Skip to content

Commit b82425a

Browse files
geoffw0geoffw0
committed
C++: Add various new test cases.
1 parent 2d4a2e0 commit b82425a

File tree

2 files changed

+109
-5
lines changed

2 files changed

+109
-5
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ edges
1313
nodes
1414
| test3.cpp:22:15:22:23 | password1 | semmle.label | password1 |
1515
| test3.cpp:26:15:26:23 | password2 | semmle.label | password2 |
16+
| test3.cpp:38:23:38:31 | password2 | semmle.label | password2 |
1617
| test3.cpp:47:15:47:22 | password | semmle.label | password |
1718
| test3.cpp:55:15:55:22 | password | semmle.label | password |
1819
| test3.cpp:74:21:74:29 | password1 | semmle.label | password1 |
@@ -33,11 +34,22 @@ nodes
3334
| test3.cpp:146:15:146:18 | data | semmle.label | data |
3435
| test3.cpp:157:19:157:26 | password | semmle.label | password |
3536
| test3.cpp:159:15:159:20 | buffer | semmle.label | buffer |
37+
| test3.cpp:173:15:173:22 | password | semmle.label | password |
38+
| test3.cpp:181:15:181:22 | password | semmle.label | password |
39+
| test3.cpp:191:15:191:22 | password | semmle.label | password |
40+
| test3.cpp:201:15:201:22 | password | semmle.label | password |
41+
| test3.cpp:210:15:210:22 | password | semmle.label | password |
42+
| test3.cpp:219:15:219:26 | password_ptr | semmle.label | password_ptr |
43+
| test3.cpp:227:22:227:29 | password | semmle.label | password |
44+
| test3.cpp:228:26:228:33 | password | semmle.label | password |
45+
| test3.cpp:241:8:241:15 | password | semmle.label | password |
46+
| test3.cpp:242:8:242:15 | password | semmle.label | password |
3647
subpaths
3748
| test3.cpp:138:24:138:32 | password1 | test3.cpp:117:28:117:33 | buffer | test3.cpp:119:9:119:14 | buffer | test3.cpp:138:21:138:22 | call to id |
3849
#select
3950
| test3.cpp:22:3:22:6 | call to send | test3.cpp:22:15:22:23 | password1 | test3.cpp:22:15:22:23 | password1 | This operation transmits 'password1', which may contain unencrypted sensitive data from $@ | test3.cpp:22:15:22:23 | password1 | password1 |
4051
| test3.cpp:26:3:26:6 | call to send | test3.cpp:26:15:26:23 | password2 | test3.cpp:26:15:26:23 | password2 | This operation transmits 'password2', which may contain unencrypted sensitive data from $@ | test3.cpp:26:15:26:23 | password2 | password2 |
52+
| test3.cpp:38:3:38:6 | call to send | test3.cpp:38:23:38:31 | password2 | test3.cpp:38:23:38:31 | password2 | This operation transmits 'password2', which may contain unencrypted sensitive data from $@ | test3.cpp:38:23:38:31 | password2 | password2 |
4153
| test3.cpp:47:3:47:6 | call to recv | test3.cpp:47:15:47:22 | password | test3.cpp:47:15:47:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:47:15:47:22 | password | password |
4254
| test3.cpp:55:3:55:6 | call to recv | test3.cpp:55:15:55:22 | password | test3.cpp:55:15:55:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:55:15:55:22 | password | password |
4355
| test3.cpp:76:3:76:6 | call to send | test3.cpp:74:21:74:29 | password1 | test3.cpp:76:15:76:17 | ptr | This operation transmits 'ptr', which may contain unencrypted sensitive data from $@ | test3.cpp:74:21:74:29 | password1 | password1 |
@@ -47,3 +59,13 @@ subpaths
4759
| test3.cpp:140:3:140:6 | call to send | test3.cpp:138:24:138:32 | password1 | test3.cpp:140:15:140:17 | ptr | This operation transmits 'ptr', which may contain unencrypted sensitive data from $@ | test3.cpp:138:24:138:32 | password1 | password1 |
4860
| test3.cpp:146:3:146:6 | call to send | test3.cpp:126:9:126:23 | global_password | test3.cpp:146:15:146:18 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:126:9:126:23 | global_password | global_password |
4961
| test3.cpp:159:3:159:6 | call to send | test3.cpp:157:19:157:26 | password | test3.cpp:159:15:159:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:157:19:157:26 | password | password |
62+
| test3.cpp:173:3:173:6 | call to recv | test3.cpp:173:15:173:22 | password | test3.cpp:173:15:173:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:173:15:173:22 | password | password |
63+
| test3.cpp:181:3:181:6 | call to recv | test3.cpp:181:15:181:22 | password | test3.cpp:181:15:181:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:181:15:181:22 | password | password |
64+
| test3.cpp:191:3:191:6 | call to recv | test3.cpp:191:15:191:22 | password | test3.cpp:191:15:191:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:191:15:191:22 | password | password |
65+
| test3.cpp:201:3:201:6 | call to send | test3.cpp:201:15:201:22 | password | test3.cpp:201:15:201:22 | password | This operation transmits 'password', which may contain unencrypted sensitive data from $@ | test3.cpp:201:15:201:22 | password | password |
66+
| test3.cpp:210:3:210:6 | call to send | test3.cpp:210:15:210:22 | password | test3.cpp:210:15:210:22 | password | This operation transmits 'password', which may contain unencrypted sensitive data from $@ | test3.cpp:210:15:210:22 | password | password |
67+
| test3.cpp:219:3:219:6 | call to send | test3.cpp:219:15:219:26 | password_ptr | test3.cpp:219:15:219:26 | password_ptr | This operation transmits 'password_ptr', which may contain unencrypted sensitive data from $@ | test3.cpp:219:15:219:26 | password_ptr | password_ptr |
68+
| test3.cpp:227:2:227:5 | call to send | test3.cpp:227:22:227:29 | password | test3.cpp:227:22:227:29 | password | This operation transmits 'password', which may contain unencrypted sensitive data from $@ | test3.cpp:227:22:227:29 | password | password |
69+
| test3.cpp:228:2:228:5 | call to send | test3.cpp:228:26:228:33 | password | test3.cpp:228:26:228:33 | password | This operation transmits 'password', which may contain unencrypted sensitive data from $@ | test3.cpp:228:26:228:33 | password | password |
70+
| test3.cpp:241:2:241:6 | call to fgets | test3.cpp:241:8:241:15 | password | test3.cpp:241:8:241:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:241:8:241:15 | password | password |
71+
| test3.cpp:242:2:242:6 | call to fgets | test3.cpp:242:8:242:15 | password | test3.cpp:242:8:242:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:242:8:242:15 | password | password |

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

Lines changed: 87 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11

22
typedef unsigned long size_t;
33
#define STDIN_FILENO (0)
4-
5-
4+
#define STDOUT_FILENO (1)
5+
int stdout_fileno = STDOUT_FILENO;
66

77
size_t strlen(const char *s);
88

@@ -34,9 +34,9 @@ void test_send(const char *password1, const char *password2, const char *passwor
3434
send(val(), message, strlen(message), val()); // GOOD: `message` is not a password
3535
}
3636

37-
38-
39-
37+
{
38+
send(stdout_fileno, password2, strlen(password2), val()); // GOOD: `password2` is sent to stdout, not a network socket (this may be an issue but is not within the scope of the `cpp/cleartext-transmission` query) [FALSE POSITIVE]
39+
}
4040
}
4141

4242
void test_receive()
@@ -159,3 +159,85 @@ void test_taint(const char *password)
159159
send(val(), buffer, 16, val()); // BAD: `password` is (partially) sent plaintext
160160
}
161161
}
162+
163+
void encrypt_inplace(char *buffer);
164+
void decrypt_inplace(char *buffer);
165+
char *rtn_encrypt(const char *buffer);
166+
char *rtn_decrypt(const char *buffer);
167+
168+
void test_decrypt()
169+
{
170+
{
171+
char password[256];
172+
173+
recv(val(), password, 256, val()); // GOOD: password is encrypted [FALSE POSITIVE]
174+
175+
decrypt_inplace(password); // proof that `password` was in fact encrypted
176+
}
177+
178+
{
179+
char password[256];
180+
181+
recv(val(), password, 256, val()); // GOOD: password is encrypted [FALSE POSITIVE]
182+
password[255] = 0;
183+
184+
decrypt_inplace(password); // proof that `password` was in fact encrypted
185+
}
186+
187+
{
188+
char password[256];
189+
char *password_ptr;
190+
191+
recv(val(), password, 256, val()); // GOOD: password is encrypted [FALSE POSITIVE]
192+
193+
password_ptr = rtn_decrypt(password); // proof that `password` was in fact encrypted
194+
}
195+
196+
{
197+
char password[256];
198+
199+
encrypt_inplace(password); // proof that `password` is in fact encrypted
200+
201+
send(val(), password, strlen(password), val()); // GOOD: password is encrypted [FALSE POSITIVE]
202+
}
203+
204+
{
205+
char password[256];
206+
207+
encrypt_inplace(password); // proof that `password` is in fact encrypted
208+
password[255] = 0;
209+
210+
send(val(), password, strlen(password), val()); // GOOD: password is encrypted [FALSE POSITIVE]
211+
}
212+
213+
{
214+
char password[256];
215+
char *password_ptr;
216+
217+
password_ptr = rtn_encrypt(password); // proof that `password` is in fact encrypted
218+
219+
send(val(), password_ptr, strlen(password_ptr), val()); // GOOD: password is encrypted [FALSE POSITIVE]
220+
}
221+
}
222+
223+
int get_socket(int from);
224+
225+
void test_more_stdio(const char *password)
226+
{
227+
send(get_socket(1), password, 128, val()); // GOOD: `getsocket(1)` is probably standard output [FALSE POSITIVE]
228+
send(get_socket(val()), password, 128, val()); // BAD
229+
}
230+
231+
typedef struct {} FILE;
232+
char *fgets(char *s, int n, FILE *stream);
233+
234+
FILE *get_stdstream(int index);
235+
#define STDIN_STREAM (get_stdstream(0))
236+
237+
void test_fgets(FILE *stream)
238+
{
239+
char password[128];
240+
241+
fgets(password, 128, stream); // BAD
242+
fgets(password, 128, STDIN_STREAM); // GOOD: `STDIN_STREAM` is probably standard input [FALSE POSITIVE]
243+
}

0 commit comments

Comments
 (0)