Skip to content

Commit cf6f530

Browse files
geoffw0geoffw0
committed
C++: Taint through std::string operator+.
1 parent a57dfd6 commit cf6f530

File tree

5 files changed

+55
-5
lines changed

5 files changed

+55
-5
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
import semmle.code.cpp.models.interfaces.Taint
22

3+
/**
4+
* The `std::basic_string` template class.
5+
*/
6+
class StdBasicString extends TemplateClass {
7+
StdBasicString() { this.hasQualifiedName("std", "basic_string") }
8+
}
9+
310
/**
411
* The standard function `std::string.c_str`.
512
*/
@@ -13,6 +20,25 @@ class StdStringCStr extends TaintFunction {
1320
}
1421
}
1522

23+
/**
24+
* The `std::string` function `operator+`.
25+
*/
26+
class StdStringPlus extends TaintFunction {
27+
StdStringPlus() {
28+
this.hasQualifiedName("std", "operator+") and
29+
this.getParameter(0).getType().getUnspecifiedType().(ReferenceType).getBaseType() = any(StdBasicString s).getAnInstantiation()
30+
}
31+
32+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
33+
// flow from parameters to return value
34+
(
35+
input.isParameterDeref(0) or
36+
input.isParameterDeref(1)
37+
) and
38+
output.isReturnValueDeref()
39+
}
40+
}
41+
1642
/**
1743
* The `std::string` function `append`.
1844
*/

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,18 @@
519519
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:327:8:327:9 | s2 | |
520520
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:8:328:9 | s2 | |
521521
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:13:328:14 | s2 | |
522+
| stl.cpp:325:8:325:9 | s1 | stl.cpp:325:11:325:11 | call to operator+ | TAINT |
523+
| stl.cpp:325:13:325:14 | s1 | stl.cpp:325:11:325:11 | call to operator+ | TAINT |
524+
| stl.cpp:326:8:326:9 | s1 | stl.cpp:326:11:326:11 | call to operator+ | TAINT |
525+
| stl.cpp:326:13:326:14 | s2 | stl.cpp:326:11:326:11 | call to operator+ | TAINT |
526+
| stl.cpp:327:8:327:9 | s2 | stl.cpp:327:11:327:11 | call to operator+ | TAINT |
527+
| stl.cpp:327:13:327:14 | s1 | stl.cpp:327:11:327:11 | call to operator+ | TAINT |
528+
| stl.cpp:328:8:328:9 | s2 | stl.cpp:328:11:328:11 | call to operator+ | TAINT |
529+
| stl.cpp:328:13:328:14 | s2 | stl.cpp:328:11:328:11 | call to operator+ | TAINT |
530+
| stl.cpp:330:8:330:9 | s1 | stl.cpp:330:11:330:11 | call to operator+ | TAINT |
531+
| stl.cpp:330:13:330:20 | world | stl.cpp:330:11:330:11 | call to operator+ | TAINT |
532+
| stl.cpp:331:8:331:9 | s1 | stl.cpp:331:11:331:11 | call to operator+ | TAINT |
533+
| stl.cpp:331:13:331:18 | call to source | stl.cpp:331:11:331:11 | call to operator+ | TAINT |
522534
| stl.cpp:335:18:335:22 | abc | stl.cpp:335:18:335:23 | call to basic_string | TAINT |
523535
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:339:8:339:9 | s3 | |
524536
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:342:8:342:9 | s3 | |
@@ -529,8 +541,10 @@
529541
| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:339:13:339:14 | s4 | |
530542
| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:343:9:343:10 | s4 | |
531543
| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:352:13:352:14 | s4 | |
544+
| stl.cpp:339:8:339:9 | s3 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
532545
| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:339:3:339:14 | ... = ... | |
533546
| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:340:8:340:9 | s5 | |
547+
| stl.cpp:339:13:339:14 | s4 | stl.cpp:339:11:339:11 | call to operator+ | TAINT |
534548
| stl.cpp:342:8:342:9 | s3 | stl.cpp:342:3:342:9 | ... = ... | |
535549
| stl.cpp:342:8:342:9 | s3 | stl.cpp:343:3:343:4 | s6 | |
536550
| stl.cpp:342:8:342:9 | s3 | stl.cpp:344:8:344:9 | s6 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -323,12 +323,12 @@ void test_string_append() {
323323
std::string s2(source());
324324

325325
sink(s1 + s1);
326-
sink(s1 + s2); // tainted [NOT DETECTED]
327-
sink(s2 + s1); // tainted [NOT DETECTED]
328-
sink(s2 + s2); // tainted [NOT DETECTED]
326+
sink(s1 + s2); // tainted
327+
sink(s2 + s1); // tainted
328+
sink(s2 + s2); // tainted
329329

330330
sink(s1 + " world");
331-
sink(s1 + source()); // tainted [NOT DETECTED]
331+
sink(s1 + source()); // tainted
332332
}
333333

334334
{
@@ -337,7 +337,7 @@ void test_string_append() {
337337
std::string s5, s6, s7, s8, s9;
338338

339339
s5 = s3 + s4;
340-
sink(s5); // tainted [NOT DETECTED]
340+
sink(s5); // tainted
341341

342342
s6 = s3;
343343
s6 += s4;

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@
5353
| stl.cpp:303:8:303:8 | x | stl.cpp:296:43:296:49 | source1 |
5454
| stl.cpp:311:8:311:8 | x | stl.cpp:296:43:296:49 | source1 |
5555
| stl.cpp:316:8:316:8 | x | stl.cpp:296:43:296:49 | source1 |
56+
| stl.cpp:326:11:326:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
57+
| stl.cpp:327:11:327:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
58+
| stl.cpp:328:11:328:11 | call to operator+ | stl.cpp:323:18:323:23 | call to source |
59+
| stl.cpp:331:11:331:11 | call to operator+ | stl.cpp:331:13:331:18 | call to source |
60+
| stl.cpp:340:8:340:9 | s5 | stl.cpp:336:18:336:23 | call to source |
5661
| stl.cpp:353:8:353:9 | s8 | stl.cpp:336:18:336:23 | call to source |
5762
| stl.cpp:358:8:358:9 | s9 | stl.cpp:356:13:356:18 | call to source |
5863
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@
5050
| stl.cpp:303:8:303:8 | stl.cpp:296:43:296:49 | AST only |
5151
| stl.cpp:311:8:311:8 | stl.cpp:296:43:296:49 | AST only |
5252
| stl.cpp:316:8:316:8 | stl.cpp:296:43:296:49 | AST only |
53+
| stl.cpp:326:11:326:11 | stl.cpp:323:18:323:23 | AST only |
54+
| stl.cpp:327:11:327:11 | stl.cpp:323:18:323:23 | AST only |
55+
| stl.cpp:328:11:328:11 | stl.cpp:323:18:323:23 | AST only |
56+
| stl.cpp:331:11:331:11 | stl.cpp:331:13:331:18 | AST only |
57+
| stl.cpp:340:8:340:9 | stl.cpp:336:18:336:23 | AST only |
5358
| stl.cpp:353:8:353:9 | stl.cpp:336:18:336:23 | AST only |
5459
| stl.cpp:358:8:358:9 | stl.cpp:356:13:356:18 | AST only |
5560
| structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |

0 commit comments

Comments
 (0)