Skip to content

Commit 917d9e7

Browse files
author
Paolo Tranquilli
committed
Merge branch 'main' into redsun82/cargo-upgrade-2
2 parents 5ec72b2 + 860b3d7 commit 917d9e7

File tree

69 files changed

+2897
-1699
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+2897
-1699
lines changed

‎.github/workflows/go-tests-other-os.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,8 @@ jobs:
2626
uses: ./go/actions/test
2727

2828
test-win:
29-
if: github.repository_owner == 'github'
3029
name: Test Windows
31-
runs-on: windows-latest-xl
30+
runs-on: windows-latest
3231
steps:
3332
- name: Check out code
3433
uses: actions/checkout@v4

‎cpp/ql/lib/change-notes/2025-05-16-array-aggregate-literals.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed a problem where `asExpr()` on `DataFlow::Node` would never return `ArrayAggregateLiteral`s.

‎cpp/ql/lib/change-notes/2025-05-18-2025-May-outdated-deprecations.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
category: breaking
3+
---
4+
* Deleted the deprecated `userInputArgument` predicate and its convenience accessor from the `Security.qll`.
5+
* Deleted the deprecated `userInputReturned` predicate and its convenience accessor from the `Security.qll`.
6+
* Deleted the deprecated `userInputReturn` predicate from the `Security.qll`.
7+
* Deleted the deprecated `isUserInput` predicate and its convenience accessor from the `Security.qll`.
8+
* Deleted the deprecated `userInputArgument` predicate from the `SecurityOptions.qll`.
9+
* Deleted the deprecated `userInputReturned` predicate from the `SecurityOptions.qll`.

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
import cpp
2-
import semmle.code.cpp.dataflow.new.DataFlow
3-
import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
4-
import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
2+
private import experimental.quantum.Language
3+
private import semmle.code.cpp.dataflow.new.DataFlow
4+
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
5+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
56

67
/**
78
* Traces 'known algorithms' to AVCs, specifically

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
import cpp
2-
import experimental.quantum.Language
3-
import OpenSSLAlgorithmInstanceBase
4-
import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
5-
import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
6-
import AlgToAVCFlow
2+
private import experimental.quantum.Language
3+
private import OpenSSLAlgorithmInstanceBase
4+
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
5+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
6+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
7+
private import AlgToAVCFlow
78

89
/**
910
* Given a `KnownOpenSSLBlockModeAlgorithmConstant`, converts this to a block family type.

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
import cpp
2-
import experimental.quantum.Language
3-
import KnownAlgorithmConstants
4-
import Crypto::KeyOpAlg as KeyOpAlg
5-
import OpenSSLAlgorithmInstanceBase
6-
import PaddingAlgorithmInstance
7-
import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
8-
import AlgToAVCFlow
9-
import BlockAlgorithmInstance
2+
private import experimental.quantum.Language
3+
private import KnownAlgorithmConstants
4+
private import Crypto::KeyOpAlg as KeyOpAlg
5+
private import OpenSSLAlgorithmInstanceBase
6+
private import PaddingAlgorithmInstance
7+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
8+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
9+
private import AlgToAVCFlow
10+
private import BlockAlgorithmInstance
1011

1112
/**
1213
* Given a `KnownOpenSSLCipherAlgorithmConstant`, converts this to a cipher family type.

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
import cpp
2+
private import experimental.quantum.Language
3+
private import KnownAlgorithmConstants
4+
private import OpenSSLAlgorithmInstanceBase
5+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
6+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
7+
private import AlgToAVCFlow
8+
9+
class KnownOpenSSLEllipticCurveConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
10+
Crypto::EllipticCurveInstance instanceof KnownOpenSSLEllipticCurveAlgorithmConstant
11+
{
12+
OpenSSLAlgorithmValueConsumer getterCall;
13+
14+
KnownOpenSSLEllipticCurveConstantAlgorithmInstance() {
15+
// Two possibilities:
16+
// 1) The source is a literal and flows to a getter, then we know we have an instance
17+
// 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
18+
// Possibility 1:
19+
this instanceof Literal and
20+
exists(DataFlow::Node src, DataFlow::Node sink |
21+
// Sink is an argument to a CipherGetterCall
22+
sink = getterCall.getInputNode() and
23+
// Source is `this`
24+
src.asExpr() = this and
25+
// This traces to a getter
26+
KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
27+
)
28+
or
29+
// Possibility 2:
30+
this instanceof DirectAlgorithmValueConsumer and getterCall = this
31+
}
32+
33+
override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
34+
35+
override string getRawEllipticCurveName() { result = this.(Literal).getValue().toString() }
36+
37+
override Crypto::TEllipticCurveType getEllipticCurveType() {
38+
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant)
39+
.getNormalizedName(), _, result)
40+
}
41+
42+
override int getKeySize() {
43+
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant)
44+
.getNormalizedName(), result, _)
45+
}
46+
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
import cpp
2-
import experimental.quantum.Language
3-
import KnownAlgorithmConstants
4-
import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
5-
import AlgToAVCFlow
2+
private import experimental.quantum.Language
3+
private import KnownAlgorithmConstants
4+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
5+
private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
6+
private import AlgToAVCFlow
67

78
predicate knownOpenSSLConstantToHashFamilyType(
89
KnownOpenSSLHashAlgorithmConstant e, Crypto::THashType type

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import cpp
2-
import experimental.quantum.OpenSSL.LibraryDetector
2+
private import experimental.quantum.OpenSSL.LibraryDetector
33

44
predicate resolveAlgorithmFromExpr(Expr e, string normalizedName, string algType) {
55
resolveAlgorithmFromCall(e, normalizedName, algType)
@@ -67,6 +67,15 @@ class KnownOpenSSLHashAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
6767
}
6868
}
6969

70+
class KnownOpenSSLEllipticCurveAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
71+
KnownOpenSSLEllipticCurveAlgorithmConstant() {
72+
exists(string algType |
73+
resolveAlgorithmFromExpr(this, _, algType) and
74+
algType.toLowerCase().matches("elliptic_curve")
75+
)
76+
}
77+
}
78+
7079
/**
7180
* Resolves a call to a 'direct algorithm getter', e.g., EVP_MD5()
7281
* This approach to fetching algorithms was used in OpenSSL 1.0.2.

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/OpenSSLAlgorithmInstanceBase.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
import experimental.quantum.Language
2-
import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
1+
private import experimental.quantum.Language
2+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
33

44
abstract class OpenSSLAlgorithmInstance extends Crypto::AlgorithmInstance {
55
abstract OpenSSLAlgorithmValueConsumer getAVC();

0 commit comments

Comments
 (0)