Skip to content

Commit 59c3ac6

Browse files
geoffw0geoffw0
committed
Rust: Allow flow through reference taking (&).
1 parent 78c58aa commit 59c3ac6

File tree

3 files changed

+58
-4
lines changed

3 files changed

+58
-4
lines changed

‎rust/ql/src/queries/security/CWE-312/CleartextLogging.ql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@ module CleartextLoggingConfig implements DataFlow::ConfigSig {
3636
isSource(node)
3737
}
3838

39+
predicate isAdditionalFlowStep(Node node1, Node node2) {
40+
// flow from `a` to `&a`
41+
node2.(Node::ExprNode).asExpr().getExpr().(RefExpr).getExpr() =
42+
node1.(Node::ExprNode).asExpr().getExpr()
43+
}
44+
3945
predicate allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c) {
4046
// flow out from tuple content at sinks.
4147
isSink(node) and

‎rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
| test_logging.rs:84:5:84:62 | ...::log::<...> | test_logging.rs:84:54:84:61 | password | test_logging.rs:84:5:84:62 | ...::log::<...> | This operation writes '...::log::<...>' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:84:54:84:61 | password | password |
2424
| test_logging.rs:85:5:85:48 | ...::log::<...> | test_logging.rs:85:21:85:28 | password | test_logging.rs:85:5:85:48 | ...::log::<...> | This operation writes '...::log::<...>' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:85:21:85:28 | password | password |
2525
| test_logging.rs:86:5:86:44 | ...::log::<...> | test_logging.rs:86:36:86:43 | password | test_logging.rs:86:5:86:44 | ...::log::<...> | This operation writes '...::log::<...>' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:86:36:86:43 | password | password |
26+
| test_logging.rs:94:5:94:29 | ...::log | test_logging.rs:93:15:93:22 | password | test_logging.rs:94:5:94:29 | ...::log | This operation writes '...::log' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:93:15:93:22 | password | password |
27+
| test_logging.rs:97:5:97:19 | ...::log | test_logging.rs:96:42:96:49 | password | test_logging.rs:97:5:97:19 | ...::log | This operation writes '...::log' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:96:42:96:49 | password | password |
2628
| test_logging.rs:100:5:100:19 | ...::log | test_logging.rs:99:38:99:45 | password | test_logging.rs:100:5:100:19 | ...::log | This operation writes '...::log' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:99:38:99:45 | password | password |
2729
| test_logging.rs:118:5:118:42 | ...::log | test_logging.rs:118:28:118:41 | get_password(...) | test_logging.rs:118:5:118:42 | ...::log | This operation writes '...::log' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:118:28:118:41 | get_password(...) | get_password(...) |
2830
| test_logging.rs:131:5:131:32 | ...::log | test_logging.rs:129:25:129:32 | password | test_logging.rs:131:5:131:32 | ...::log | This operation writes '...::log' to a log file. It may contain unencrypted sensitive data from $@. | test_logging.rs:129:25:129:32 | password | password |
@@ -72,26 +74,38 @@ edges
7274
| test_logging.rs:60:46:60:53 | password | test_logging.rs:60:30:60:53 | MacroExpr | provenance | |
7375
| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:61:5:61:55 | ...::log | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
7476
| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:61:5:61:55 | ...::log | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 Sink:MaD:1 |
77+
| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0] | test_logging.rs:61:5:61:55 | ...::log | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
78+
| test_logging.rs:61:20:61:28 | &password | test_logging.rs:61:20:61:28 | TupleExpr [tuple.0] | provenance | |
7579
| test_logging.rs:61:20:61:28 | &password [&ref] | test_logging.rs:61:20:61:28 | TupleExpr [tuple.0, &ref] | provenance | |
7680
| test_logging.rs:61:20:61:28 | TupleExpr [tuple.0, &ref] | test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | provenance | |
81+
| test_logging.rs:61:20:61:28 | TupleExpr [tuple.0] | test_logging.rs:61:20:61:28 | &... [&ref, tuple.0] | provenance | |
82+
| test_logging.rs:61:21:61:28 | password | test_logging.rs:61:20:61:28 | &password | provenance | Config |
7783
| test_logging.rs:61:21:61:28 | password | test_logging.rs:61:20:61:28 | &password [&ref] | provenance | |
7884
| test_logging.rs:65:24:65:47 | MacroExpr | test_logging.rs:65:5:65:48 | ...::log | provenance | MaD:0 Sink:MaD:0 |
7985
| test_logging.rs:65:40:65:47 | password | test_logging.rs:65:24:65:47 | MacroExpr | provenance | |
8086
| test_logging.rs:67:42:67:65 | MacroExpr | test_logging.rs:67:5:67:66 | ...::log | provenance | MaD:0 Sink:MaD:0 |
8187
| test_logging.rs:67:58:67:65 | password | test_logging.rs:67:42:67:65 | MacroExpr | provenance | |
8288
| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | test_logging.rs:68:5:68:67 | ...::log | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
8389
| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | test_logging.rs:68:5:68:67 | ...::log | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 Sink:MaD:1 |
90+
| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0] | test_logging.rs:68:5:68:67 | ...::log | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
91+
| test_logging.rs:68:18:68:26 | &password | test_logging.rs:68:18:68:26 | TupleExpr [tuple.0] | provenance | |
8492
| test_logging.rs:68:18:68:26 | &password [&ref] | test_logging.rs:68:18:68:26 | TupleExpr [tuple.0, &ref] | provenance | |
8593
| test_logging.rs:68:18:68:26 | TupleExpr [tuple.0, &ref] | test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | provenance | |
94+
| test_logging.rs:68:18:68:26 | TupleExpr [tuple.0] | test_logging.rs:68:18:68:26 | &... [&ref, tuple.0] | provenance | |
95+
| test_logging.rs:68:19:68:26 | password | test_logging.rs:68:18:68:26 | &password | provenance | Config |
8696
| test_logging.rs:68:19:68:26 | password | test_logging.rs:68:18:68:26 | &password [&ref] | provenance | |
8797
| test_logging.rs:72:23:72:46 | MacroExpr | test_logging.rs:72:5:72:47 | ...::log::<...> | provenance | MaD:0 Sink:MaD:0 |
8898
| test_logging.rs:72:39:72:46 | password | test_logging.rs:72:23:72:46 | MacroExpr | provenance | |
8999
| test_logging.rs:74:41:74:64 | MacroExpr | test_logging.rs:74:5:74:65 | ...::log::<...> | provenance | MaD:0 Sink:MaD:0 |
90100
| test_logging.rs:74:57:74:64 | password | test_logging.rs:74:41:74:64 | MacroExpr | provenance | |
91101
| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:75:5:75:51 | ...::log::<...> | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
92102
| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:75:5:75:51 | ...::log::<...> | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 Sink:MaD:1 |
103+
| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0] | test_logging.rs:75:5:75:51 | ...::log::<...> | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
104+
| test_logging.rs:75:20:75:28 | &password | test_logging.rs:75:20:75:28 | TupleExpr [tuple.0] | provenance | |
93105
| test_logging.rs:75:20:75:28 | &password [&ref] | test_logging.rs:75:20:75:28 | TupleExpr [tuple.0, &ref] | provenance | |
94106
| test_logging.rs:75:20:75:28 | TupleExpr [tuple.0, &ref] | test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | provenance | |
107+
| test_logging.rs:75:20:75:28 | TupleExpr [tuple.0] | test_logging.rs:75:20:75:28 | &... [&ref, tuple.0] | provenance | |
108+
| test_logging.rs:75:21:75:28 | password | test_logging.rs:75:20:75:28 | &password | provenance | Config |
95109
| test_logging.rs:75:21:75:28 | password | test_logging.rs:75:20:75:28 | &password [&ref] | provenance | |
96110
| test_logging.rs:76:23:76:46 | MacroExpr | test_logging.rs:76:5:76:47 | ...::log::<...> | provenance | MaD:0 Sink:MaD:0 |
97111
| test_logging.rs:76:39:76:46 | password | test_logging.rs:76:23:76:46 | MacroExpr | provenance | |
@@ -101,11 +115,23 @@ edges
101115
| test_logging.rs:84:54:84:61 | password | test_logging.rs:84:38:84:61 | MacroExpr | provenance | |
102116
| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:85:5:85:48 | ...::log::<...> | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
103117
| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | test_logging.rs:85:5:85:48 | ...::log::<...> | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 Sink:MaD:1 |
118+
| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0] | test_logging.rs:85:5:85:48 | ...::log::<...> | provenance | MaD:1 Sink:MaD:1 Sink:MaD:1 |
119+
| test_logging.rs:85:20:85:28 | &password | test_logging.rs:85:20:85:28 | TupleExpr [tuple.0] | provenance | |
104120
| test_logging.rs:85:20:85:28 | &password [&ref] | test_logging.rs:85:20:85:28 | TupleExpr [tuple.0, &ref] | provenance | |
105121
| test_logging.rs:85:20:85:28 | TupleExpr [tuple.0, &ref] | test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | provenance | |
122+
| test_logging.rs:85:20:85:28 | TupleExpr [tuple.0] | test_logging.rs:85:20:85:28 | &... [&ref, tuple.0] | provenance | |
123+
| test_logging.rs:85:21:85:28 | password | test_logging.rs:85:20:85:28 | &password | provenance | Config |
106124
| test_logging.rs:85:21:85:28 | password | test_logging.rs:85:20:85:28 | &password [&ref] | provenance | |
107125
| test_logging.rs:86:20:86:43 | MacroExpr | test_logging.rs:86:5:86:44 | ...::log::<...> | provenance | MaD:0 Sink:MaD:0 |
108126
| test_logging.rs:86:36:86:43 | password | test_logging.rs:86:20:86:43 | MacroExpr | provenance | |
127+
| test_logging.rs:93:9:93:10 | m1 | test_logging.rs:94:11:94:28 | MacroExpr | provenance | |
128+
| test_logging.rs:93:14:93:22 | &password | test_logging.rs:93:9:93:10 | m1 | provenance | |
129+
| test_logging.rs:93:15:93:22 | password | test_logging.rs:93:14:93:22 | &password | provenance | Config |
130+
| test_logging.rs:94:11:94:28 | MacroExpr | test_logging.rs:94:5:94:29 | ...::log | provenance | MaD:0 Sink:MaD:0 |
131+
| test_logging.rs:96:9:96:10 | m2 | test_logging.rs:97:11:97:18 | MacroExpr | provenance | |
132+
| test_logging.rs:96:41:96:49 | &password | test_logging.rs:96:9:96:10 | m2 | provenance | |
133+
| test_logging.rs:96:42:96:49 | password | test_logging.rs:96:41:96:49 | &password | provenance | Config |
134+
| test_logging.rs:97:11:97:18 | MacroExpr | test_logging.rs:97:5:97:19 | ...::log | provenance | MaD:0 Sink:MaD:0 |
109135
| test_logging.rs:99:9:99:10 | m3 | test_logging.rs:100:11:100:18 | MacroExpr | provenance | |
110136
| test_logging.rs:99:14:99:46 | res | test_logging.rs:99:22:99:45 | { ... } | provenance | |
111137
| test_logging.rs:99:22:99:45 | ...::format(...) | test_logging.rs:99:14:99:46 | res | provenance | |
@@ -233,8 +259,11 @@ nodes
233259
| test_logging.rs:60:46:60:53 | password | semmle.label | password |
234260
| test_logging.rs:61:5:61:55 | ...::log | semmle.label | ...::log |
235261
| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0, &ref] | semmle.label | &... [&ref, tuple.0, &ref] |
262+
| test_logging.rs:61:20:61:28 | &... [&ref, tuple.0] | semmle.label | &... [&ref, tuple.0] |
263+
| test_logging.rs:61:20:61:28 | &password | semmle.label | &password |
236264
| test_logging.rs:61:20:61:28 | &password [&ref] | semmle.label | &password [&ref] |
237265
| test_logging.rs:61:20:61:28 | TupleExpr [tuple.0, &ref] | semmle.label | TupleExpr [tuple.0, &ref] |
266+
| test_logging.rs:61:20:61:28 | TupleExpr [tuple.0] | semmle.label | TupleExpr [tuple.0] |
238267
| test_logging.rs:61:21:61:28 | password | semmle.label | password |
239268
| test_logging.rs:65:5:65:48 | ...::log | semmle.label | ...::log |
240269
| test_logging.rs:65:24:65:47 | MacroExpr | semmle.label | MacroExpr |
@@ -244,8 +273,11 @@ nodes
244273
| test_logging.rs:67:58:67:65 | password | semmle.label | password |
245274
| test_logging.rs:68:5:68:67 | ...::log | semmle.label | ...::log |
246275
| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0, &ref] | semmle.label | &... [&ref, tuple.0, &ref] |
276+
| test_logging.rs:68:18:68:26 | &... [&ref, tuple.0] | semmle.label | &... [&ref, tuple.0] |
277+
| test_logging.rs:68:18:68:26 | &password | semmle.label | &password |
247278
| test_logging.rs:68:18:68:26 | &password [&ref] | semmle.label | &password [&ref] |
248279
| test_logging.rs:68:18:68:26 | TupleExpr [tuple.0, &ref] | semmle.label | TupleExpr [tuple.0, &ref] |
280+
| test_logging.rs:68:18:68:26 | TupleExpr [tuple.0] | semmle.label | TupleExpr [tuple.0] |
249281
| test_logging.rs:68:19:68:26 | password | semmle.label | password |
250282
| test_logging.rs:72:5:72:47 | ...::log::<...> | semmle.label | ...::log::<...> |
251283
| test_logging.rs:72:23:72:46 | MacroExpr | semmle.label | MacroExpr |
@@ -255,8 +287,11 @@ nodes
255287
| test_logging.rs:74:57:74:64 | password | semmle.label | password |
256288
| test_logging.rs:75:5:75:51 | ...::log::<...> | semmle.label | ...::log::<...> |
257289
| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0, &ref] | semmle.label | &... [&ref, tuple.0, &ref] |
290+
| test_logging.rs:75:20:75:28 | &... [&ref, tuple.0] | semmle.label | &... [&ref, tuple.0] |
291+
| test_logging.rs:75:20:75:28 | &password | semmle.label | &password |
258292
| test_logging.rs:75:20:75:28 | &password [&ref] | semmle.label | &password [&ref] |
259293
| test_logging.rs:75:20:75:28 | TupleExpr [tuple.0, &ref] | semmle.label | TupleExpr [tuple.0, &ref] |
294+
| test_logging.rs:75:20:75:28 | TupleExpr [tuple.0] | semmle.label | TupleExpr [tuple.0] |
260295
| test_logging.rs:75:21:75:28 | password | semmle.label | password |
261296
| test_logging.rs:76:5:76:47 | ...::log::<...> | semmle.label | ...::log::<...> |
262297
| test_logging.rs:76:23:76:46 | MacroExpr | semmle.label | MacroExpr |
@@ -269,12 +304,25 @@ nodes
269304
| test_logging.rs:84:54:84:61 | password | semmle.label | password |
270305
| test_logging.rs:85:5:85:48 | ...::log::<...> | semmle.label | ...::log::<...> |
271306
| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0, &ref] | semmle.label | &... [&ref, tuple.0, &ref] |
307+
| test_logging.rs:85:20:85:28 | &... [&ref, tuple.0] | semmle.label | &... [&ref, tuple.0] |
308+
| test_logging.rs:85:20:85:28 | &password | semmle.label | &password |
272309
| test_logging.rs:85:20:85:28 | &password [&ref] | semmle.label | &password [&ref] |
273310
| test_logging.rs:85:20:85:28 | TupleExpr [tuple.0, &ref] | semmle.label | TupleExpr [tuple.0, &ref] |
311+
| test_logging.rs:85:20:85:28 | TupleExpr [tuple.0] | semmle.label | TupleExpr [tuple.0] |
274312
| test_logging.rs:85:21:85:28 | password | semmle.label | password |
275313
| test_logging.rs:86:5:86:44 | ...::log::<...> | semmle.label | ...::log::<...> |
276314
| test_logging.rs:86:20:86:43 | MacroExpr | semmle.label | MacroExpr |
277315
| test_logging.rs:86:36:86:43 | password | semmle.label | password |
316+
| test_logging.rs:93:9:93:10 | m1 | semmle.label | m1 |
317+
| test_logging.rs:93:14:93:22 | &password | semmle.label | &password |
318+
| test_logging.rs:93:15:93:22 | password | semmle.label | password |
319+
| test_logging.rs:94:5:94:29 | ...::log | semmle.label | ...::log |
320+
| test_logging.rs:94:11:94:28 | MacroExpr | semmle.label | MacroExpr |
321+
| test_logging.rs:96:9:96:10 | m2 | semmle.label | m2 |
322+
| test_logging.rs:96:41:96:49 | &password | semmle.label | &password |
323+
| test_logging.rs:96:42:96:49 | password | semmle.label | password |
324+
| test_logging.rs:97:5:97:19 | ...::log | semmle.label | ...::log |
325+
| test_logging.rs:97:11:97:18 | MacroExpr | semmle.label | MacroExpr |
278326
| test_logging.rs:99:9:99:10 | m3 | semmle.label | m3 |
279327
| test_logging.rs:99:14:99:46 | res | semmle.label | res |
280328
| test_logging.rs:99:22:99:45 | ...::format(...) | semmle.label | ...::format(...) |

‎rust/ql/test/query-tests/security/CWE-312/test_logging.rs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,11 @@ fn test_log(harmless: String, password: String, encrypted_password: String) {
9090
error!(value2:?; "message"); // $ MISSING: Alert[rust/cleartext-logging]
9191

9292
// pre-formatted
93-
let m1 = &password; // $ MISSING: Source=m1
94-
info!("message = {}", m1); // $ MISSING: Alert[rust/cleartext-logging]=m1
93+
let m1 = &password; // $ Source=m1
94+
info!("message = {}", m1); // $ Alert[rust/cleartext-logging]=m1
9595

96-
let m2 = "message = ".to_string() + &password; // $ MISSING: Source=m2
97-
info!("{}", m2); // $ MISSING: Alert[rust/cleartext-logging]=m2
96+
let m2 = "message = ".to_string() + &password; // $ Source=m2
97+
info!("{}", m2); // $ Alert[rust/cleartext-logging]=m2
9898

9999
let m3 = format!("message = {}", password); // $ Source=m3
100100
info!("{}", m3); // $ Alert[rust/cleartext-logging]=m3

0 commit comments

Comments
 (0)