Skip to content

Commit 0031ed3

Browse files
geoffw0geoffw0
committed
C++: Additional test cases.
1 parent 5ee9684 commit 0031ed3

File tree

2 files changed

+232
-0
lines changed

2 files changed

+232
-0
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,88 @@ edges
6565
| test3.cpp:217:30:217:37 | password | test3.cpp:219:15:219:26 | password_ptr |
6666
| test3.cpp:217:30:217:37 | password | test3.cpp:219:36:219:47 | password_ptr |
6767
| test3.cpp:241:8:241:15 | password | test3.cpp:242:8:242:15 | password |
68+
| test3.cpp:254:15:254:23 | password1 | test3.cpp:256:3:256:19 | call to decrypt_to_buffer |
69+
| test3.cpp:254:15:254:23 | password1 | test3.cpp:256:21:256:29 | password1 |
70+
| test3.cpp:254:15:254:23 | password1 | test3.cpp:256:21:256:29 | password1 |
71+
| test3.cpp:256:21:256:29 | password1 | test3.cpp:256:3:256:19 | call to decrypt_to_buffer |
72+
| test3.cpp:256:32:256:40 | password2 | test3.cpp:256:3:256:19 | call to decrypt_to_buffer |
73+
| test3.cpp:262:21:262:29 | password1 | test3.cpp:262:3:262:19 | call to encrypt_to_buffer |
74+
| test3.cpp:262:32:262:40 | password2 | test3.cpp:262:3:262:19 | call to encrypt_to_buffer |
75+
| test3.cpp:262:32:262:40 | password2 | test3.cpp:264:15:264:23 | password2 |
76+
| test3.cpp:262:32:262:40 | password2 | test3.cpp:264:33:264:41 | password2 |
77+
| test3.cpp:270:16:270:23 | password | test3.cpp:272:15:272:18 | data |
78+
| test3.cpp:278:20:278:23 | data | test3.cpp:278:20:278:23 | data |
79+
| test3.cpp:278:20:278:23 | data | test3.cpp:280:14:280:17 | data |
80+
| test3.cpp:283:20:283:23 | data | test3.cpp:283:20:283:23 | data |
81+
| test3.cpp:283:20:283:23 | data | test3.cpp:285:14:285:17 | data |
82+
| test3.cpp:288:20:288:23 | data | test3.cpp:288:20:288:23 | data |
83+
| test3.cpp:288:20:288:23 | data | test3.cpp:290:14:290:17 | data |
84+
| test3.cpp:293:20:293:23 | data | test3.cpp:293:20:293:23 | data |
85+
| test3.cpp:293:20:293:23 | data | test3.cpp:295:14:295:17 | data |
86+
| test3.cpp:298:20:298:23 | data | test3.cpp:300:14:300:17 | data |
87+
| test3.cpp:312:19:312:26 | password | test3.cpp:312:3:312:17 | call to encrypt_inplace |
88+
| test3.cpp:312:19:312:26 | password | test3.cpp:313:11:313:18 | password |
89+
| test3.cpp:312:19:312:26 | password | test3.cpp:313:11:313:18 | password |
90+
| test3.cpp:312:19:312:26 | password | test3.cpp:314:11:314:18 | password |
91+
| test3.cpp:312:19:312:26 | password | test3.cpp:314:11:314:18 | password |
92+
| test3.cpp:312:19:312:26 | password | test3.cpp:322:16:322:23 | password |
93+
| test3.cpp:312:19:312:26 | password | test3.cpp:322:16:322:23 | password |
94+
| test3.cpp:312:19:312:26 | password | test3.cpp:324:11:324:14 | data |
95+
| test3.cpp:312:19:312:26 | password | test3.cpp:325:11:325:14 | data |
96+
| test3.cpp:313:11:313:18 | password | test3.cpp:278:20:278:23 | data |
97+
| test3.cpp:313:11:313:18 | password | test3.cpp:313:11:313:18 | ref arg password |
98+
| test3.cpp:313:11:313:18 | password | test3.cpp:314:11:314:18 | password |
99+
| test3.cpp:313:11:313:18 | password | test3.cpp:314:11:314:18 | password |
100+
| test3.cpp:313:11:313:18 | password | test3.cpp:322:16:322:23 | password |
101+
| test3.cpp:313:11:313:18 | password | test3.cpp:322:16:322:23 | password |
102+
| test3.cpp:313:11:313:18 | password | test3.cpp:324:11:324:14 | data |
103+
| test3.cpp:313:11:313:18 | password | test3.cpp:325:11:325:14 | data |
104+
| test3.cpp:313:11:313:18 | ref arg password | test3.cpp:314:11:314:18 | password |
105+
| test3.cpp:313:11:313:18 | ref arg password | test3.cpp:314:11:314:18 | password |
106+
| test3.cpp:313:11:313:18 | ref arg password | test3.cpp:322:16:322:23 | password |
107+
| test3.cpp:313:11:313:18 | ref arg password | test3.cpp:322:16:322:23 | password |
108+
| test3.cpp:313:11:313:18 | ref arg password | test3.cpp:324:11:324:14 | data |
109+
| test3.cpp:313:11:313:18 | ref arg password | test3.cpp:325:11:325:14 | data |
110+
| test3.cpp:314:11:314:18 | password | test3.cpp:283:20:283:23 | data |
111+
| test3.cpp:314:11:314:18 | password | test3.cpp:314:11:314:18 | ref arg password |
112+
| test3.cpp:314:11:314:18 | password | test3.cpp:322:16:322:23 | password |
113+
| test3.cpp:314:11:314:18 | password | test3.cpp:322:16:322:23 | password |
114+
| test3.cpp:314:11:314:18 | password | test3.cpp:324:11:324:14 | data |
115+
| test3.cpp:314:11:314:18 | password | test3.cpp:325:11:325:14 | data |
116+
| test3.cpp:314:11:314:18 | ref arg password | test3.cpp:322:16:322:23 | password |
117+
| test3.cpp:314:11:314:18 | ref arg password | test3.cpp:322:16:322:23 | password |
118+
| test3.cpp:314:11:314:18 | ref arg password | test3.cpp:324:11:324:14 | data |
119+
| test3.cpp:314:11:314:18 | ref arg password | test3.cpp:325:11:325:14 | data |
120+
| test3.cpp:316:11:316:18 | password | test3.cpp:283:20:283:23 | data |
121+
| test3.cpp:316:11:316:18 | password | test3.cpp:316:11:316:18 | ref arg password |
122+
| test3.cpp:316:11:316:18 | password | test3.cpp:317:11:317:18 | password |
123+
| test3.cpp:316:11:316:18 | password | test3.cpp:317:11:317:18 | password |
124+
| test3.cpp:316:11:316:18 | password | test3.cpp:322:16:322:23 | password |
125+
| test3.cpp:316:11:316:18 | password | test3.cpp:322:16:322:23 | password |
126+
| test3.cpp:316:11:316:18 | password | test3.cpp:324:11:324:14 | data |
127+
| test3.cpp:316:11:316:18 | password | test3.cpp:325:11:325:14 | data |
128+
| test3.cpp:316:11:316:18 | ref arg password | test3.cpp:317:11:317:18 | password |
129+
| test3.cpp:316:11:316:18 | ref arg password | test3.cpp:317:11:317:18 | password |
130+
| test3.cpp:316:11:316:18 | ref arg password | test3.cpp:322:16:322:23 | password |
131+
| test3.cpp:316:11:316:18 | ref arg password | test3.cpp:322:16:322:23 | password |
132+
| test3.cpp:316:11:316:18 | ref arg password | test3.cpp:324:11:324:14 | data |
133+
| test3.cpp:316:11:316:18 | ref arg password | test3.cpp:325:11:325:14 | data |
134+
| test3.cpp:317:11:317:18 | password | test3.cpp:288:20:288:23 | data |
135+
| test3.cpp:317:11:317:18 | password | test3.cpp:317:11:317:18 | ref arg password |
136+
| test3.cpp:317:11:317:18 | password | test3.cpp:322:16:322:23 | password |
137+
| test3.cpp:317:11:317:18 | password | test3.cpp:322:16:322:23 | password |
138+
| test3.cpp:317:11:317:18 | password | test3.cpp:324:11:324:14 | data |
139+
| test3.cpp:317:11:317:18 | password | test3.cpp:325:11:325:14 | data |
140+
| test3.cpp:317:11:317:18 | ref arg password | test3.cpp:322:16:322:23 | password |
141+
| test3.cpp:317:11:317:18 | ref arg password | test3.cpp:322:16:322:23 | password |
142+
| test3.cpp:317:11:317:18 | ref arg password | test3.cpp:324:11:324:14 | data |
143+
| test3.cpp:317:11:317:18 | ref arg password | test3.cpp:325:11:325:14 | data |
144+
| test3.cpp:322:16:322:23 | password | test3.cpp:324:11:324:14 | data |
145+
| test3.cpp:322:16:322:23 | password | test3.cpp:325:11:325:14 | data |
146+
| test3.cpp:324:11:324:14 | data | test3.cpp:293:20:293:23 | data |
147+
| test3.cpp:324:11:324:14 | data | test3.cpp:324:11:324:14 | ref arg data |
148+
| test3.cpp:324:11:324:14 | ref arg data | test3.cpp:325:11:325:14 | data |
149+
| test3.cpp:325:11:325:14 | data | test3.cpp:298:20:298:23 | data |
68150
| test.cpp:48:29:48:39 | thePassword | test.cpp:48:21:48:27 | call to encrypt |
69151
| test.cpp:58:11:58:16 | passwd | test.cpp:61:11:61:16 | passwd |
70152
| test.cpp:76:29:76:39 | thePassword | test.cpp:76:21:76:27 | call to encrypt |
@@ -178,6 +260,57 @@ nodes
178260
| test3.cpp:241:8:241:15 | password | semmle.label | password |
179261
| test3.cpp:241:8:241:15 | password | semmle.label | password |
180262
| test3.cpp:242:8:242:15 | password | semmle.label | password |
263+
| test3.cpp:254:15:254:23 | password1 | semmle.label | password1 |
264+
| test3.cpp:254:15:254:23 | password1 | semmle.label | password1 |
265+
| test3.cpp:256:3:256:19 | call to decrypt_to_buffer | semmle.label | call to decrypt_to_buffer |
266+
| test3.cpp:256:21:256:29 | password1 | semmle.label | password1 |
267+
| test3.cpp:256:21:256:29 | password1 | semmle.label | password1 |
268+
| test3.cpp:256:32:256:40 | password2 | semmle.label | password2 |
269+
| test3.cpp:256:32:256:40 | password2 | semmle.label | password2 |
270+
| test3.cpp:262:3:262:19 | call to encrypt_to_buffer | semmle.label | call to encrypt_to_buffer |
271+
| test3.cpp:262:21:262:29 | password1 | semmle.label | password1 |
272+
| test3.cpp:262:21:262:29 | password1 | semmle.label | password1 |
273+
| test3.cpp:262:32:262:40 | password2 | semmle.label | password2 |
274+
| test3.cpp:262:32:262:40 | password2 | semmle.label | password2 |
275+
| test3.cpp:264:15:264:23 | password2 | semmle.label | password2 |
276+
| test3.cpp:264:33:264:41 | password2 | semmle.label | password2 |
277+
| test3.cpp:270:16:270:23 | password | semmle.label | password |
278+
| test3.cpp:270:16:270:23 | password | semmle.label | password |
279+
| test3.cpp:272:15:272:18 | data | semmle.label | data |
280+
| test3.cpp:278:20:278:23 | data | semmle.label | data |
281+
| test3.cpp:278:20:278:23 | data | semmle.label | data |
282+
| test3.cpp:280:14:280:17 | data | semmle.label | data |
283+
| test3.cpp:283:20:283:23 | data | semmle.label | data |
284+
| test3.cpp:283:20:283:23 | data | semmle.label | data |
285+
| test3.cpp:285:14:285:17 | data | semmle.label | data |
286+
| test3.cpp:288:20:288:23 | data | semmle.label | data |
287+
| test3.cpp:288:20:288:23 | data | semmle.label | data |
288+
| test3.cpp:290:14:290:17 | data | semmle.label | data |
289+
| test3.cpp:293:20:293:23 | data | semmle.label | data |
290+
| test3.cpp:293:20:293:23 | data | semmle.label | data |
291+
| test3.cpp:295:14:295:17 | data | semmle.label | data |
292+
| test3.cpp:298:20:298:23 | data | semmle.label | data |
293+
| test3.cpp:300:14:300:17 | data | semmle.label | data |
294+
| test3.cpp:312:3:312:17 | call to encrypt_inplace | semmle.label | call to encrypt_inplace |
295+
| test3.cpp:312:19:312:26 | password | semmle.label | password |
296+
| test3.cpp:312:19:312:26 | password | semmle.label | password |
297+
| test3.cpp:313:11:313:18 | password | semmle.label | password |
298+
| test3.cpp:313:11:313:18 | password | semmle.label | password |
299+
| test3.cpp:313:11:313:18 | ref arg password | semmle.label | ref arg password |
300+
| test3.cpp:314:11:314:18 | password | semmle.label | password |
301+
| test3.cpp:314:11:314:18 | password | semmle.label | password |
302+
| test3.cpp:314:11:314:18 | ref arg password | semmle.label | ref arg password |
303+
| test3.cpp:316:11:316:18 | password | semmle.label | password |
304+
| test3.cpp:316:11:316:18 | password | semmle.label | password |
305+
| test3.cpp:316:11:316:18 | ref arg password | semmle.label | ref arg password |
306+
| test3.cpp:317:11:317:18 | password | semmle.label | password |
307+
| test3.cpp:317:11:317:18 | password | semmle.label | password |
308+
| test3.cpp:317:11:317:18 | ref arg password | semmle.label | ref arg password |
309+
| test3.cpp:322:16:322:23 | password | semmle.label | password |
310+
| test3.cpp:322:16:322:23 | password | semmle.label | password |
311+
| test3.cpp:324:11:324:14 | data | semmle.label | data |
312+
| test3.cpp:324:11:324:14 | ref arg data | semmle.label | ref arg data |
313+
| test3.cpp:325:11:325:14 | data | semmle.label | data |
181314
| test.cpp:45:9:45:19 | thePassword | semmle.label | thePassword |
182315
| test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
183316
| test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
@@ -193,6 +326,11 @@ nodes
193326
| test.cpp:76:29:76:39 | thePassword | semmle.label | thePassword |
194327
subpaths
195328
| test3.cpp:138:24:138:32 | password1 | test3.cpp:117:28:117:33 | buffer | test3.cpp:119:9:119:14 | buffer | test3.cpp:138:21:138:22 | call to id |
329+
| test3.cpp:313:11:313:18 | password | test3.cpp:278:20:278:23 | data | test3.cpp:278:20:278:23 | data | test3.cpp:313:11:313:18 | ref arg password |
330+
| test3.cpp:314:11:314:18 | password | test3.cpp:283:20:283:23 | data | test3.cpp:283:20:283:23 | data | test3.cpp:314:11:314:18 | ref arg password |
331+
| test3.cpp:316:11:316:18 | password | test3.cpp:283:20:283:23 | data | test3.cpp:283:20:283:23 | data | test3.cpp:316:11:316:18 | ref arg password |
332+
| test3.cpp:317:11:317:18 | password | test3.cpp:288:20:288:23 | data | test3.cpp:288:20:288:23 | data | test3.cpp:317:11:317:18 | ref arg password |
333+
| test3.cpp:324:11:324:14 | data | test3.cpp:293:20:293:23 | data | test3.cpp:293:20:293:23 | data | test3.cpp:324:11:324:14 | ref arg data |
196334
#select
197335
| test3.cpp:22:3:22:6 | call to send | test3.cpp:22:15:22:23 | password1 | test3.cpp:22:15:22:23 | password1 | This operation transmits 'password1', which may contain unencrypted sensitive data from $@ | test3.cpp:22:15:22:23 | password1 | password1 |
198336
| test3.cpp:26:3:26:6 | call to send | test3.cpp:26:15:26:23 | password2 | test3.cpp:26:15:26:23 | password2 | This operation transmits 'password2', which may contain unencrypted sensitive data from $@ | test3.cpp:26:15:26:23 | password2 | password2 |
@@ -209,3 +347,8 @@ subpaths
209347
| test3.cpp:228:2:228:5 | call to send | test3.cpp:228:26:228:33 | password | test3.cpp:228:26:228:33 | password | This operation transmits 'password', which may contain unencrypted sensitive data from $@ | test3.cpp:228:26:228:33 | password | password |
210348
| test3.cpp:241:2:241:6 | call to fgets | test3.cpp:241:8:241:15 | password | test3.cpp:241:8:241:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:241:8:241:15 | password | password |
211349
| test3.cpp:242:2:242:6 | call to fgets | test3.cpp:241:8:241:15 | password | test3.cpp:242:8:242:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:241:8:241:15 | password | password |
350+
| test3.cpp:272:3:272:6 | call to send | test3.cpp:270:16:270:23 | password | test3.cpp:272:15:272:18 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:270:16:270:23 | password | password |
351+
| test3.cpp:285:2:285:5 | call to send | test3.cpp:316:11:316:18 | password | test3.cpp:285:14:285:17 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:316:11:316:18 | password | password |
352+
| test3.cpp:290:2:290:5 | call to send | test3.cpp:316:11:316:18 | password | test3.cpp:290:14:290:17 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:316:11:316:18 | password | password |
353+
| test3.cpp:295:2:295:5 | call to send | test3.cpp:316:11:316:18 | password | test3.cpp:295:14:295:17 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:316:11:316:18 | password | password |
354+
| test3.cpp:300:2:300:5 | call to send | test3.cpp:316:11:316:18 | password | test3.cpp:300:14:300:17 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:316:11:316:18 | password | password |

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,3 +241,92 @@ void test_fgets(FILE *stream)
241241
fgets(password, 128, stream); // BAD
242242
fgets(password, 128, STDIN_STREAM); // GOOD: `STDIN_STREAM` is probably standard input [FALSE POSITIVE]
243243
}
244+
245+
void encrypt_to_buffer(const char *input, char* output);
246+
void decrypt_to_buffer(const char *input, char* output);
247+
char *strcpy(char *s1, const char *s2);
248+
249+
void test_crypt_more()
250+
{
251+
{
252+
char password1[256], password2[256];
253+
254+
recv(val(), password1, 256, val()); // GOOD: password is encrypted
255+
256+
decrypt_to_buffer(password1, password2); // proof that `password1` was in fact encrypted
257+
}
258+
259+
{
260+
char password1[256], password2[256];
261+
262+
encrypt_to_buffer(password1, password2); // proof that `password2` is in fact encrypted
263+
264+
send(val(), password2, strlen(password2), val()); // GOOD: password is encrypted
265+
}
266+
267+
{
268+
char data[256], password[256];
269+
270+
strcpy(data, password); // not proof of anything
271+
272+
send(val(), data, strlen(data), val()); // BAD: password is sent plaintext
273+
}
274+
}
275+
276+
bool cond();
277+
278+
void target1(char *data)
279+
{
280+
send(val(), data, strlen(data), val()); // GOOD: encrypted
281+
}
282+
283+
void target2(char *data)
284+
{
285+
send(val(), data, strlen(data), val()); // BAD: from one source this is a plaintext password
286+
}
287+
288+
void target3(char *data)
289+
{
290+
send(val(), data, strlen(data), val()); // BAD: data is a plaintext password
291+
}
292+
293+
void target4(char *data)
294+
{
295+
send(val(), data, strlen(data), val()); // BAD: data is a plaintext password
296+
}
297+
298+
void target5(char *data)
299+
{
300+
send(val(), data, strlen(data), val()); // BAD: from one source this is a plaintext password
301+
}
302+
303+
void target6(char *data)
304+
{
305+
send(val(), data, strlen(data), val()); // GOOD: not a password
306+
}
307+
308+
void test_multiple_sources_source(char *password)
309+
{
310+
if (cond())
311+
{
312+
encrypt_inplace(password);
313+
target1(password);
314+
target2(password);
315+
} else {
316+
target2(password);
317+
target3(password);
318+
}
319+
320+
if (cond())
321+
{
322+
char *data = password;
323+
324+
target4(data);
325+
target5(data);
326+
} else {
327+
char *data = "harmless";
328+
329+
target5(data);
330+
target6(data);
331+
}
332+
}

0 commit comments

Comments
 (0)