Skip to content

Commit 138975e

Browse files
geoffw0geoffw0
committed
C++: Add ZMQ summary models.
1 parent 783ce48 commit 138975e

File tree

4 files changed

+40
-11
lines changed

4 files changed

+40
-11
lines changed

‎cpp/ql/lib/semmle/code/cpp/models/implementations/ZMQ.qll

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@ private class ZmqSource extends SourceModelCsv {
1111
override predicate row(string row) {
1212
row =
1313
[
14-
";;false;zmq_recv;;;Argument[*1];remote",
15-
";;false;zmq_recvmsg;;;Argument[*1];remote",
14+
";;false;zmq_recv;;;Argument[*1];remote", ";;false;zmq_recvmsg;;;Argument[*1];remote",
1615
";;false;zmq_msg_recv;;;Argument[*0];remote",
1716
]
1817
}
@@ -26,9 +25,21 @@ private class ZmqSinks extends SinkModelCsv {
2625
row =
2726
[
2827
";;false;zmq_send;;;Argument[*1];remote-sink",
29-
";;false;zmq_msg_init_data;;;Argument[*1];remote-sink",
3028
";;false;zmq_sendmsg;;;Argument[*1];remote-sink",
3129
";;false;zmq_msg_send;;;Argument[*0];remote-sink",
3230
]
3331
}
3432
}
33+
34+
/**
35+
* Flow steps.
36+
*/
37+
private class ZmqSummaries extends SummaryModelCsv {
38+
override predicate row(string row) {
39+
row =
40+
[
41+
";;false;zmq_msg_init_data;;;Argument[*1];Argument[*0];taint",
42+
";;false;zmq_msg_data;;;Argument[*0];ReturnValue[*];taint",
43+
]
44+
}
45+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/zmq.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ void test_zmc(void *socket, char *message_data, size_t message_len) {
2626
sink(message_data); // $ ast,ir
2727

2828
if (zmq_msg_init_data(&message, message_data, message_len, 0, 0)) {
29-
sink(message); // $ ast MISSING: ir
30-
sink(zmq_msg_data(&message)); // $ MISSING: ast,ir
29+
sink(message); // $ ast,ir
30+
sink(zmq_msg_data(&message)); // $ ir MISSING: ast
3131
}
3232
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,15 @@ edges
1010
| tests2.cpp:111:14:111:15 | *c1 [*ptr] | tests2.cpp:111:14:111:19 | *ptr | provenance | |
1111
| tests2.cpp:111:14:111:15 | *c1 [*ptr] | tests2.cpp:111:17:111:19 | *ptr | provenance | |
1212
| tests2.cpp:111:17:111:19 | *ptr | tests2.cpp:111:14:111:19 | *ptr | provenance | |
13+
| tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | tests2.cpp:120:5:120:21 | [summary] to write: Argument[0 indirection] in zmq_msg_init_data | provenance | |
1314
| tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:138:23:138:34 | *message_data | provenance | |
1415
| tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:143:34:143:45 | *message_data | provenance | |
16+
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:144:33:144:40 | *& ... | provenance | |
17+
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:147:20:147:27 | *& ... | provenance | |
18+
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:155:32:155:39 | *& ... | provenance | |
19+
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:158:20:158:27 | *& ... | provenance | |
20+
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | provenance | |
21+
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | provenance | |
1522
| tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:39:19:39:22 | *path | provenance | |
1623
| tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:43:20:43:23 | *path | provenance | |
1724
| tests_sockets.cpp:63:15:63:20 | *call to getenv | tests_sockets.cpp:76:19:76:22 | *path | provenance | |
@@ -38,9 +45,16 @@ nodes
3845
| tests2.cpp:111:14:111:15 | *c1 [*ptr] | semmle.label | *c1 [*ptr] |
3946
| tests2.cpp:111:14:111:19 | *ptr | semmle.label | *ptr |
4047
| tests2.cpp:111:17:111:19 | *ptr | semmle.label | *ptr |
48+
| tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | semmle.label | [summary param] 1 indirection in zmq_msg_init_data |
49+
| tests2.cpp:120:5:120:21 | [summary] to write: Argument[0 indirection] in zmq_msg_init_data | semmle.label | [summary] to write: Argument[0 indirection] in zmq_msg_init_data |
4150
| tests2.cpp:134:17:134:22 | *call to getenv | semmle.label | *call to getenv |
4251
| tests2.cpp:138:23:138:34 | *message_data | semmle.label | *message_data |
52+
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | semmle.label | zmq_msg_init_data output argument |
4353
| tests2.cpp:143:34:143:45 | *message_data | semmle.label | *message_data |
54+
| tests2.cpp:144:33:144:40 | *& ... | semmle.label | *& ... |
55+
| tests2.cpp:147:20:147:27 | *& ... | semmle.label | *& ... |
56+
| tests2.cpp:155:32:155:39 | *& ... | semmle.label | *& ... |
57+
| tests2.cpp:158:20:158:27 | *& ... | semmle.label | *& ... |
4458
| tests_sockets.cpp:26:15:26:20 | *call to getenv | semmle.label | *call to getenv |
4559
| tests_sockets.cpp:39:19:39:22 | *path | semmle.label | *path |
4660
| tests_sockets.cpp:43:20:43:23 | *path | semmle.label | *path |
@@ -50,6 +64,7 @@ nodes
5064
| tests_sysconf.cpp:36:21:36:27 | confstr output argument | semmle.label | confstr output argument |
5165
| tests_sysconf.cpp:39:19:39:25 | *pathbuf | semmle.label | *pathbuf |
5266
subpaths
67+
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | tests2.cpp:120:5:120:21 | [summary] to write: Argument[0 indirection] in zmq_msg_init_data | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument |
5368
#select
5469
| tests2.cpp:63:13:63:26 | *call to getenv | tests2.cpp:63:13:63:26 | *call to getenv | tests2.cpp:63:13:63:26 | *call to getenv | This operation exposes system data from $@. | tests2.cpp:63:13:63:26 | *call to getenv | *call to getenv |
5570
| tests2.cpp:64:13:64:26 | *call to getenv | tests2.cpp:64:13:64:26 | *call to getenv | tests2.cpp:64:13:64:26 | *call to getenv | This operation exposes system data from $@. | tests2.cpp:64:13:64:26 | *call to getenv | *call to getenv |
@@ -62,7 +77,10 @@ subpaths
6277
| tests2.cpp:102:14:102:15 | *pw | tests2.cpp:101:8:101:15 | *call to getpwuid | tests2.cpp:102:14:102:15 | *pw | This operation exposes system data from $@. | tests2.cpp:101:8:101:15 | *call to getpwuid | *call to getpwuid |
6378
| tests2.cpp:111:14:111:19 | *ptr | tests2.cpp:109:12:109:17 | *call to getenv | tests2.cpp:111:14:111:19 | *ptr | This operation exposes system data from $@. | tests2.cpp:109:12:109:17 | *call to getenv | *call to getenv |
6479
| tests2.cpp:138:23:138:34 | *message_data | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:138:23:138:34 | *message_data | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv |
65-
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:143:34:143:45 | *message_data | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv |
80+
| tests2.cpp:144:33:144:40 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:144:33:144:40 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv |
81+
| tests2.cpp:147:20:147:27 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:147:20:147:27 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv |
82+
| tests2.cpp:155:32:155:39 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:155:32:155:39 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv |
83+
| tests2.cpp:158:20:158:27 | *& ... | tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:158:20:158:27 | *& ... | This operation exposes system data from $@. | tests2.cpp:134:17:134:22 | *call to getenv | *call to getenv |
6684
| tests_sockets.cpp:39:19:39:22 | *path | tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:39:19:39:22 | *path | This operation exposes system data from $@. | tests_sockets.cpp:26:15:26:20 | *call to getenv | *call to getenv |
6785
| tests_sockets.cpp:43:20:43:23 | *path | tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:43:20:43:23 | *path | This operation exposes system data from $@. | tests_sockets.cpp:26:15:26:20 | *call to getenv | *call to getenv |
6886
| tests_sockets.cpp:76:19:76:22 | *path | tests_sockets.cpp:63:15:63:20 | *call to getenv | tests_sockets.cpp:76:19:76:22 | *path | This operation exposes system data from $@. | tests_sockets.cpp:63:15:63:20 | *call to getenv | *call to getenv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -140,22 +140,22 @@ void test_zmq(void *remoteSocket)
140140
}
141141

142142
// send as message
143-
if (zmq_msg_init_data(&message, message_data, message_len, 0, 0)) { // (detected here)
144-
if (zmq_sendmsg(remoteSocket, &message, message_len)) { // BAD: outputs HOME environment variable (detected above)
143+
if (zmq_msg_init_data(&message, message_data, message_len, 0, 0)) {
144+
if (zmq_sendmsg(remoteSocket, &message, message_len)) { // BAD: outputs HOME environment variable
145145
// ...
146146
}
147-
if (zmq_msg_send(&message, remoteSocket, message_len)) { // BAD: outputs HOME environment variable (detected above)
147+
if (zmq_msg_send(&message, remoteSocket, message_len)) { // BAD: outputs HOME environment variable
148148
// ...
149149
}
150150
}
151151

152152
// send as message (alternative path)
153153
if (zmq_msg_init_size(&message, message_len) == 0) {
154154
memcpy(zmq_msg_data(&message), message_data, message_len);
155-
if (zmq_sendmsg(remoteSocket,&message, message_len)) { // BAD: outputs HOME environment variable [NOT DETECTED]
155+
if (zmq_sendmsg(remoteSocket,&message, message_len)) { // BAD: outputs HOME environment variable
156156
// ...
157157
}
158-
if (zmq_msg_send(&message, remoteSocket, message_len)) { // BAD: outputs HOME environment variable [NOT DETECTED]
158+
if (zmq_msg_send(&message, remoteSocket, message_len)) { // BAD: outputs HOME environment variable
159159
// ...
160160
}
161161
}

0 commit comments

Comments
 (0)