Skip to content

Commit 91b9b78

Browse files
geoffw0geoffw0
committed
C++: Add a test case for CWE-114 involving pointers and references.
1 parent 1b8f3c4 commit 91b9b78

File tree

2 files changed

+75
-0
lines changed

2 files changed

+75
-0
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.expected

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,22 @@ edges
77
| test.cpp:42:18:42:34 | (const char *)... | test.cpp:24:30:24:36 | command |
88
| test.cpp:43:18:43:23 | call to getenv | test.cpp:29:30:29:36 | command |
99
| test.cpp:43:18:43:34 | (const char *)... | test.cpp:29:30:29:36 | command |
10+
| test.cpp:56:12:56:17 | buffer | test.cpp:62:10:62:15 | (const char *)... |
11+
| test.cpp:56:12:56:17 | buffer | test.cpp:62:10:62:15 | buffer |
12+
| test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | (const char *)... |
13+
| test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | data |
14+
| test.cpp:56:12:56:17 | fgets output argument | test.cpp:62:10:62:15 | (const char *)... |
15+
| test.cpp:56:12:56:17 | fgets output argument | test.cpp:62:10:62:15 | buffer |
16+
| test.cpp:56:12:56:17 | fgets output argument | test.cpp:63:10:63:13 | (const char *)... |
17+
| test.cpp:56:12:56:17 | fgets output argument | test.cpp:63:10:63:13 | data |
18+
| test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | (const char *)... |
19+
| test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | buffer |
20+
| test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | (const char *)... |
21+
| test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | data |
22+
| test.cpp:76:12:76:17 | fgets output argument | test.cpp:78:10:78:15 | (const char *)... |
23+
| test.cpp:76:12:76:17 | fgets output argument | test.cpp:78:10:78:15 | buffer |
24+
| test.cpp:76:12:76:17 | fgets output argument | test.cpp:79:10:79:13 | (const char *)... |
25+
| test.cpp:76:12:76:17 | fgets output argument | test.cpp:79:10:79:13 | data |
1026
nodes
1127
| test.cpp:24:30:24:36 | command | semmle.label | command |
1228
| test.cpp:26:10:26:16 | command | semmle.label | command |
@@ -20,6 +36,26 @@ nodes
2036
| test.cpp:42:18:42:34 | (const char *)... | semmle.label | (const char *)... |
2137
| test.cpp:43:18:43:23 | call to getenv | semmle.label | call to getenv |
2238
| test.cpp:43:18:43:34 | (const char *)... | semmle.label | (const char *)... |
39+
| test.cpp:56:12:56:17 | buffer | semmle.label | buffer |
40+
| test.cpp:56:12:56:17 | fgets output argument | semmle.label | fgets output argument |
41+
| test.cpp:62:10:62:15 | (const char *)... | semmle.label | (const char *)... |
42+
| test.cpp:62:10:62:15 | (const char *)... | semmle.label | (const char *)... |
43+
| test.cpp:62:10:62:15 | buffer | semmle.label | buffer |
44+
| test.cpp:63:10:63:13 | (const char *)... | semmle.label | (const char *)... |
45+
| test.cpp:63:10:63:13 | (const char *)... | semmle.label | (const char *)... |
46+
| test.cpp:63:10:63:13 | data | semmle.label | data |
47+
| test.cpp:76:12:76:17 | buffer | semmle.label | buffer |
48+
| test.cpp:76:12:76:17 | fgets output argument | semmle.label | fgets output argument |
49+
| test.cpp:78:10:78:15 | (const char *)... | semmle.label | (const char *)... |
50+
| test.cpp:78:10:78:15 | (const char *)... | semmle.label | (const char *)... |
51+
| test.cpp:78:10:78:15 | buffer | semmle.label | buffer |
52+
| test.cpp:79:10:79:13 | (const char *)... | semmle.label | (const char *)... |
53+
| test.cpp:79:10:79:13 | (const char *)... | semmle.label | (const char *)... |
54+
| test.cpp:79:10:79:13 | data | semmle.label | data |
2355
#select
2456
| test.cpp:26:10:26:16 | command | test.cpp:42:18:42:23 | call to getenv | test.cpp:26:10:26:16 | command | The value of this argument may come from $@ and is being passed to system | test.cpp:42:18:42:23 | call to getenv | call to getenv |
2557
| test.cpp:31:10:31:16 | command | test.cpp:43:18:43:23 | call to getenv | test.cpp:31:10:31:16 | command | The value of this argument may come from $@ and is being passed to system | test.cpp:43:18:43:23 | call to getenv | call to getenv |
58+
| test.cpp:62:10:62:15 | buffer | test.cpp:56:12:56:17 | buffer | test.cpp:62:10:62:15 | buffer | The value of this argument may come from $@ and is being passed to system | test.cpp:56:12:56:17 | buffer | buffer |
59+
| test.cpp:63:10:63:13 | data | test.cpp:56:12:56:17 | buffer | test.cpp:63:10:63:13 | data | The value of this argument may come from $@ and is being passed to system | test.cpp:56:12:56:17 | buffer | buffer |
60+
| test.cpp:78:10:78:15 | buffer | test.cpp:76:12:76:17 | buffer | test.cpp:78:10:78:15 | buffer | The value of this argument may come from $@ and is being passed to system | test.cpp:76:12:76:17 | buffer | buffer |
61+
| test.cpp:79:10:79:13 | data | test.cpp:76:12:76:17 | buffer | test.cpp:79:10:79:13 | data | The value of this argument may come from $@ and is being passed to system | test.cpp:76:12:76:17 | buffer | buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,42 @@ void testMyDerived()
4242
md2->doCommand2(getenv("varname"));
4343
md3->doCommand3(getenv("varname"));
4444
}
45+
46+
// ---
47+
48+
typedef struct {} FILE;
49+
char *fgets(char *s, int n, FILE *stream);
50+
FILE *stdin;
51+
52+
void testReferencePointer1()
53+
{
54+
char buffer[1024];
55+
56+
if (fgets(buffer, 1024, stdin) != 0)
57+
{
58+
char *data = buffer;
59+
char *&dataref = data;
60+
char *data2 = dataref;
61+
62+
system(buffer); // BAD
63+
system(data); // BAD
64+
system(dataref); // BAD [NOT DETECTED]
65+
system(data2); // BAD [NOT DETECTED]
66+
}
67+
}
68+
69+
void testReferencePointer2()
70+
{
71+
char buffer[1024];
72+
char *data = buffer;
73+
char *&dataref = data;
74+
char *data2 = dataref;
75+
76+
if (fgets(buffer, 1024, stdin) != 0)
77+
{
78+
system(buffer); // BAD
79+
system(data); // BAD
80+
system(dataref); // BAD [NOT DETECTED]
81+
system(data2); // BAD [NOT DETECTED]
82+
}
83+
}

0 commit comments

Comments
 (0)