Skip to content

Commit cb0ac61

Browse files
redsun82redsun82
authored
Merge pull request #18069 from geoffw0/sourcemodels
Rust: Add some flow source models
2 parents d73dcd6 + 1090164 commit cb0ac61

File tree

14 files changed

+293
-0
lines changed

14 files changed

+293
-0
lines changed

‎rust/ql/lib/codeql/rust/Concepts.qll‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
private import codeql.rust.dataflow.DataFlow
88
private import codeql.threatmodels.ThreatModels
9+
private import codeql.rust.Frameworks
910

1011
/**
1112
* A data flow source for a specific threat-model.
@@ -46,6 +47,63 @@ class ActiveThreatModelSource extends ThreatModelSource {
4647
ActiveThreatModelSource() { currentThreatModel(this.getThreatModel()) }
4748
}
4849

50+
/**
51+
* A data flow source corresponding to the program's command line arguments or path.
52+
*/
53+
final class CommandLineArgsSource = CommandLineArgsSource::Range;
54+
55+
/**
56+
* Provides a class for modeling new sources for the program's command line arguments or path.
57+
*/
58+
module CommandLineArgsSource {
59+
/**
60+
* A data flow source corresponding to the program's command line arguments or path.
61+
*/
62+
abstract class Range extends ThreatModelSource::Range {
63+
override string getThreatModel() { result = "commandargs" }
64+
65+
override string getSourceType() { result = "CommandLineArgs" }
66+
}
67+
}
68+
69+
/**
70+
* A data flow source corresponding to the program's environment.
71+
*/
72+
final class EnvironmentSource = EnvironmentSource::Range;
73+
74+
/**
75+
* Provides a class for modeling new sources for the program's environment.
76+
*/
77+
module EnvironmentSource {
78+
/**
79+
* A data flow source corresponding to the program's environment.
80+
*/
81+
abstract class Range extends ThreatModelSource::Range {
82+
override string getThreatModel() { result = "environment" }
83+
84+
override string getSourceType() { result = "EnvironmentSource" }
85+
}
86+
}
87+
88+
/**
89+
* A data flow source for remote (network) data.
90+
*/
91+
final class RemoteSource = RemoteSource::Range;
92+
93+
/**
94+
* Provides a class for modeling new sources of remote (network) data.
95+
*/
96+
module RemoteSource {
97+
/**
98+
* A data flow source for remote (network) data.
99+
*/
100+
abstract class Range extends ThreatModelSource::Range {
101+
override string getThreatModel() { result = "remote" }
102+
103+
override string getSourceType() { result = "RemoteSource" }
104+
}
105+
}
106+
49107
/**
50108
* A data-flow node that constructs a SQL statement.
51109
*

‎rust/ql/lib/codeql/rust/Frameworks.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
/**
2+
* This file imports all models of frameworks and libraries.
3+
*/
4+
5+
private import codeql.rust.frameworks.Reqwest
6+
private import codeql.rust.frameworks.stdlib.Env

‎rust/ql/lib/codeql/rust/frameworks/Reqwest.qll‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Provides modeling for the `reqwest` library.
3+
*/
4+
5+
private import rust
6+
private import codeql.rust.Concepts
7+
8+
/**
9+
* A call to `reqwest::get` or `reqwest::blocking::get`.
10+
*/
11+
private class ReqwestGet extends RemoteSource::Range {
12+
ReqwestGet() {
13+
exists(CallExpr ce |
14+
this.asExpr().getExpr() = ce and
15+
ce.getExpr().(PathExpr).getPath().getResolvedCrateOrigin().matches("%reqwest") and
16+
ce.getExpr().(PathExpr).getPath().getResolvedPath() = ["crate::get", "crate::blocking::get"]
17+
)
18+
}
19+
}

‎rust/ql/lib/codeql/rust/frameworks/stdlib/Env.qll‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* Provides modeling for the `std::env` library.
3+
*/
4+
5+
private import rust
6+
private import codeql.rust.Concepts
7+
8+
/**
9+
* A call to `std::env::args` or `std::env::args_os`.
10+
*/
11+
private class StdEnvArgs extends CommandLineArgsSource::Range {
12+
StdEnvArgs() {
13+
this.asExpr().getExpr().(CallExpr).getExpr().(PathExpr).getPath().getResolvedPath() =
14+
["crate::env::args", "crate::env::args_os"]
15+
}
16+
}
17+
18+
/**
19+
* A call to `std::env::current_dir`, `std::env::current_exe` or `std::env::home_dir`.
20+
*/
21+
private class StdEnvDir extends CommandLineArgsSource::Range {
22+
StdEnvDir() {
23+
this.asExpr().getExpr().(CallExpr).getExpr().(PathExpr).getPath().getResolvedPath() =
24+
["crate::env::current_dir", "crate::env::current_exe", "crate::env::home_dir"]
25+
}
26+
}
27+
28+
/**
29+
* A call to `std::env::var`, `std::env::var_os`, `std::env::vars` or `std::env::vars_os`.
30+
*/
31+
private class StdEnvVar extends EnvironmentSource::Range {
32+
StdEnvVar() {
33+
this.asExpr().getExpr().(CallExpr).getExpr().(PathExpr).getPath().getResolvedPath() =
34+
["crate::env::var", "crate::env::var_os", "crate::env::vars", "crate::env::vars_os"]
35+
}
36+
}

‎rust/ql/src/queries/summary/SummaryStats.ql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
*/
88

99
import rust
10+
import codeql.rust.Concepts
1011
import codeql.rust.Diagnostics
1112
import Stats
1213

@@ -43,4 +44,8 @@ where
4344
key = "Macro calls - resolved" and value = count(MacroCall mc | mc.hasExpanded())
4445
or
4546
key = "Macro calls - unresolved" and value = count(MacroCall mc | not mc.hasExpanded())
47+
or
48+
key = "Taint sources - total" and value = count(ThreatModelSource s)
49+
or
50+
key = "Taint sources - active" and value = count(ActiveThreatModelSource s)
4651
select key, value order by key

‎rust/ql/src/queries/summary/TaintSources.ql‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* @name Taint Sources
3+
* @description List all sources of untrusted input that have been idenfitied
4+
* in the database.
5+
* @kind problem
6+
* @problem.severity info
7+
* @id rust/summary/taint-sources
8+
* @tags summary
9+
*/
10+
11+
import rust
12+
import codeql.rust.Concepts
13+
14+
from ThreatModelSource s, string defaultString
15+
where
16+
if s instanceof ActiveThreatModelSource then defaultString = " (DEFAULT)" else defaultString = ""
17+
select s,
18+
"Flow source '" + s.getSourceType() + "' of type " + s.getThreatModel() + defaultString + "."

‎rust/ql/test/library-tests/dataflow/sources/InlineFlow.expected‎

Whitespace-only changes.

‎rust/ql/test/library-tests/dataflow/sources/InlineFlow.ql‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
import rust
2+
import codeql.rust.dataflow.DataFlow
3+
import codeql.rust.Concepts
4+
import utils.InlineFlowTest
5+
6+
/**
7+
* Configuration for flow from any threat model source to an argument of the function `sink`.
8+
*/
9+
module MyFlowConfig implements DataFlow::ConfigSig {
10+
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelSource }
11+
12+
predicate isSink(DataFlow::Node sink) {
13+
any(CallExpr call | call.getExpr().(PathExpr).getPath().getResolvedPath() = "crate::test::sink")
14+
.getArgList()
15+
.getAnArg() = sink.asExpr().getExpr()
16+
}
17+
}
18+
19+
module MyFlowTest = TaintFlowTest<MyFlowConfig>;
20+
21+
import MyFlowTest

‎rust/ql/test/library-tests/dataflow/sources/TaintSources.expected‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
| test.rs:8:10:8:30 | ...::var(...) | Flow source 'EnvironmentSource' of type environment. |
2+
| test.rs:9:10:9:33 | ...::var_os(...) | Flow source 'EnvironmentSource' of type environment. |
3+
| test.rs:11:16:11:36 | ...::var(...) | Flow source 'EnvironmentSource' of type environment. |
4+
| test.rs:12:16:12:39 | ...::var_os(...) | Flow source 'EnvironmentSource' of type environment. |
5+
| test.rs:17:25:17:40 | ...::vars(...) | Flow source 'EnvironmentSource' of type environment. |
6+
| test.rs:22:25:22:43 | ...::vars_os(...) | Flow source 'EnvironmentSource' of type environment. |
7+
| test.rs:29:29:29:44 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs. |
8+
| test.rs:32:16:32:31 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs. |
9+
| test.rs:33:16:33:34 | ...::args_os(...) | Flow source 'CommandLineArgs' of type commandargs. |
10+
| test.rs:40:16:40:31 | ...::args(...) | Flow source 'CommandLineArgs' of type commandargs. |
11+
| test.rs:44:16:44:34 | ...::args_os(...) | Flow source 'CommandLineArgs' of type commandargs. |
12+
| test.rs:50:15:50:37 | ...::current_dir(...) | Flow source 'CommandLineArgs' of type commandargs. |
13+
| test.rs:51:15:51:37 | ...::current_exe(...) | Flow source 'CommandLineArgs' of type commandargs. |
14+
| test.rs:52:16:52:35 | ...::home_dir(...) | Flow source 'CommandLineArgs' of type commandargs. |
15+
| test.rs:60:26:60:70 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
16+
| test.rs:63:26:63:70 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |
17+
| test.rs:66:26:66:60 | ...::get(...) | Flow source 'RemoteSource' of type remote (DEFAULT). |

‎rust/ql/test/library-tests/dataflow/sources/TaintSources.qlref‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
query: queries/summary/TaintSources.ql
2+
postprocess: utils/InlineExpectationsTestQuery.ql

0 commit comments

Comments
 (0)