Skip to content

Commit 9531701

Browse files
am0o0am0o0
committed
delete miniz support because there is no good documents and i don't have enough time as the library is not popular enough. add tests for minizip lib
1 parent e85ca79 commit 9531701

File tree

5 files changed

+207
-112
lines changed

5 files changed

+207
-112
lines changed

‎cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBomb.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import ZlibGzopen
55
import ZlibInflator
66
import ZlibUncompress
77
import LibArchive
8-
import LibMiniz
98
import XZ
109
import ZSTD
1110
import Bzip2

‎cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibMiniz.qll

Lines changed: 0 additions & 80 deletions
This file was deleted.

‎cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll

Lines changed: 12 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,6 @@ class Mz_zip_entry extends DecompressionFunction {
1717
override int getArchiveParameterIndex() { result = 1 }
1818
}
1919

20-
/**
21-
* The `mz_zip_entry` function is used in flow steps.
22-
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
23-
*/
24-
class Mz_zip_entry_flow_steps extends DecompressionFlowStep {
25-
Mz_zip_entry_flow_steps() { this.hasGlobalName("mz_zip_entry_read") }
26-
27-
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
28-
exists(FunctionCall fc | fc.getTarget() = this |
29-
node1.asExpr() = fc.getArgument(0) and
30-
node2.asExpr() = fc.getArgument(1)
31-
)
32-
}
33-
}
34-
3520
/**
3621
* The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow source.
3722
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
@@ -44,34 +29,30 @@ class Mz_zip_reader_entry extends DecompressionFunction {
4429
])
4530
}
4631

47-
override int getArchiveParameterIndex() { result = 1 }
32+
override int getArchiveParameterIndex() { result = 0 }
4833
}
4934

5035
/**
51-
* The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow steps.
52-
* [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
36+
* The `UnzOpen*` functions are used in flow sink.
5337
*/
54-
class Mz_zip_reader_entry_flow_steps extends DecompressionFlowStep {
55-
Mz_zip_reader_entry_flow_steps() { this instanceof Mz_zip_reader_entry }
38+
class UnzOpenFunction extends DecompressionFunction {
39+
UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
5640

57-
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
58-
exists(FunctionCall fc | fc.getTarget() = this |
59-
node1.asExpr() = fc.getArgument(0) and
60-
node2.asExpr() = fc.getArgument(1)
61-
)
62-
}
41+
override int getArchiveParameterIndex() { result = 0 }
6342
}
6443

6544
/**
66-
* The `UnzOpen` function as a flow source.
45+
* The `mz_zip_reader_open_file` and `mz_zip_reader_open_file_in_memory` functions as a flow source.
6746
*/
68-
class UnzOpenFunction extends DecompressionFlowStep {
69-
UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
47+
class ReaderOpenFunction extends DecompressionFlowStep {
48+
ReaderOpenFunction() {
49+
this.hasGlobalName(["mz_zip_reader_open_file_in_memory", "mz_zip_reader_open_file"])
50+
}
7051

7152
override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
7253
exists(FunctionCall fc | fc.getTarget() = this |
73-
node1.asExpr() = fc.getArgument(0) and
74-
node2.asExpr() = fc
54+
node1.asIndirectExpr() = fc.getArgument(1) and
55+
node2.asIndirectExpr() = fc.getArgument(0)
7556
)
7657
}
7758
}

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,37 @@
11
edges
22
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
33
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
4+
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
5+
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
6+
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
7+
| brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
8+
| minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:28:46:28:48 | *buf | provenance | |
9+
| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
10+
| minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
11+
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
12+
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
13+
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
14+
| minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
15+
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:28:46:28:48 | *buf | provenance | |
16+
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | provenance | |
17+
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
18+
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | minizipTest.cpp:42:52:42:67 | *access to array | provenance | |
19+
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | minizipTest.cpp:54:41:54:47 | *access to array | provenance | |
20+
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | minizipTest.cpp:69:13:69:19 | *access to array | provenance | |
21+
| minizipTest.cpp:54:29:54:38 | **zip_reader | minizipTest.cpp:60:30:60:39 | **zip_reader | provenance | |
22+
| minizipTest.cpp:54:29:54:38 | *zip_reader | minizipTest.cpp:54:29:54:38 | mz_zip_reader_open_file output argument | provenance | |
23+
| minizipTest.cpp:54:29:54:38 | *zip_reader | minizipTest.cpp:55:36:55:45 | *zip_reader | provenance | |
24+
| minizipTest.cpp:54:29:54:38 | *zip_reader | minizipTest.cpp:60:30:60:39 | *zip_reader | provenance | |
25+
| minizipTest.cpp:54:29:54:38 | *zip_reader | minizipTest.cpp:109:39:109:44 | *handle | provenance | |
26+
| minizipTest.cpp:54:29:54:38 | mz_zip_reader_open_file output argument | minizipTest.cpp:55:36:55:45 | *zip_reader | provenance | |
27+
| minizipTest.cpp:54:29:54:38 | mz_zip_reader_open_file output argument | minizipTest.cpp:60:30:60:39 | *zip_reader | provenance | |
28+
| minizipTest.cpp:54:41:54:47 | *access to array | minizipTest.cpp:54:29:54:38 | **zip_reader | provenance | Config |
29+
| minizipTest.cpp:54:41:54:47 | *access to array | minizipTest.cpp:54:29:54:38 | *zip_reader | provenance | Config |
30+
| minizipTest.cpp:55:36:55:45 | *zip_reader | minizipTest.cpp:55:36:55:45 | mz_zip_reader_goto_first_entry output argument | provenance | |
31+
| minizipTest.cpp:55:36:55:45 | *zip_reader | minizipTest.cpp:101:46:101:50 | *pVoid | provenance | |
32+
| minizipTest.cpp:55:36:55:45 | mz_zip_reader_goto_first_entry output argument | minizipTest.cpp:60:30:60:39 | *zip_reader | provenance | |
33+
| minizipTest.cpp:101:46:101:50 | *pVoid | minizipTest.cpp:101:46:101:50 | *pVoid | provenance | |
34+
| minizipTest.cpp:109:39:109:44 | *handle | minizipTest.cpp:109:39:109:44 | *handle | provenance | |
435
| zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:63:25:63:35 | *a | provenance | |
536
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:52:25:52:25 | *a | provenance | |
637
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:69:17:69:26 | & ... | provenance | Config |
@@ -50,6 +81,25 @@ nodes
5081
| brotliTest.cpp:29:32:29:35 | **argv | semmle.label | **argv |
5182
| brotliTest.cpp:31:42:31:60 | *access to array | semmle.label | *access to array |
5283
| brotliTest.cpp:37:35:37:40 | *input2 | semmle.label | *input2 |
84+
| minizipTest.cpp:28:46:28:48 | *buf | semmle.label | *buf |
85+
| minizipTest.cpp:28:46:28:48 | *buf | semmle.label | *buf |
86+
| minizipTest.cpp:36:32:36:35 | **argv | semmle.label | **argv |
87+
| minizipTest.cpp:42:52:42:67 | *access to array | semmle.label | *access to array |
88+
| minizipTest.cpp:42:52:42:67 | *access to array | semmle.label | *access to array |
89+
| minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument | semmle.label | mz_zip_entry_read output argument |
90+
| minizipTest.cpp:54:29:54:38 | **zip_reader | semmle.label | **zip_reader |
91+
| minizipTest.cpp:54:29:54:38 | *zip_reader | semmle.label | *zip_reader |
92+
| minizipTest.cpp:54:29:54:38 | mz_zip_reader_open_file output argument | semmle.label | mz_zip_reader_open_file output argument |
93+
| minizipTest.cpp:54:41:54:47 | *access to array | semmle.label | *access to array |
94+
| minizipTest.cpp:55:36:55:45 | *zip_reader | semmle.label | *zip_reader |
95+
| minizipTest.cpp:55:36:55:45 | mz_zip_reader_goto_first_entry output argument | semmle.label | mz_zip_reader_goto_first_entry output argument |
96+
| minizipTest.cpp:60:30:60:39 | **zip_reader | semmle.label | **zip_reader |
97+
| minizipTest.cpp:60:30:60:39 | *zip_reader | semmle.label | *zip_reader |
98+
| minizipTest.cpp:69:13:69:19 | *access to array | semmle.label | *access to array |
99+
| minizipTest.cpp:101:46:101:50 | *pVoid | semmle.label | *pVoid |
100+
| minizipTest.cpp:101:46:101:50 | *pVoid | semmle.label | *pVoid |
101+
| minizipTest.cpp:109:39:109:44 | *handle | semmle.label | *handle |
102+
| minizipTest.cpp:109:39:109:44 | *handle | semmle.label | *handle |
53103
| zlibTest.cpp:52:25:52:25 | *a | semmle.label | *a |
54104
| zlibTest.cpp:52:25:52:25 | *a | semmle.label | *a |
55105
| zlibTest.cpp:63:25:63:35 | *a | semmle.label | *a |
@@ -86,13 +136,38 @@ nodes
86136
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | semmle.label | UnsafeGzread output argument |
87137
| zlibTest.cpp:174:19:174:66 | *access to array | semmle.label | *access to array |
88138
subpaths
139+
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:28:46:28:48 | *buf | minizipTest.cpp:42:52:42:67 | mz_zip_entry_read output argument |
140+
| minizipTest.cpp:54:29:54:38 | *zip_reader | minizipTest.cpp:109:39:109:44 | *handle | minizipTest.cpp:109:39:109:44 | *handle | minizipTest.cpp:54:29:54:38 | mz_zip_reader_open_file output argument |
141+
| minizipTest.cpp:55:36:55:45 | *zip_reader | minizipTest.cpp:101:46:101:50 | *pVoid | minizipTest.cpp:101:46:101:50 | *pVoid | minizipTest.cpp:55:36:55:45 | mz_zip_reader_goto_first_entry output argument |
89142
| zlibTest.cpp:169:19:169:25 | *access to array | zlibTest.cpp:114:25:114:32 | *fileName | zlibTest.cpp:114:25:114:32 | *fileName | zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument |
90143
| zlibTest.cpp:170:18:170:24 | *access to array | zlibTest.cpp:131:24:131:31 | *fileName | zlibTest.cpp:131:24:131:31 | *fileName | zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument |
91144
| zlibTest.cpp:171:19:171:25 | *access to array | zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument |
92145
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument |
93146
#select
94147
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
148+
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
149+
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
150+
| brotliTest.cpp:31:42:31:60 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
95151
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
152+
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
153+
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
154+
| brotliTest.cpp:37:35:37:40 | *input2 | minizipTest.cpp:36:32:36:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
155+
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
156+
| minizipTest.cpp:42:52:42:67 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
157+
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
158+
| minizipTest.cpp:42:52:42:67 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:42:52:42:67 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
159+
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
160+
| minizipTest.cpp:60:30:60:39 | **zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
161+
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
162+
| minizipTest.cpp:60:30:60:39 | **zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | **zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
163+
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
164+
| minizipTest.cpp:60:30:60:39 | *zip_reader | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
165+
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
166+
| minizipTest.cpp:60:30:60:39 | *zip_reader | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:60:30:60:39 | *zip_reader | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
167+
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
168+
| minizipTest.cpp:69:13:69:19 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
169+
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
170+
| minizipTest.cpp:69:13:69:19 | *access to array | minizipTest.cpp:36:32:36:35 | **argv | minizipTest.cpp:69:13:69:19 | *access to array | This Decompression output $@. | minizipTest.cpp:36:32:36:35 | **argv | is not limited |
96171
| zlibTest.cpp:70:13:70:22 | & ... | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:70:13:70:22 | & ... | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
97172
| zlibTest.cpp:101:32:101:38 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:101:32:101:38 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
98173
| zlibTest.cpp:121:38:121:44 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:121:38:121:44 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |

0 commit comments

Comments
 (0)