Skip to content

Commit acb1962

Browse files
nicolaswillnicolaswill
authored
Merge branch 'main' into missing_openssl_hash_algorithm_consumers
2 parents 9f65cb8 + 1828d40 commit acb1962

File tree

158 files changed

+7229
-401
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

158 files changed

+7229
-401
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ node_modules/
6262

6363
# Temporary folders for working with generated models
6464
.model-temp
65+
/mad-generation-build
6566

6667
# bazel-built in-tree extractor packs
6768
/*/extractor-pack

‎Cargo.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ members = [
1010
"rust/ast-generator",
1111
"rust/autobuild",
1212
]
13+
exclude = ["mad-generation-build"]
1314

1415
[patch.crates-io]
1516
# patch for build script bug preventing bazel build

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,11 +104,8 @@ class KnownOpenSSLCipherConstantAlgorithmInstance extends OpenSSLAlgorithmInstan
104104

105105
override string getRawAlgorithmName() { result = this.(Literal).getValue().toString() }
106106

107-
override string getKeySizeFixed() {
108-
exists(int keySize |
109-
this.(KnownOpenSSLCipherAlgorithmConstant).getExplicitKeySize() = keySize and
110-
result = keySize.toString()
111-
)
107+
override int getKeySizeFixed() {
108+
this.(KnownOpenSSLCipherAlgorithmConstant).getExplicitKeySize() = result
112109
}
113110

114111
override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,11 @@ class KnownOpenSSLEllipticCurveConstantAlgorithmInstance extends OpenSSLAlgorith
3535
override string getRawEllipticCurveName() { result = this.(Literal).getValue().toString() }
3636

3737
override Crypto::TEllipticCurveType getEllipticCurveType() {
38-
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant)
39-
.getNormalizedName(), _, result)
38+
Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _, result)
39+
}
40+
41+
override string getParsedEllipticCurveName() {
42+
result = this.(KnownOpenSSLEllipticCurveAlgorithmConstant).getNormalizedName()
4043
}
4144

4245
override int getKeySize() {

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/ECKeyGenOperation.qll

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
private import experimental.quantum.Language
2+
private import experimental.quantum.OpenSSL.LibraryDetector
3+
private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
4+
private import OpenSSLOperationBase
5+
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
6+
private import semmle.code.cpp.dataflow.new.DataFlow
7+
8+
private module AlgGetterToAlgConsumerConfig implements DataFlow::ConfigSig {
9+
predicate isSource(DataFlow::Node source) {
10+
exists(OpenSSLAlgorithmValueConsumer c | c.getResultNode() = source)
11+
}
12+
13+
predicate isSink(DataFlow::Node sink) {
14+
exists(ECKeyGenOperation c | c.getAlgorithmArg() = sink.asExpr())
15+
}
16+
}
17+
18+
private module AlgGetterToAlgConsumerFlow = DataFlow::Global<AlgGetterToAlgConsumerConfig>;
19+
20+
class ECKeyGenOperation extends OpenSSLOperation, Crypto::KeyGenerationOperationInstance {
21+
ECKeyGenOperation() {
22+
this.(Call).getTarget().getName() = "EC_KEY_generate_key" and
23+
isPossibleOpenSSLFunction(this.(Call).getTarget())
24+
}
25+
26+
override Expr getOutputArg() {
27+
result = this.(Call) // return value of call
28+
}
29+
30+
Expr getAlgorithmArg() { result = this.(Call).getArgument(0) }
31+
32+
override Expr getInputArg() {
33+
// there is no 'input', in the sense that no data is being manipulated by the operation.
34+
// There is an input of an algorithm, but that is not the intention of the operation input arg.
35+
none()
36+
}
37+
38+
override Crypto::KeyArtifactType getOutputKeyType() { result = Crypto::TAsymmetricKeyType() }
39+
40+
override Crypto::ArtifactOutputDataFlowNode getOutputKeyArtifact() {
41+
result = this.getOutputNode()
42+
}
43+
44+
override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
45+
AlgGetterToAlgConsumerFlow::flow(result.(OpenSSLAlgorithmValueConsumer).getResultNode(),
46+
DataFlow::exprNode(this.getAlgorithmArg()))
47+
}
48+
49+
override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
50+
none() // no explicit key size, inferred from algorithm
51+
}
52+
53+
override int getKeySizeFixed() {
54+
none()
55+
// TODO: marked as none as the operation itself has no key size, it
56+
// comes from the algorithm source, but note we could grab the
57+
// algorithm source and get the key size (see below).
58+
// We may need to reconsider what is the best approach here.
59+
// result =
60+
// this.getAnAlgorithmValueConsumer()
61+
// .getAKnownAlgorithmSource()
62+
// .(Crypto::EllipticCurveInstance)
63+
// .getKeySize()
64+
}
65+
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperations.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
import OpenSSLOperationBase
22
import EVPCipherOperation
33
import EVPHashOperation
4+
import ECKeyGenOperation

‎cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticCFG.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ private import SemanticExprSpecific::SemanticExprConfig as Specific
1010
*/
1111
class SemBasicBlock extends Specific::BasicBlock {
1212
/** Holds if this block (transitively) dominates `otherblock`. */
13-
final predicate bbDominates(SemBasicBlock otherBlock) { Specific::bbDominates(this, otherBlock) }
13+
final predicate dominates(SemBasicBlock otherBlock) { Specific::bbDominates(this, otherBlock) }
1414

1515
/** Gets an expression that is evaluated in this basic block. */
1616
final SemExpr getAnExpr() { result.getBasicBlock() = this }

‎csharp/ql/integration-tests/posix/query-suite/csharp-security-and-quality.qls.expected

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ ql/csharp/ql/src/Concurrency/SynchSetUnsynchGet.ql
3838
ql/csharp/ql/src/Concurrency/UnsafeLazyInitialization.ql
3939
ql/csharp/ql/src/Concurrency/UnsynchronizedStaticAccess.ql
4040
ql/csharp/ql/src/Configuration/EmptyPasswordInConfigurationFile.ql
41-
ql/csharp/ql/src/Configuration/PasswordInConfigurationFile.ql
4241
ql/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
4342
ql/csharp/ql/src/Diagnostics/CompilerError.ql
4443
ql/csharp/ql/src/Diagnostics/CompilerMessage.ql
@@ -146,8 +145,6 @@ ql/csharp/ql/src/Security Features/CWE-639/InsecureDirectObjectReference.ql
146145
ql/csharp/ql/src/Security Features/CWE-643/XPathInjection.ql
147146
ql/csharp/ql/src/Security Features/CWE-730/ReDoS.ql
148147
ql/csharp/ql/src/Security Features/CWE-730/RegexInjection.ql
149-
ql/csharp/ql/src/Security Features/CWE-798/HardcodedConnectionString.ql
150-
ql/csharp/ql/src/Security Features/CWE-798/HardcodedCredentials.ql
151148
ql/csharp/ql/src/Security Features/CWE-807/ConditionalBypass.ql
152149
ql/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
153150
ql/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql

‎csharp/ql/integration-tests/posix/query-suite/csharp-security-extended.qls.expected

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
ql/csharp/ql/src/Configuration/EmptyPasswordInConfigurationFile.ql
2-
ql/csharp/ql/src/Configuration/PasswordInConfigurationFile.ql
32
ql/csharp/ql/src/Diagnostics/CompilerError.ql
43
ql/csharp/ql/src/Diagnostics/CompilerMessage.ql
54
ql/csharp/ql/src/Diagnostics/DiagnosticExtractionErrors.ql
@@ -49,8 +48,6 @@ ql/csharp/ql/src/Security Features/CWE-639/InsecureDirectObjectReference.ql
4948
ql/csharp/ql/src/Security Features/CWE-643/XPathInjection.ql
5049
ql/csharp/ql/src/Security Features/CWE-730/ReDoS.ql
5150
ql/csharp/ql/src/Security Features/CWE-730/RegexInjection.ql
52-
ql/csharp/ql/src/Security Features/CWE-798/HardcodedConnectionString.ql
53-
ql/csharp/ql/src/Security Features/CWE-798/HardcodedCredentials.ql
5451
ql/csharp/ql/src/Security Features/CWE-807/ConditionalBypass.ql
5552
ql/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
5653
ql/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql

‎csharp/ql/integration-tests/posix/query-suite/not_included_in_qls.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ ql/csharp/ql/src/Bad Practices/Naming Conventions/DefaultControlNames.ql
2626
ql/csharp/ql/src/Bad Practices/Naming Conventions/VariableNameTooShort.ql
2727
ql/csharp/ql/src/Bad Practices/UseOfHtmlInputHidden.ql
2828
ql/csharp/ql/src/Bad Practices/UseOfSystemOutputStream.ql
29+
ql/csharp/ql/src/Configuration/PasswordInConfigurationFile.ql
2930
ql/csharp/ql/src/Dead Code/DeadRefTypes.ql
3031
ql/csharp/ql/src/Dead Code/NonAssignedFields.ql
3132
ql/csharp/ql/src/Dead Code/UnusedField.ql
@@ -89,6 +90,8 @@ ql/csharp/ql/src/Security Features/CWE-321/HardcodedSymmetricEncryptionKey.ql
8990
ql/csharp/ql/src/Security Features/CWE-327/DontInstallRootCert.ql
9091
ql/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.ql
9192
ql/csharp/ql/src/Security Features/CWE-611/UseXmlSecureResolver.ql
93+
ql/csharp/ql/src/Security Features/CWE-798/HardcodedConnectionString.ql
94+
ql/csharp/ql/src/Security Features/CWE-798/HardcodedCredentials.ql
9295
ql/csharp/ql/src/Security Features/CWE-838/InappropriateEncoding.ql
9396
ql/csharp/ql/src/Useless code/PointlessForwardingMethod.ql
9497
ql/csharp/ql/src/definitions.ql

0 commit comments

Comments
 (0)