Skip to content

Commit f21e949

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#6007 from geoffw0/weak_crypto2
C++: Combine results for cpp/weak-cryptographic-algorithm
2 parents 3c7c10a + b24dc81 commit f21e949

File tree

2 files changed

+95
-78
lines changed

2 files changed

+95
-78
lines changed

‎cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql

Lines changed: 70 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Function getAnInsecureEncryptionFunction() {
2828
/**
2929
* A function with additional evidence it is related to encryption.
3030
*/
31-
Function getAdditionalEvidenceFunction() {
31+
Function getAnAdditionalEvidenceFunction() {
3232
(
3333
isEncryptionAdditionalEvidence(result.getName()) or
3434
isEncryptionAdditionalEvidence(result.getAParameter().getName())
@@ -47,7 +47,7 @@ Macro getAnInsecureEncryptionMacro() {
4747
/**
4848
* A macro with additional evidence it is related to encryption.
4949
*/
50-
Macro getAdditionalEvidenceMacro() {
50+
Macro getAnAdditionalEvidenceMacro() {
5151
isEncryptionAdditionalEvidence(result.getName()) and
5252
exists(result.getAnInvocation())
5353
}
@@ -63,61 +63,78 @@ EnumConstant getAnInsecureEncryptionEnumConst() { isInsecureEncryption(result.ge
6363
EnumConstant getAdditionalEvidenceEnumConst() { isEncryptionAdditionalEvidence(result.getName()) }
6464

6565
/**
66-
* A function call we have a high confidence is related to use of an insecure
67-
* encryption algorithm.
66+
* A function call we have a high confidence is related to use of an insecure encryption algorithm, along
67+
* with an associated `Element` which might be the best point to blame, and a description of that element.
6868
*/
69-
class InsecureFunctionCall extends FunctionCall {
70-
Element blame;
71-
string explain;
69+
predicate getInsecureEncryptionEvidence(FunctionCall fc, Element blame, string description) {
70+
// find use of an insecure algorithm name
71+
(
72+
fc.getTarget() = getAnInsecureEncryptionFunction() and
73+
blame = fc and
74+
description = "call to " + fc.getTarget().getName()
75+
or
76+
exists(MacroInvocation mi |
77+
(
78+
mi.getAnExpandedElement() = fc or
79+
mi.getAnExpandedElement() = fc.getAnArgument()
80+
) and
81+
mi.getMacro() = getAnInsecureEncryptionMacro() and
82+
blame = mi and
83+
description = "invocation of macro " + mi.getMacro().getName()
84+
)
85+
or
86+
exists(EnumConstantAccess ec |
87+
ec = fc.getAnArgument() and
88+
ec.getTarget() = getAnInsecureEncryptionEnumConst() and
89+
blame = ec and
90+
description = "access of enum constant " + ec.getTarget().getName()
91+
)
92+
) and
93+
// find additional evidence that this function is related to encryption.
94+
(
95+
fc.getTarget() = getAnAdditionalEvidenceFunction()
96+
or
97+
exists(MacroInvocation mi |
98+
(
99+
mi.getAnExpandedElement() = fc or
100+
mi.getAnExpandedElement() = fc.getAnArgument()
101+
) and
102+
mi.getMacro() = getAnAdditionalEvidenceMacro()
103+
)
104+
or
105+
exists(EnumConstantAccess ec |
106+
ec = fc.getAnArgument() and
107+
ec.getTarget() = getAdditionalEvidenceEnumConst()
108+
)
109+
)
110+
}
111+
112+
/**
113+
* An element that is the `blame` of an `InsecureFunctionCall`.
114+
*/
115+
class BlamedElement extends Element {
116+
string description;
117+
118+
BlamedElement() { getInsecureEncryptionEvidence(_, this, description) }
72119

73-
InsecureFunctionCall() {
74-
// find use of an insecure algorithm name
75-
(
76-
getTarget() = getAnInsecureEncryptionFunction() and
77-
blame = this and
78-
explain = "function call"
79-
or
80-
exists(MacroInvocation mi |
81-
(
82-
mi.getAnExpandedElement() = this or
83-
mi.getAnExpandedElement() = this.getAnArgument()
84-
) and
85-
mi.getMacro() = getAnInsecureEncryptionMacro() and
86-
blame = mi and
87-
explain = "macro invocation"
88-
)
89-
or
90-
exists(EnumConstantAccess ec |
91-
ec = this.getAnArgument() and
92-
ec.getTarget() = getAnInsecureEncryptionEnumConst() and
93-
blame = ec and
94-
explain = "enum constant access"
95-
)
96-
) and
97-
// find additional evidence that this function is related to encryption.
98-
(
99-
getTarget() = getAdditionalEvidenceFunction()
100-
or
101-
exists(MacroInvocation mi |
102-
(
103-
mi.getAnExpandedElement() = this or
104-
mi.getAnExpandedElement() = this.getAnArgument()
105-
) and
106-
mi.getMacro() = getAdditionalEvidenceMacro()
107-
)
108-
or
109-
exists(EnumConstantAccess ec |
110-
ec = this.getAnArgument() and
111-
ec.getTarget() = getAdditionalEvidenceEnumConst()
112-
)
120+
/**
121+
* Holds if this is the `num`-th `BlamedElement` in `f`.
122+
*/
123+
predicate hasFileRank(File f, int num) {
124+
exists(int loc |
125+
getLocation().charLoc(f, loc, _) and
126+
loc =
127+
rank[num](BlamedElement other, int loc2 | other.getLocation().charLoc(f, loc2, _) | loc2)
113128
)
114129
}
115130

116-
Element getBlame() { result = blame }
117-
118-
string getDescription() { result = explain }
131+
string getDescription() { result = description }
119132
}
120133

121-
from InsecureFunctionCall c
122-
select c.getBlame(),
123-
"This " + c.getDescription() + " specifies a broken or weak cryptographic algorithm."
134+
from File f, BlamedElement firstResult, BlamedElement thisResult
135+
where
136+
firstResult.hasFileRank(f, 1) and
137+
thisResult.hasFileRank(f, _)
138+
select firstResult,
139+
"This file makes use of a broken or weak cryptographic algorithm (specified by $@).", thisResult,
140+
thisResult.getDescription()

‎cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.expected

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
1-
| test2.cpp:49:4:49:24 | call to my_des_implementation | This function call specifies a broken or weak cryptographic algorithm. |
2-
| test2.cpp:62:33:62:40 | ALGO_DES | This macro invocation specifies a broken or weak cryptographic algorithm. |
3-
| test2.cpp:124:4:124:24 | call to my_des_implementation | This function call specifies a broken or weak cryptographic algorithm. |
4-
| test2.cpp:144:27:144:29 | DES | This enum constant access specifies a broken or weak cryptographic algorithm. |
5-
| test2.cpp:172:28:172:35 | ALGO_DES | This macro invocation specifies a broken or weak cryptographic algorithm. |
6-
| test2.cpp:175:28:175:34 | USE_DES | This enum constant access specifies a broken or weak cryptographic algorithm. |
7-
| test2.cpp:182:38:182:45 | ALGO_DES | This macro invocation specifies a broken or weak cryptographic algorithm. |
8-
| test2.cpp:185:38:185:44 | USE_DES | This enum constant access specifies a broken or weak cryptographic algorithm. |
9-
| test2.cpp:238:2:238:20 | call to encrypt | This function call specifies a broken or weak cryptographic algorithm. |
10-
| test2.cpp:245:5:245:11 | call to encrypt | This function call specifies a broken or weak cryptographic algorithm. |
11-
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
12-
| test.cpp:39:2:39:31 | ENCRYPT_WITH_RC2(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
13-
| test.cpp:41:2:41:32 | ENCRYPT_WITH_3DES(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
14-
| test.cpp:42:2:42:38 | ENCRYPT_WITH_TRIPLE_DES(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
15-
| test.cpp:51:2:51:32 | DES_DO_ENCRYPTION(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
16-
| test.cpp:52:2:52:31 | RUN_DES_ENCODING(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
17-
| test.cpp:53:2:53:25 | DES_ENCODE(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
18-
| test.cpp:54:2:54:26 | DES_SET_KEY(data,amount) | This macro invocation specifies a broken or weak cryptographic algorithm. |
19-
| test.cpp:88:2:88:11 | call to encryptDES | This function call specifies a broken or weak cryptographic algorithm. |
20-
| test.cpp:89:2:89:11 | call to encryptRC2 | This function call specifies a broken or weak cryptographic algorithm. |
21-
| test.cpp:91:2:91:12 | call to encrypt3DES | This function call specifies a broken or weak cryptographic algorithm. |
22-
| test.cpp:92:2:92:17 | call to encryptTripleDES | This function call specifies a broken or weak cryptographic algorithm. |
23-
| test.cpp:101:2:101:15 | call to do_des_encrypt | This function call specifies a broken or weak cryptographic algorithm. |
24-
| test.cpp:102:2:102:12 | call to DES_Set_Key | This function call specifies a broken or weak cryptographic algorithm. |
25-
| test.cpp:121:2:121:24 | INIT_ENCRYPT_WITH_DES() | This macro invocation specifies a broken or weak cryptographic algorithm. |
1+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:49:4:49:24 | call to my_des_implementation | call to my_des_implementation |
2+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:62:33:62:40 | ALGO_DES | invocation of macro ALGO_DES |
3+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:124:4:124:24 | call to my_des_implementation | call to my_des_implementation |
4+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:144:27:144:29 | DES | access of enum constant DES |
5+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:172:28:172:35 | ALGO_DES | invocation of macro ALGO_DES |
6+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:175:28:175:34 | USE_DES | access of enum constant USE_DES |
7+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:182:38:182:45 | ALGO_DES | invocation of macro ALGO_DES |
8+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:185:38:185:44 | USE_DES | access of enum constant USE_DES |
9+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:238:2:238:20 | call to encrypt | call to encrypt |
10+
| test2.cpp:49:4:49:24 | call to my_des_implementation | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test2.cpp:245:5:245:11 | call to encrypt | call to encrypt |
11+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | invocation of macro ENCRYPT_WITH_DES |
12+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:39:2:39:31 | ENCRYPT_WITH_RC2(data,amount) | invocation of macro ENCRYPT_WITH_RC2 |
13+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:41:2:41:32 | ENCRYPT_WITH_3DES(data,amount) | invocation of macro ENCRYPT_WITH_3DES |
14+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:42:2:42:38 | ENCRYPT_WITH_TRIPLE_DES(data,amount) | invocation of macro ENCRYPT_WITH_TRIPLE_DES |
15+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:51:2:51:32 | DES_DO_ENCRYPTION(data,amount) | invocation of macro DES_DO_ENCRYPTION |
16+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:52:2:52:31 | RUN_DES_ENCODING(data,amount) | invocation of macro RUN_DES_ENCODING |
17+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:53:2:53:25 | DES_ENCODE(data,amount) | invocation of macro DES_ENCODE |
18+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:54:2:54:26 | DES_SET_KEY(data,amount) | invocation of macro DES_SET_KEY |
19+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:88:2:88:11 | call to encryptDES | call to encryptDES |
20+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:89:2:89:11 | call to encryptRC2 | call to encryptRC2 |
21+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:91:2:91:12 | call to encrypt3DES | call to encrypt3DES |
22+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:92:2:92:17 | call to encryptTripleDES | call to encryptTripleDES |
23+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:101:2:101:15 | call to do_des_encrypt | call to do_des_encrypt |
24+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:102:2:102:12 | call to DES_Set_Key | call to DES_Set_Key |
25+
| test.cpp:38:2:38:31 | ENCRYPT_WITH_DES(data,amount) | This file makes use of a broken or weak cryptographic algorithm (specified by $@). | test.cpp:121:2:121:24 | INIT_ENCRYPT_WITH_DES() | invocation of macro INIT_ENCRYPT_WITH_DES |

0 commit comments

Comments
 (0)