Skip to content

Commit ee7ccd7

Browse files
geoffw0geoffw0
committed
C++: Upgrade to path problem.
1 parent f58177f commit ee7ccd7

File tree

2 files changed

+56
-18
lines changed

2 files changed

+56
-18
lines changed

‎cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Cleartext transmission of sensitive information
33
* @description Transmitting sensitive information across a network in
44
* cleartext can expose it to an attacker.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity warning
77
* @security-severity 7.5 TODO
88
* @precision high TODO
@@ -14,6 +14,7 @@
1414
import cpp
1515
import semmle.code.cpp.security.SensitiveExprs
1616
import semmle.code.cpp.dataflow.DataFlow
17+
import DataFlow::PathGraph
1718

1819
/**
1920
* A function call that sends or receives data over a network.
@@ -83,11 +84,19 @@ class SensitiveSendRecvConfiguration extends DataFlow::Configuration {
8384
}
8485
}
8586

86-
from SensitiveSendRecvConfiguration config1, Expr source, Expr sink
87+
from
88+
SensitiveSendRecvConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink,
89+
NetworkSendRecv transmission, string msg
8790
where
88-
exists(DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode |
89-
config1.hasFlowPath(sourceNode, sinkNode) and
90-
source = sourceNode.getNode().asExpr() and
91-
sink = sinkNode.getNode().asExpr()
92-
)
93-
select sink, source
91+
config.hasFlowPath(source, sink) and
92+
sink.getNode().asExpr() = transmission.getDataExpr() and
93+
if transmission instanceof NetworkSend
94+
then
95+
msg =
96+
"This operation transmits '" + sink.toString() +
97+
"', which may contain unencrypted sensitive data from $@"
98+
else
99+
msg =
100+
"This operation receives into '" + sink.toString() +
101+
"', which may put unencrypted sensitive data into $@"
102+
select transmission, source, sink, msg, source, source.getNode().asExpr().toString()

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,39 @@
1-
| test3.cpp:20:15:20:23 | password1 | test3.cpp:20:15:20:23 | password1 |
2-
| test3.cpp:24:15:24:23 | password2 | test3.cpp:24:15:24:23 | password2 |
3-
| test3.cpp:41:15:41:22 | password | test3.cpp:41:15:41:22 | password |
4-
| test3.cpp:49:15:49:22 | password | test3.cpp:49:15:49:22 | password |
5-
| test3.cpp:70:15:70:17 | ptr | test3.cpp:68:21:68:29 | password1 |
6-
| test3.cpp:77:15:77:17 | ptr | test3.cpp:75:15:75:22 | password |
7-
| test3.cpp:95:12:95:19 | password | test3.cpp:95:12:95:19 | password |
8-
| test3.cpp:108:14:108:19 | buffer | test3.cpp:128:11:128:18 | password |
9-
| test3.cpp:134:15:134:17 | ptr | test3.cpp:132:24:132:32 | password1 |
10-
| test3.cpp:140:15:140:18 | data | test3.cpp:120:9:120:23 | global_password |
1+
edges
2+
| test3.cpp:68:21:68:29 | password1 | test3.cpp:70:15:70:17 | ptr |
3+
| test3.cpp:75:15:75:22 | password | test3.cpp:77:15:77:17 | ptr |
4+
| test3.cpp:106:20:106:25 | buffer | test3.cpp:108:14:108:19 | buffer |
5+
| test3.cpp:120:9:120:23 | global_password | test3.cpp:138:16:138:29 | call to get_global_str |
6+
| test3.cpp:128:11:128:18 | password | test3.cpp:106:20:106:25 | buffer |
7+
| test3.cpp:132:21:132:22 | call to id | test3.cpp:134:15:134:17 | ptr |
8+
| test3.cpp:132:24:132:32 | password1 | test3.cpp:132:21:132:22 | call to id |
9+
| test3.cpp:138:16:138:29 | call to get_global_str | test3.cpp:140:15:140:18 | data |
10+
nodes
11+
| test3.cpp:20:15:20:23 | password1 | semmle.label | password1 |
12+
| test3.cpp:24:15:24:23 | password2 | semmle.label | password2 |
13+
| test3.cpp:41:15:41:22 | password | semmle.label | password |
14+
| test3.cpp:49:15:49:22 | password | semmle.label | password |
15+
| test3.cpp:68:21:68:29 | password1 | semmle.label | password1 |
16+
| test3.cpp:70:15:70:17 | ptr | semmle.label | ptr |
17+
| test3.cpp:75:15:75:22 | password | semmle.label | password |
18+
| test3.cpp:77:15:77:17 | ptr | semmle.label | ptr |
19+
| test3.cpp:95:12:95:19 | password | semmle.label | password |
20+
| test3.cpp:106:20:106:25 | buffer | semmle.label | buffer |
21+
| test3.cpp:108:14:108:19 | buffer | semmle.label | buffer |
22+
| test3.cpp:120:9:120:23 | global_password | semmle.label | global_password |
23+
| test3.cpp:128:11:128:18 | password | semmle.label | password |
24+
| test3.cpp:132:21:132:22 | call to id | semmle.label | call to id |
25+
| test3.cpp:132:24:132:32 | password1 | semmle.label | password1 |
26+
| test3.cpp:134:15:134:17 | ptr | semmle.label | ptr |
27+
| test3.cpp:138:16:138:29 | call to get_global_str | semmle.label | call to get_global_str |
28+
| test3.cpp:140:15:140:18 | data | semmle.label | data |
29+
#select
30+
| test3.cpp:20:3:20:6 | call to send | test3.cpp:20:15:20:23 | password1 | test3.cpp:20:15:20:23 | password1 | This operation transmits 'password1', which may contain unencrypted sensitive data from $@ | test3.cpp:20:15:20:23 | password1 | password1 |
31+
| test3.cpp:24:3:24:6 | call to send | test3.cpp:24:15:24:23 | password2 | test3.cpp:24:15:24:23 | password2 | This operation transmits 'password2', which may contain unencrypted sensitive data from $@ | test3.cpp:24:15:24:23 | password2 | password2 |
32+
| test3.cpp:41:3:41:6 | call to recv | test3.cpp:41:15:41:22 | password | test3.cpp:41:15:41:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:41:15:41:22 | password | password |
33+
| test3.cpp:49:3:49:6 | call to recv | test3.cpp:49:15:49:22 | password | test3.cpp:49:15:49:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:49:15:49:22 | password | password |
34+
| test3.cpp:70:3:70:6 | call to send | test3.cpp:68:21:68:29 | password1 | test3.cpp:70:15:70:17 | ptr | This operation transmits 'ptr', which may contain unencrypted sensitive data from $@ | test3.cpp:68:21:68:29 | password1 | password1 |
35+
| test3.cpp:77:3:77:6 | call to recv | test3.cpp:75:15:75:22 | password | test3.cpp:77:15:77:17 | ptr | This operation receives into 'ptr', which may put unencrypted sensitive data into $@ | test3.cpp:75:15:75:22 | password | password |
36+
| test3.cpp:95:3:95:6 | call to read | test3.cpp:95:12:95:19 | password | test3.cpp:95:12:95:19 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:95:12:95:19 | password | password |
37+
| test3.cpp:108:2:108:5 | call to recv | test3.cpp:128:11:128:18 | password | test3.cpp:108:14:108:19 | buffer | This operation receives into 'buffer', which may put unencrypted sensitive data into $@ | test3.cpp:128:11:128:18 | password | password |
38+
| test3.cpp:134:3:134:6 | call to send | test3.cpp:132:24:132:32 | password1 | test3.cpp:134:15:134:17 | ptr | This operation transmits 'ptr', which may contain unencrypted sensitive data from $@ | test3.cpp:132:24:132:32 | password1 | password1 |
39+
| test3.cpp:140:3:140:6 | call to send | test3.cpp:120:9:120:23 | global_password | test3.cpp:140:15:140:18 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:120:9:120:23 | global_password | global_password |

0 commit comments

Comments
 (0)