Skip to content

Commit 8ee03e4

Browse files
bdrodesbdrodes
committed
Crypto: Fix cpp-specific code scanning alert failure
1 parent 16c6411 commit 8ee03e4

File tree

9 files changed

+50
-48
lines changed

9 files changed

+50
-48
lines changed

‎cpp/ql/lib/experimental/quantum/Language.qll

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ module ArtifactFlowConfig implements DataFlow::ConfigSig {
5656
module ArtifactFlow = DataFlow::Global<ArtifactFlowConfig>;
5757

5858
/**
59-
* Artifact output to node input configuration
59+
* An artifact output to node input configuration
6060
*/
6161
abstract class AdditionalFlowInputStep extends DataFlow::Node {
6262
abstract DataFlow::Node getOutput();
@@ -91,9 +91,8 @@ module GenericDataSourceFlowConfig implements DataFlow::ConfigSig {
9191

9292
module GenericDataSourceFlow = TaintTracking::Global<GenericDataSourceFlowConfig>;
9393

94-
private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof Literal {
95-
ConstantDataSource() { this instanceof OpenSslGenericSourceCandidateLiteral }
96-
94+
private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof OpenSslGenericSourceCandidateLiteral
95+
{
9796
override DataFlow::Node getOutputNode() { result.asExpr() = this }
9897

9998
override predicate flowsTo(Crypto::FlowAwareElement other) {

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ module KnownOpenSslAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::
4848
module KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow =
4949
DataFlow::Global<KnownOpenSslAlgorithmToAlgorithmValueConsumerConfig>;
5050

51-
module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
51+
module RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
5252
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSslPaddingLiteral }
5353

5454
predicate isSink(DataFlow::Node sink) {
@@ -60,8 +60,8 @@ module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataF
6060
}
6161
}
6262

63-
module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow =
64-
DataFlow::Global<RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig>;
63+
module RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow =
64+
DataFlow::Global<RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig>;
6565

6666
class OpenSslAlgorithmAdditionalFlowStep extends AdditionalFlowInputStep {
6767
OpenSslAlgorithmAdditionalFlowStep() { exists(AlgorithmPassthroughCall c | c.getInNode() = this) }
@@ -114,11 +114,11 @@ class CopyAndDupAlgorithmPassthroughCall extends AlgorithmPassthroughCall {
114114
override DataFlow::Node getOutNode() { result = outNode }
115115
}
116116

117-
class NIDToPointerPassthroughCall extends AlgorithmPassthroughCall {
117+
class NidToPointerPassthroughCall extends AlgorithmPassthroughCall {
118118
DataFlow::Node inNode;
119119
DataFlow::Node outNode;
120120

121-
NIDToPointerPassthroughCall() {
121+
NidToPointerPassthroughCall() {
122122
this.getTarget().getName() in ["OBJ_nid2obj", "OBJ_nid2ln", "OBJ_nid2sn"] and
123123
inNode.asExpr() = this.getArgument(0) and
124124
outNode.asExpr() = this
@@ -150,11 +150,11 @@ class PointerToPointerPassthroughCall extends AlgorithmPassthroughCall {
150150
override DataFlow::Node getOutNode() { result = outNode }
151151
}
152152

153-
class PointerToNIDPassthroughCall extends AlgorithmPassthroughCall {
153+
class PointerToNidPassthroughCall extends AlgorithmPassthroughCall {
154154
DataFlow::Node inNode;
155155
DataFlow::Node outNode;
156156

157-
PointerToNIDPassthroughCall() {
157+
PointerToNidPassthroughCall() {
158158
this.getTarget().getName() in ["OBJ_obj2nid", "OBJ_ln2nid", "OBJ_sn2nid", "OBJ_txt2nid"] and
159159
(
160160
inNode.asIndirectExpr() = this.getArgument(0)

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,25 +16,25 @@ predicate knownOpenSslConstantToBlockModeFamilyType(
1616
exists(string name |
1717
name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
1818
(
19-
name.matches("CBC") and type instanceof Crypto::CBC
19+
name = "CBC" and type instanceof Crypto::CBC
2020
or
21-
name.matches("CFB%") and type instanceof Crypto::CFB
21+
name = "CFB%" and type instanceof Crypto::CFB
2222
or
23-
name.matches("CTR") and type instanceof Crypto::CTR
23+
name = "CTR" and type instanceof Crypto::CTR
2424
or
25-
name.matches("GCM") and type instanceof Crypto::GCM
25+
name = "GCM" and type instanceof Crypto::GCM
2626
or
27-
name.matches("OFB") and type instanceof Crypto::OFB
27+
name = "OFB" and type instanceof Crypto::OFB
2828
or
29-
name.matches("XTS") and type instanceof Crypto::XTS
29+
name = "XTS" and type instanceof Crypto::XTS
3030
or
31-
name.matches("CCM") and type instanceof Crypto::CCM
31+
name = "CCM" and type instanceof Crypto::CCM
3232
or
33-
name.matches("GCM") and type instanceof Crypto::GCM
33+
name = "GCM" and type instanceof Crypto::GCM
3434
or
35-
name.matches("CCM") and type instanceof Crypto::CCM
35+
name = "CCM" and type instanceof Crypto::CCM
3636
or
37-
name.matches("ECB") and type instanceof Crypto::ECB
37+
name = "ECB" and type instanceof Crypto::ECB
3838
)
3939
)
4040
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,35 +11,35 @@ predicate knownOpenSslConstantToHashFamilyType(
1111
exists(string name |
1212
name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
1313
(
14-
name.matches("BLAKE2B") and type instanceof Crypto::BLAKE2B
14+
name = "BLAKE2B" and type instanceof Crypto::BLAKE2B
1515
or
16-
name.matches("BLAKE2S") and type instanceof Crypto::BLAKE2S
16+
name = "BLAKE2S" and type instanceof Crypto::BLAKE2S
1717
or
1818
name.matches("GOST%") and type instanceof Crypto::GOSTHash
1919
or
20-
name.matches("MD2") and type instanceof Crypto::MD2
20+
name = "MD2" and type instanceof Crypto::MD2
2121
or
22-
name.matches("MD4") and type instanceof Crypto::MD4
22+
name = "MD4" and type instanceof Crypto::MD4
2323
or
24-
name.matches("MD5") and type instanceof Crypto::MD5
24+
name = "MD5" and type instanceof Crypto::MD5
2525
or
26-
name.matches("MDC2") and type instanceof Crypto::MDC2
26+
name = "MDC2" and type instanceof Crypto::MDC2
2727
or
28-
name.matches("POLY1305") and type instanceof Crypto::POLY1305
28+
name = "POLY1305" and type instanceof Crypto::POLY1305
2929
or
3030
name.matches(["SHA", "SHA1"]) and type instanceof Crypto::SHA1
3131
or
3232
name.matches("SHA_%") and not name.matches(["SHA1", "SHA3-"]) and type instanceof Crypto::SHA2
3333
or
3434
name.matches("SHA3-%") and type instanceof Crypto::SHA3
3535
or
36-
name.matches(["SHAKE"]) and type instanceof Crypto::SHAKE
36+
name = "SHAKE" and type instanceof Crypto::SHAKE
3737
or
38-
name.matches("SM3") and type instanceof Crypto::SM3
38+
name = "SM3" and type instanceof Crypto::SM3
3939
or
40-
name.matches("RIPEMD160") and type instanceof Crypto::RIPEMD160
40+
name = "RIPEMD160" and type instanceof Crypto::RIPEMD160
4141
or
42-
name.matches("WHIRLPOOL") and type instanceof Crypto::WHIRLPOOL
42+
name = "WHIRLPOOL" and type instanceof Crypto::WHIRLPOOL
4343
)
4444
)
4545
}

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,8 @@ string getAlgorithmAlias(string alias) {
210210
}
211211

212212
/**
213-
* Finds aliases of known alagorithms defined by users (through obj_name_add and various macros pointing to this function)
213+
* Holds for aliases of known alagorithms defined by users
214+
* (through obj_name_add and various macros pointing to this function).
214215
*
215216
* The `target` and `alias` are converted to lowercase to be of a standard form.
216217
*/
@@ -222,7 +223,7 @@ predicate customAliases(string target, string alias) {
222223
}
223224

224225
/**
225-
* A hard-coded mapping of known algorithm aliases in OpenSsl.
226+
* Holds for a hard-coded mapping of known algorithm aliases in OpenSsl.
226227
* This was derived by applying the same kind of logic foun din `customAliases` to the
227228
* OpenSsl code base directly.
228229
*

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,13 @@ predicate knownOpenSslConstantToPaddingFamilyType(
3333
exists(string name |
3434
name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
3535
(
36-
name.matches("OAEP") and type = Crypto::OAEP()
36+
name = "OAEP" and type = Crypto::OAEP()
3737
or
38-
name.matches("PSS") and type = Crypto::PSS()
38+
name = "PSS" and type = Crypto::PSS()
3939
or
40-
name.matches("PKCS7") and type = Crypto::PKCS7()
40+
name = "PKCS7" and type = Crypto::PKCS7()
4141
or
42-
name.matches("PKCS1V15") and type = Crypto::PKCS1_v1_5()
42+
name = "PKCS1V15" and type = Crypto::PKCS1_v1_5()
4343
)
4444
)
4545
}
@@ -85,7 +85,7 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
8585
// Source is `this`
8686
src.asExpr() = this and
8787
// This traces to a padding-specific consumer
88-
RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow::flow(src, sink)
88+
RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow::flow(src, sink)
8989
) and
9090
isPaddingSpecificConsumer = true
9191
}
@@ -143,7 +143,7 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
143143
// this instanceof Literal and
144144
// this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8]
145145
// // TODO: trace to padding-specific consumers
146-
// RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow
146+
// RsaPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow
147147
// }
148148
// override string getRawPaddingAlgorithmName() { result = this.(Literal).getValue().toString() }
149149
// override Crypto::TPaddingType getPaddingType() {
@@ -161,10 +161,10 @@ class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInsta
161161
// else result = Crypto::OtherPadding()
162162
// }
163163
// }
164-
class OAEPPaddingAlgorithmInstance extends Crypto::OAEPPaddingAlgorithmInstance,
164+
class OaepPaddingAlgorithmInstance extends Crypto::OAEPPaddingAlgorithmInstance,
165165
KnownOpenSslPaddingConstantAlgorithmInstance
166166
{
167-
OAEPPaddingAlgorithmInstance() {
167+
OaepPaddingAlgorithmInstance() {
168168
this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = Crypto::OAEP()
169169
}
170170

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/DirectAlgorithmValueConsumer.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
44
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
55

66
/**
7-
* Cases like EVP_MD5(),
8-
* there is no input, rather it directly gets an algorithm
9-
* and returns it.
10-
* Also includes operations directly using an algorithm
7+
* A call that is considered to inherently 'consume' an algorithm value.
8+
* E.g., cases like EVP_MD5(),
9+
* where there is no input, rather it directly gets an algorithm
10+
* and returns it. Also includes operations directly using an algorithm
1111
* like AES_encrypt().
1212
*/
1313
class DirectAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer instanceof OpenSslAlgorithmCall

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/HashAlgorithmValueConsumer.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmI
77
abstract class HashAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
88

99
/**
10-
* EVP_Q_Digest directly consumes algorithm constant values
10+
* An EVP_Q_Digest directly consumes algorithm constant values
1111
*/
1212
class Evp_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
1313
Evp_Q_Digest_Algorithm_Consumer() { this.(Call).getTarget().getName() = "EVP_Q_digest" }

‎cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherOperation.qll

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,8 @@ class Evp_Cipher_Update_Call extends EvpUpdate {
9191
}
9292

9393
/**
94-
* see: https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
94+
* The EVP Cipher operations.
95+
* See: https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
9596
* Base configuration for all EVP cipher operations.
9697
*/
9798
abstract class Evp_Cipher_Operation extends EvpOperation, Crypto::KeyOperationInstance {
@@ -163,6 +164,7 @@ class Evp_Cipher_Final_Call extends EvpFinal, Evp_Cipher_Operation {
163164
}
164165

165166
/**
167+
* The EVP encryption/decryption operations.
166168
* https://docs.openssl.org/3.2/man3/EVP_PKEY_decrypt/
167169
* https://docs.openssl.org/3.2/man3/EVP_PKEY_encrypt
168170
*/

0 commit comments

Comments
 (0)