Skip to content

Commit 72d9d47

Browse files
aegilopsaegilops
authored
Merge branch 'main' into java/experimental/command-injection
2 parents 2112d73 + ea97c3e commit 72d9d47

File tree

64 files changed

+272
-66
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+272
-66
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -748,6 +748,46 @@ edges
748748
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
749749
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
750750
| test.cpp:384:14:384:16 | end | test.cpp:384:13:384:16 | Load: * ... |
751+
| test.cpp:388:14:388:27 | new[] | test.cpp:389:16:389:17 | xs |
752+
| test.cpp:388:14:388:27 | new[] | test.cpp:392:5:392:6 | xs |
753+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
754+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
755+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
756+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
757+
| test.cpp:389:16:389:17 | xs | test.cpp:393:9:393:10 | xs |
758+
| test.cpp:389:16:389:17 | xs | test.cpp:393:9:393:10 | xs |
759+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:392:5:392:8 | ... ++ |
760+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:392:5:392:8 | ... ++ |
761+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
762+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
763+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
764+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
765+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:6 | xs |
766+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:6 | xs |
767+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
768+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
769+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
770+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
771+
| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:6 | xs |
772+
| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
773+
| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
774+
| test.cpp:395:5:395:6 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
775+
| test.cpp:404:3:404:25 | ... = ... | test.cpp:404:7:404:8 | val indirection [post update] [xs] |
776+
| test.cpp:404:7:404:8 | val indirection [post update] [xs] | test.cpp:407:3:407:5 | val indirection [xs] |
777+
| test.cpp:404:12:404:25 | new[] | test.cpp:404:3:404:25 | ... = ... |
778+
| test.cpp:406:3:406:25 | ... = ... | test.cpp:406:7:406:8 | val indirection [post update] [xs] |
779+
| test.cpp:406:7:406:8 | val indirection [post update] [xs] | test.cpp:407:3:407:5 | val indirection [xs] |
780+
| test.cpp:406:12:406:25 | new[] | test.cpp:406:3:406:25 | ... = ... |
781+
| test.cpp:407:3:407:5 | val indirection [xs] | test.cpp:407:7:407:8 | xs indirection |
782+
| test.cpp:407:3:407:18 | access to array | test.cpp:407:3:407:22 | Store: ... = ... |
783+
| test.cpp:407:7:407:8 | xs | test.cpp:407:3:407:18 | access to array |
784+
| test.cpp:407:7:407:8 | xs indirection | test.cpp:407:7:407:8 | xs |
785+
| test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:8 | xs |
786+
| test.cpp:419:7:419:8 | xs | test.cpp:419:7:419:11 | access to array |
787+
| test.cpp:419:7:419:11 | access to array | test.cpp:419:7:419:15 | Store: ... = ... |
788+
| test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:6 | xs |
789+
| test.cpp:433:5:433:6 | xs | test.cpp:433:5:433:17 | access to array |
790+
| test.cpp:433:5:433:17 | access to array | test.cpp:433:5:433:21 | Store: ... = ... |
751791
nodes
752792
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
753793
| test.cpp:5:15:5:15 | p | semmle.label | p |
@@ -1087,6 +1127,36 @@ nodes
10871127
| test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
10881128
| test.cpp:384:13:384:16 | Load: * ... | semmle.label | Load: * ... |
10891129
| test.cpp:384:14:384:16 | end | semmle.label | end |
1130+
| test.cpp:388:14:388:27 | new[] | semmle.label | new[] |
1131+
| test.cpp:389:16:389:17 | xs | semmle.label | xs |
1132+
| test.cpp:392:5:392:6 | xs | semmle.label | xs |
1133+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1134+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1135+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1136+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1137+
| test.cpp:393:9:393:10 | xs | semmle.label | xs |
1138+
| test.cpp:393:9:393:10 | xs | semmle.label | xs |
1139+
| test.cpp:395:5:395:6 | xs | semmle.label | xs |
1140+
| test.cpp:395:5:395:13 | Store: ... = ... | semmle.label | Store: ... = ... |
1141+
| test.cpp:404:3:404:25 | ... = ... | semmle.label | ... = ... |
1142+
| test.cpp:404:7:404:8 | val indirection [post update] [xs] | semmle.label | val indirection [post update] [xs] |
1143+
| test.cpp:404:12:404:25 | new[] | semmle.label | new[] |
1144+
| test.cpp:406:3:406:25 | ... = ... | semmle.label | ... = ... |
1145+
| test.cpp:406:7:406:8 | val indirection [post update] [xs] | semmle.label | val indirection [post update] [xs] |
1146+
| test.cpp:406:12:406:25 | new[] | semmle.label | new[] |
1147+
| test.cpp:407:3:407:5 | val indirection [xs] | semmle.label | val indirection [xs] |
1148+
| test.cpp:407:3:407:18 | access to array | semmle.label | access to array |
1149+
| test.cpp:407:3:407:22 | Store: ... = ... | semmle.label | Store: ... = ... |
1150+
| test.cpp:407:7:407:8 | xs | semmle.label | xs |
1151+
| test.cpp:407:7:407:8 | xs indirection | semmle.label | xs indirection |
1152+
| test.cpp:417:16:417:33 | new[] | semmle.label | new[] |
1153+
| test.cpp:419:7:419:8 | xs | semmle.label | xs |
1154+
| test.cpp:419:7:419:11 | access to array | semmle.label | access to array |
1155+
| test.cpp:419:7:419:15 | Store: ... = ... | semmle.label | Store: ... = ... |
1156+
| test.cpp:427:14:427:27 | new[] | semmle.label | new[] |
1157+
| test.cpp:433:5:433:6 | xs | semmle.label | xs |
1158+
| test.cpp:433:5:433:17 | access to array | semmle.label | access to array |
1159+
| test.cpp:433:5:433:21 | Store: ... = ... | semmle.label | Store: ... = ... |
10901160
subpaths
10911161
#select
10921162
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -1113,3 +1183,7 @@ subpaths
11131183
| test.cpp:359:14:359:32 | Load: * ... | test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 2. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size |
11141184
| test.cpp:372:15:372:16 | Load: * ... | test.cpp:363:14:363:27 | new[] | test.cpp:372:15:372:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:363:14:363:27 | new[] | new[] | test.cpp:365:19:365:22 | size | size |
11151185
| test.cpp:384:13:384:16 | Load: * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size |
1186+
| test.cpp:395:5:395:13 | Store: ... = ... | test.cpp:388:14:388:27 | new[] | test.cpp:395:5:395:13 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:388:14:388:27 | new[] | new[] | test.cpp:389:19:389:22 | size | size |
1187+
| test.cpp:407:3:407:22 | Store: ... = ... | test.cpp:404:12:404:25 | new[] | test.cpp:407:3:407:22 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:404:12:404:25 | new[] | new[] | test.cpp:407:10:407:17 | ... - ... | ... - ... |
1188+
| test.cpp:419:7:419:15 | Store: ... = ... | test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:15 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:417:16:417:33 | new[] | new[] | test.cpp:419:10:419:10 | i | i |
1189+
| test.cpp:433:5:433:21 | Store: ... = ... | test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:21 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:427:14:427:27 | new[] | new[] | test.cpp:433:8:433:16 | ... ++ | ... ++ |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,3 +383,53 @@ void test27(unsigned size, bool b) {
383383

384384
int val = *end; // BAD
385385
}
386+
387+
void test28(unsigned size) {
388+
char *xs = new char[size];
389+
char *end = &xs[size];
390+
if (xs >= end)
391+
return;
392+
xs++;
393+
if (xs >= end)
394+
return;
395+
xs[0] = 0; // GOOD [FALSE POSITIVE]
396+
}
397+
398+
struct test29_struct {
399+
char* xs;
400+
};
401+
402+
void test29(unsigned size) {
403+
test29_struct val;
404+
val.xs = new char[size];
405+
size++;
406+
val.xs = new char[size];
407+
val.xs[size - 1] = 0; // GOOD [FALSE POSITIVE]
408+
}
409+
410+
void test30(int *size)
411+
{
412+
int new_size = 0, tmp_size = 0;
413+
414+
test30(&tmp_size);
415+
if (tmp_size + 1 > new_size) {
416+
new_size = tmp_size + 1;
417+
char *xs = new char[new_size];
418+
for (int i = 0; i < new_size; i++) {
419+
xs[i] = 0; // GOOD [FALSE POSITIVE]
420+
}
421+
}
422+
*size = new_size;
423+
}
424+
425+
void test31(unsigned size, unsigned src_pos)
426+
{
427+
char *xs = new char[size];
428+
if (src_pos > size) {
429+
src_pos = size;
430+
}
431+
unsigned dst_pos = src_pos;
432+
if(dst_pos < size - 3) {
433+
xs[dst_pos++] = 0; // GOOD [FALSE POSITIVE]
434+
}
435+
}

‎csharp/ql/test/query-tests/Security Features/CWE-011/options

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj

‎csharp/ql/test/query-tests/Security Features/CWE-016/options

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj

‎csharp/ql/test/query-tests/Security Features/CWE-020/options

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
1-
semmle-extractor-options: /r:${testdir}/../../../resources/assemblies/System.Web.dll /r:${testdir}/../../../resources/assemblies/System.Web.ApplicationServices.dll /r:${testdir}/../../../resources/assemblies/System.Data.dll /r:System.Text.RegularExpressions.dll /r:System.Collections.Specialized.dll /r:System.Data.Common.dll /r:System.Security.Cryptography.X509Certificates.dll /r:System.Runtime.InteropServices.dll
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Web.cs

‎csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/options

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
1-
semmle-extractor-options: /r:System.IO.FileSystem.dll /r:System.Runtime.Extensions.dll /r:System.Collections.Specialized.dll ${testdir}/../../../../resources/stubs/System.Web.cs
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
3+
semmle-extractor-options: ${testdir}/../../../../resources/stubs/System.Web.cs

‎csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/options

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
semmle-extractor-options: /r:System.IO.Compression.dll /r:System.IO.Compression.FileSystem.dll /r:System.IO.Compression.ZipFile.dll /r:System.IO.FileSystem.dll
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj

‎csharp/ql/test/query-tests/Security Features/CWE-078/options

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
semmle-extractor-options: /r:System.ComponentModel.Primitives.dll /r:System.Diagnostics.Process.dll /r:System.Runtime.InteropServices.dll ${testdir}/../../../resources/stubs/System.Data.cs /r:System.Data.Common.dll
1+
semmle-extractor-options: /nostdlib /noconfig
2+
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../resources/stubs/System.Data.SqlClient/4.8.3/System.Data.SqlClient.csproj

‎csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.cs

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
// semmle-extractor-options: /r:${testdir}/../../../../resources/assemblies/System.Data.dll /r:${testdir}/../../../../resources/assemblies/System.Web.dll /r:${testdir}/../../../../resources/assemblies/System.Web.Mvc.dll /r:System.ComponentModel.Primitives.dll /r:System.Collections.Specialized.dll /r:${testdir}/../../../../resources/assemblies/System.Net.Http.dll
2-
31
using System;
42
using System.Data.SqlClient;
53
using System.Web;

‎csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
edges
2-
| StoredXSS.cs:24:60:24:86 | call to method GetString : String | StoredXSS.cs:24:44:24:86 | ... + ... |
2+
| StoredXSS.cs:22:60:22:86 | call to method GetString : String | StoredXSS.cs:22:44:22:86 | ... + ... |
33
nodes
4-
| StoredXSS.cs:24:44:24:86 | ... + ... | semmle.label | ... + ... |
5-
| StoredXSS.cs:24:60:24:86 | call to method GetString : String | semmle.label | call to method GetString : String |
4+
| StoredXSS.cs:22:44:22:86 | ... + ... | semmle.label | ... + ... |
5+
| StoredXSS.cs:22:60:22:86 | call to method GetString : String | semmle.label | call to method GetString : String |
66
subpaths
77
#select
8-
| StoredXSS.cs:24:44:24:86 | ... + ... | StoredXSS.cs:24:60:24:86 | call to method GetString : String | StoredXSS.cs:24:44:24:86 | ... + ... | This HTML or JavaScript write depends on a $@. | StoredXSS.cs:24:60:24:86 | call to method GetString | stored (potentially user-provided) value |
8+
| StoredXSS.cs:22:44:22:86 | ... + ... | StoredXSS.cs:22:60:22:86 | call to method GetString : String | StoredXSS.cs:22:44:22:86 | ... + ... | This HTML or JavaScript write depends on a $@. | StoredXSS.cs:22:60:22:86 | call to method GetString | stored (potentially user-provided) value |

0 commit comments

Comments
 (0)