests2.cpp:91:14:91:17 | str1 | This operation exposes system data from $@. | tests2.cpp:89:42:89:45 | str1 | str1 |
64+
| tests2.cpp:109:14:109:19 | (const char *)... | tests2.cpp:107:12:107:17 | call to getenv | tests2.cpp:109:14:109:19 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:107:12:107:17 | call to getenv | call to getenv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ void test1()
8888

8989
mysql_real_connect(sock, val(), val(), str1, val(), val(), val(), val());
9090

91-
send(sock, str1, val(), val()); // BAD [NOT DETECTED]
91+
send(sock, str1, val(), val()); // BAD
9292
send(sock, str2, val(), val()); // GOOD: not system data
9393
}
9494

0 commit comments

Comments
 (0)