Skip to content

Commit b9bdee6

Browse files
asgerfasgerf
authored
Merge branch 'main' into post-release-prep/codeql-cli-2.10.1
2 parents 0ee4761 + bfe9041 commit b9bdee6

File tree

123 files changed

+2658
-293
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

123 files changed

+2658
-293
lines changed

‎.github/workflows/ql-for-ql-build.yml

Lines changed: 20 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,10 @@ env:
1010
CARGO_TERM_COLOR: always
1111

1212
jobs:
13-
queries:
14-
runs-on: ubuntu-latest
13+
analyze:
14+
runs-on: ubuntu-latest-xl
1515
steps:
16+
### Build the queries ###
1617
- uses: actions/checkout@v3
1718
- name: Find codeql
1819
id: find-codeql
@@ -48,11 +49,7 @@ jobs:
4849
name: query-pack-zip
4950
path: ${{ runner.temp }}/query-pack.zip
5051

51-
extractors:
52-
runs-on: ubuntu-latest
53-
54-
steps:
55-
- uses: actions/checkout@v3
52+
### Build the extractor ###
5653
- name: Cache entire extractor
5754
id: cache-extractor
5855
uses: actions/cache@v3
@@ -96,15 +93,8 @@ jobs:
9693
ql/target/release/ql-extractor
9794
ql/target/release/ql-extractor.exe
9895
retention-days: 1
99-
package:
100-
runs-on: ubuntu-latest
101-
102-
needs:
103-
- extractors
104-
- queries
10596

106-
steps:
107-
- uses: actions/checkout@v3
97+
### Package the queries and extractor ###
10898
- uses: actions/download-artifact@v3
10999
with:
110100
name: query-pack-zip
@@ -132,16 +122,8 @@ jobs:
132122
name: codeql-ql-pack
133123
path: codeql-ql.zip
134124
retention-days: 1
135-
analyze:
136-
runs-on: ubuntu-latest
137-
strategy:
138-
matrix:
139-
folder: [cpp, csharp, java, javascript, python, ql, ruby, swift, go]
140-
141-
needs:
142-
- package
143125

144-
steps:
126+
### Run the analysis ###
145127
- name: Download pack
146128
uses: actions/download-artifact@v3
147129
with:
@@ -161,22 +143,18 @@ jobs:
161143
env:
162144
PACK: ${{ runner.temp }}/pack
163145

164-
- name: Checkout repository
165-
uses: actions/checkout@v3
166146
- name: Create CodeQL config file
167147
run: |
168-
echo "paths:" > ${CONF}
169-
echo " - ${FOLDER}" >> ${CONF}
170148
echo "paths-ignore:" >> ${CONF}
171149
echo " - ql/ql/test" >> ${CONF}
150+
echo " - \"*/ql/lib/upgrades/\"" >> ${CONF}
172151
echo "disable-default-queries: true" >> ${CONF}
173152
echo "packs:" >> ${CONF}
174153
echo " - codeql/ql" >> ${CONF}
175154
echo "Config file: "
176155
cat ${CONF}
177156
env:
178157
CONF: ./ql-for-ql-config.yml
179-
FOLDER: ${{ matrix.folder }}
180158
- name: Initialize CodeQL
181159
uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980
182160
with:
@@ -187,39 +165,24 @@ jobs:
187165
- name: Perform CodeQL Analysis
188166
uses: github/codeql-action/analyze@aa93aea877e5fb8841bcb1193f672abf6e9f2980
189167
with:
190-
category: "ql-for-ql-${{ matrix.folder }}"
168+
category: "ql-for-ql"
191169
- name: Copy sarif file to CWD
192-
run: cp ../results/ql.sarif ./${{ matrix.folder }}.sarif
170+
run: cp ../results/ql.sarif ./ql-for-ql.sarif
193171
- name: Fixup the $scema in sarif # Until https://github.com/microsoft/sarif-vscode-extension/pull/436/ is part in a stable release
194172
run: |
195-
sed -i 's/\$schema.*/\$schema": "https:\/\/raw.githubusercontent.com\/oasis-tcs\/sarif-spec\/master\/Schemata\/sarif-schema-2.1.0",/' ${{ matrix.folder }}.sarif
173+
sed -i 's/\$schema.*/\$schema": "https:\/\/raw.githubusercontent.com\/oasis-tcs\/sarif-spec\/master\/Schemata\/sarif-schema-2.1.0",/' ql-for-ql.sarif
196174
- name: Sarif as artifact
197175
uses: actions/upload-artifact@v3
198176
with:
199-
name: ${{ matrix.folder }}.sarif
200-
path: ${{ matrix.folder }}.sarif
201-
202-
combine:
203-
runs-on: ubuntu-latest
204-
needs:
205-
- analyze
206-
207-
steps:
208-
- uses: actions/checkout@v3
209-
- name: Make a folder for artifacts.
210-
run: mkdir -p results
211-
- name: Download all sarif files
212-
uses: actions/download-artifact@v3
213-
with:
214-
path: results
215-
- uses: actions/setup-node@v3
216-
with:
217-
node-version: 16
218-
- name: Combine all sarif files
219-
run: |
220-
node ./ql/scripts/merge-sarif.js results/**/*.sarif combined.sarif
221-
- name: Upload combined sarif file
177+
name: ql-for-ql.sarif
178+
path: ql-for-ql.sarif
179+
- name: Split out the sarif file into langs
180+
run: |
181+
mkdir split-sarif
182+
node ./ql/scripts/split-sarif.js ql-for-ql.sarif split-sarif
183+
- name: Upload langs as artifacts
222184
uses: actions/upload-artifact@v3
223185
with:
224-
name: combined.sarif
225-
path: combined.sarif
186+
name: ql-for-ql-langs
187+
path: split-sarif
188+
retention-days: 1

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.cs

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
2+
{
3+
SymmetricKey aesKey = new SymmetricKey(kid: "symencryptionkey");
4+
5+
// BAD: Using the outdated client side encryption version V1_0
6+
BlobEncryptionPolicy uploadPolicy = new BlobEncryptionPolicy(key: aesKey, keyResolver: null);
7+
BlobRequestOptions uploadOptions = new BlobRequestOptions() { EncryptionPolicy = uploadPolicy };
8+
9+
MemoryStream stream = new MemoryStream(buffer);
10+
blob.UploadFromStream(stream, length: size, accessCondition: null, options: uploadOptions);
11+
}
12+
13+
var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions()
14+
{
15+
// BAD: Using an outdated SDK that does not support client side encryption version V2_0
16+
ClientSideEncryption = new ClientSideEncryptionOptions()
17+
{
18+
KeyEncryptionKey = myKey,
19+
KeyResolver = myKeyResolver,
20+
KeyWrapAlgorihm = myKeyWrapAlgorithm
21+
}
22+
});
23+
24+
var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions()
25+
{
26+
// BAD: Using the outdated client side encryption version V1_0
27+
ClientSideEncryption = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V1_0)
28+
{
29+
KeyEncryptionKey = myKey,
30+
KeyResolver = myKeyResolver,
31+
KeyWrapAlgorihm = myKeyWrapAlgorithm
32+
}
33+
});
34+
35+
var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions()
36+
{
37+
// GOOD: Using client side encryption version V2_0
38+
ClientSideEncryption = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V2_0)
39+
{
40+
KeyEncryptionKey = myKey,
41+
KeyResolver = myKeyResolver,
42+
KeyWrapAlgorihm = myKeyWrapAlgorithm
43+
}
44+
});

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.qhelp

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
4+
5+
<overview>
6+
<p>Azure Storage .NET, Java, and Python SDKs support encryption on the client with a customer-managed key that is maintained in Azure Key Vault or another key store.</p>
7+
<p>Current release versions of the Azure Storage SDKs use cipher block chaining (CBC mode) for client-side encryption (referred to as <code>v1</code>).</p>
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>Consider switching to <code>v2</code> client-side encryption.</p>
13+
14+
</recommendation>
15+
<example>
16+
17+
<sample src="UnsafeUsageOfClientSideEncryptionVersion.cs" />
18+
19+
</example>
20+
<references>
21+
<li>
22+
<a href="http://aka.ms/azstorageclientencryptionblog">Azure Storage Client Encryption Blog.</a>
23+
</li>
24+
<li>
25+
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30187">CVE-2022-30187</a>
26+
</li>
27+
28+
</references>
29+
</qhelp>

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
/**
2+
* @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187).
3+
* @description Unsafe usage of v1 version of Azure Storage client-side encryption, please refer to http://aka.ms/azstorageclientencryptionblog
4+
* @kind problem
5+
* @tags security
6+
* cryptography
7+
* external/cwe/cwe-327
8+
* @id cs/azure-storage/unsafe-usage-of-client-side-encryption-version
9+
* @problem.severity error
10+
* @precision high
11+
*/
12+
13+
import csharp
14+
15+
/**
16+
* Holds if `oc` is creating an object of type `c` = `Azure.Storage.ClientSideEncryptionOptions`
17+
* and `e` is the `version` argument to the constructor
18+
*/
19+
predicate isCreatingAzureClientSideEncryptionObject(ObjectCreation oc, Class c, Expr e) {
20+
exists(Parameter p | p.hasName("version") |
21+
c.hasQualifiedName("Azure.Storage.ClientSideEncryptionOptions") and
22+
oc.getTarget() = c.getAConstructor() and
23+
e = oc.getArgumentForParameter(p)
24+
)
25+
}
26+
27+
/**
28+
* Holds if `oc` is an object creation of the outdated type `c` = `Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy`
29+
*/
30+
predicate isCreatingOutdatedAzureClientSideEncryptionObject(ObjectCreation oc, Class c) {
31+
c.hasQualifiedName("Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy") and
32+
oc.getTarget() = c.getAConstructor()
33+
}
34+
35+
/**
36+
* Holds if the Azure.Storage assembly for `c` is a version known to support
37+
* version 2+ for client-side encryption
38+
*/
39+
predicate doesAzureStorageAssemblySupportSafeClientSideEncryption(Assembly asm) {
40+
exists(int versionCompare |
41+
versionCompare = asm.getVersion().compareTo("12.12.0.0") and
42+
versionCompare >= 0
43+
) and
44+
asm.getName() = "Azure.Storage.Common"
45+
}
46+
47+
/**
48+
* Holds if the Azure.Storage assembly for `c` is a version known to support
49+
* version 2+ for client-side encryption and if the argument for the constructor `version`
50+
* is set to a secure value.
51+
*/
52+
predicate isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(Expr versionExpr, Assembly asm) {
53+
// Check if the Azure.Storage assembly version has the fix
54+
doesAzureStorageAssemblySupportSafeClientSideEncryption(asm) and
55+
// and that the version argument for the constructor is guaranteed to be Version2
56+
isExprAnAccessToSafeClientSideEncryptionVersionValue(versionExpr)
57+
}
58+
59+
/**
60+
* Holds if the expression `e` is an access to a safe version of the enum `ClientSideEncryptionVersion`
61+
* or an equivalent numeric value
62+
*/
63+
predicate isExprAnAccessToSafeClientSideEncryptionVersionValue(Expr e) {
64+
exists(EnumConstant ec |
65+
ec.hasQualifiedName("Azure.Storage.ClientSideEncryptionVersion.V2_0") and
66+
ec.getAnAccess() = e
67+
)
68+
}
69+
70+
from Expr e, Class c, Assembly asm
71+
where
72+
asm = c.getLocation() and
73+
(
74+
exists(Expr e2 |
75+
isCreatingAzureClientSideEncryptionObject(e, c, e2) and
76+
not isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(e2, asm)
77+
)
78+
or
79+
isCreatingOutdatedAzureClientSideEncryptionObject(e, c)
80+
)
81+
select e, "Unsafe usage of v1 version of Azure Storage client-side encryption."

‎docs/codeql/query-help/cpp.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@ CodeQL query help for C and C++
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/cpp/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/cpp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/examples>`__.
79

810
.. include:: toc-cpp.rst
911

‎docs/codeql/query-help/csharp.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for C#
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/csharp/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/csharp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/examples>`__.
79

810
.. include:: toc-csharp.rst

‎docs/codeql/query-help/go.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Go
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/go/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/go-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/examples>`__.
79

810
.. include:: toc-go.rst

‎docs/codeql/query-help/java.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Java
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/java/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/java-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/examples>`__.
79

810
.. include:: toc-java.rst

‎docs/codeql/query-help/javascript.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for JavaScript
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/javascript/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/javascript-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/examples>`__.
79

810
.. include:: toc-javascript.rst

‎docs/codeql/query-help/python.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Python
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/python/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/python-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/examples>`__.
79

810
.. include:: toc-python.rst

0 commit comments

Comments
 (0)