Skip to content

Commit 54b3262

Browse files
geoffw0geoffw0
authored
Merge pull request #11891 from geoffw0/authbypass
C++: Fix issue with cpp/user-controlled-bypass
2 parents babdee3 + d628cc5 commit 54b3262

File tree

3 files changed

+69
-65
lines changed

3 files changed

+69
-65
lines changed

‎cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql

Lines changed: 13 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -15,76 +15,24 @@
1515
import semmle.code.cpp.ir.dataflow.internal.DefaultTaintTrackingImpl
1616
import TaintedWithPath
1717

18+
string getATopLevelDomain() {
19+
result =
20+
[
21+
"com", "ru", "net", "org", "de", "jp", "uk", "br", "pl", "in", "it", "fr", "au", "info", "nl",
22+
"cn", "ir", "es", "cz", "biz", "ca", "eu", "ua", "kr", "za", "co", "gr", "ro", "se", "tw",
23+
"vn", "mx", "ch", "tr", "at", "be", "hu", "tv", "dk", "me", "ar", "us", "no", "sk", "fi",
24+
"id", "cl", "nz", "by", "xyz", "pt", "ie", "il", "kz", "my", "hk", "lt", "cc", "sg", "io",
25+
"edu", "gov"
26+
]
27+
}
28+
1829
predicate hardCodedAddressOrIP(StringLiteral txt) {
1930
exists(string s | s = txt.getValueText() |
2031
// Hard-coded ip addresses, such as 127.0.0.1
2132
s.regexpMatch("\"[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+\"") or
2233
// Hard-coded addresses such as www.mycompany.com
23-
s.matches("\"www.%\"") or
24-
s.matches("\"http:%\"") or
25-
s.matches("\"https:%\"") or
26-
s.matches("\"%.com\"") or
27-
s.matches("\"%.ru\"") or
28-
s.matches("\"%.net\"") or
29-
s.matches("\"%.org\"") or
30-
s.matches("\"%.de\"") or
31-
s.matches("\"%.jp\"") or
32-
s.matches("\"%.uk\"") or
33-
s.matches("\"%.br\"") or
34-
s.matches("\"%.pl\"") or
35-
s.matches("\"%.in\"") or
36-
s.matches("\"%.it\"") or
37-
s.matches("\"%.fr\"") or
38-
s.matches("\"%.au\"") or
39-
s.matches("\"%.info\"") or
40-
s.matches("\"%.nl\"") or
41-
s.matches("\"%.cn\"") or
42-
s.matches("\"%.ir\"") or
43-
s.matches("\"%.es\"") or
44-
s.matches("\"%.cz\"") or
45-
s.matches("\"%.biz\"") or
46-
s.matches("\"%.ca\"") or
47-
s.matches("\"%.eu\"") or
48-
s.matches("\"%.ua\"") or
49-
s.matches("\"%.kr\"") or
50-
s.matches("\"%.za\"") or
51-
s.matches("\"%.co\"") or
52-
s.matches("\"%.gr\"") or
53-
s.matches("\"%.ro\"") or
54-
s.matches("\"%.se\"") or
55-
s.matches("\"%.tw\"") or
56-
s.matches("\"%.vn\"") or
57-
s.matches("\"%.mx\"") or
58-
s.matches("\"%.ch\"") or
59-
s.matches("\"%.tr\"") or
60-
s.matches("\"%.at\"") or
61-
s.matches("\"%.be\"") or
62-
s.matches("\"%.hu\"") or
63-
s.matches("\"%.tv\"") or
64-
s.matches("\"%.dk\"") or
65-
s.matches("\"%.me\"") or
66-
s.matches("\"%.ar\"") or
67-
s.matches("\"%.us\"") or
68-
s.matches("\"%.no\"") or
69-
s.matches("\"%.sk\"") or
70-
s.matches("\"%.fi\"") or
71-
s.matches("\"%.id\"") or
72-
s.matches("\"%.cl\"") or
73-
s.matches("\"%.nz\"") or
74-
s.matches("\"%.by\"") or
75-
s.matches("\"%.xyz\"") or
76-
s.matches("\"%.pt\"") or
77-
s.matches("\"%.ie\"") or
78-
s.matches("\"%.il\"") or
79-
s.matches("\"%.kz\"") or
80-
s.matches("\"%.my\"") or
81-
s.matches("\"%.hk\"") or
82-
s.matches("\"%.lt\"") or
83-
s.matches("\"%.cc\"") or
84-
s.matches("\"%.sg\"") or
85-
s.matches("\"%.io\"") or
86-
s.matches("\"%.edu\"") or
87-
s.matches("\"%.gov\"")
34+
s.regexpMatch("\"(www\\.|http:|https:).*\"") or
35+
s.regexpMatch("\".*\\.(" + strictconcat(getATopLevelDomain(), "|") + ")\"")
8836
)
8937
}
9038

‎cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.expected

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,24 @@ edges
1717
| test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address |
1818
| test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address |
1919
| test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address indirection |
20+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address |
21+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address |
22+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address indirection |
23+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address |
24+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address |
25+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address indirection |
26+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address |
27+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address |
28+
| test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address indirection |
29+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:52:14:52:20 | address |
30+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:52:14:52:20 | address |
31+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:52:14:52:20 | address indirection |
32+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:56:14:56:20 | address |
33+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:56:14:56:20 | address |
34+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:56:14:56:20 | address indirection |
35+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:60:14:60:20 | address |
36+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:60:14:60:20 | address |
37+
| test.cpp:49:25:49:42 | (const char *)... | test.cpp:60:14:60:20 | address indirection |
2038
subpaths
2139
nodes
2240
| test.cpp:16:25:16:30 | call to getenv | semmle.label | call to getenv |
@@ -34,7 +52,21 @@ nodes
3452
| test.cpp:42:14:42:20 | address | semmle.label | address |
3553
| test.cpp:42:14:42:20 | address | semmle.label | address |
3654
| test.cpp:42:14:42:20 | address indirection | semmle.label | address indirection |
55+
| test.cpp:49:25:49:30 | call to getenv | semmle.label | call to getenv |
56+
| test.cpp:49:25:49:42 | (const char *)... | semmle.label | (const char *)... |
57+
| test.cpp:52:14:52:20 | address | semmle.label | address |
58+
| test.cpp:52:14:52:20 | address | semmle.label | address |
59+
| test.cpp:52:14:52:20 | address indirection | semmle.label | address indirection |
60+
| test.cpp:56:14:56:20 | address | semmle.label | address |
61+
| test.cpp:56:14:56:20 | address | semmle.label | address |
62+
| test.cpp:56:14:56:20 | address indirection | semmle.label | address indirection |
63+
| test.cpp:60:14:60:20 | address | semmle.label | address |
64+
| test.cpp:60:14:60:20 | address | semmle.label | address |
65+
| test.cpp:60:14:60:20 | address indirection | semmle.label | address indirection |
3766
#select
3867
| test.cpp:20:7:20:12 | call to strcmp | test.cpp:16:25:16:30 | call to getenv | test.cpp:20:14:20:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:16:25:16:30 | call to getenv | call to getenv |
3968
| test.cpp:31:7:31:12 | call to strcmp | test.cpp:27:25:27:30 | call to getenv | test.cpp:31:14:31:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:27:25:27:30 | call to getenv | call to getenv |
4069
| test.cpp:42:7:42:12 | call to strcmp | test.cpp:38:25:38:30 | call to getenv | test.cpp:42:14:42:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:38:25:38:30 | call to getenv | call to getenv |
70+
| test.cpp:52:7:52:12 | call to strcmp | test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:49:25:49:30 | call to getenv | call to getenv |
71+
| test.cpp:56:7:56:12 | call to strcmp | test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:49:25:49:30 | call to getenv | call to getenv |
72+
| test.cpp:60:7:60:12 | call to strcmp | test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:49:25:49:30 | call to getenv | call to getenv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/test.cpp

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,27 @@ void processRequest3()
4343
isServer = 1;
4444
}
4545
}
46+
47+
void processRequest4()
48+
{
49+
const char *address = getenv("SERVERIP");
50+
bool cond = false;
51+
52+
if (strcmp(address, "127.0.0.1")) { cond = true; } // BAD
53+
if (strcmp(address, "127_0_0_1")) { cond = true; } // GOOD (not an IP)
54+
if (strcmp(address, "127.0.0")) { cond = true; } // GOOD (not an IP)
55+
if (strcmp(address, "127.0.0.0.1")) { cond = true; } // GOOD (not an IP)
56+
if (strcmp(address, "http://mycompany")) { cond = true; } // BAD
57+
if (strcmp(address, "http_//mycompany")) { cond = true; } // GOOD (not an address)
58+
if (strcmp(address, "htt://mycompany")) { cond = true; } // GOOD (not an address)
59+
if (strcmp(address, "httpp://mycompany")) { cond = true; } // GOOD (not an address)
60+
if (strcmp(address, "mycompany.com")) { cond = true; } // BAD
61+
if (strcmp(address, "mycompany_com")) { cond = true; } // GOOD (not an address)
62+
if (strcmp(address, "mycompany.c")) { cond = true; } // GOOD (not an address)
63+
if (strcmp(address, "mycompany.comm")) { cond = true; } // GOOD (not an address)
64+
65+
if (cond) {
66+
isServer = 1;
67+
}
68+
}
69+

0 commit comments

Comments
 (0)