Skip to content

Commit c9b1356

Browse files
chanel-ychanel-y
authored
Merge pull request #200 from microsoft/files-reads-as-flow-sources
PS: Handle more flow sources
2 parents 1637df0 + 396a283 commit c9b1356

File tree

641 files changed

+77361
-77228
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

641 files changed

+77361
-77228
lines changed

‎powershell/ql/lib/semmle/code/powershell/ApiGraphs.qll

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,16 @@ module API {
152152
pragma[inline_late]
153153
Node getReturn() { Impl::returnEdge(this.getAnEpsilonSuccessor(), result) }
154154

155+
/**
156+
* Gets the result of this call when there is a named argument with the
157+
* name `name`, or the return value of this callable.
158+
*/
159+
bindingset[this]
160+
pragma[inline_late]
161+
Node getReturnWithArg(string name) {
162+
Impl::returnEdgeWithArg(this.getAnEpsilonSuccessor(), name, result)
163+
}
164+
155165
/**
156166
* Gets the result of a call to `method` with this value as the receiver, or the return value of `method` defined on
157167
* an object that can reach this sink.
@@ -695,6 +705,21 @@ module API {
695705
)
696706
}
697707

708+
cached
709+
predicate returnEdgeWithArg(Node pred, string arg, Node succ) {
710+
exists(DataFlow::CallNode call |
711+
pred = MkMethodAccessNode(call) and
712+
exists(call.getNamedArgument(arg)) and
713+
succ = getForwardStartNode(call)
714+
)
715+
or
716+
arg = "" and // TODO
717+
exists(DataFlow::CallableNode callable |
718+
pred = getBackwardEndNode(callable) and
719+
succ = MkSinkNode(callable.getAReturnNode())
720+
)
721+
}
722+
698723
cached
699724
predicate entryPointEdge(EntryPoint entry, Node node) {
700725
node = MkSinkNode(entry.getASink()) or

‎powershell/ql/lib/semmle/code/powershell/dataflow/flowsources/FlowSources.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
private import semmle.code.powershell.dataflow.internal.DataFlowPublic as DataFlow
33
import semmle.code.powershell.dataflow.flowsources.Remote
44
import semmle.code.powershell.dataflow.flowsources.Local
5+
import semmle.code.powershell.dataflow.flowsources.Stored
56
import semmle.code.powershell.frameworks.data.internal.ApiGraphModels
67

78
/**

‎powershell/ql/lib/semmle/code/powershell/dataflow/flowsources/Remote.qll

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,18 @@
66
private import semmle.code.powershell.dataflow.internal.DataFlowPublic as DataFlow
77
// Need to import since frameworks can extend `RemoteFlowSource::Range`
88
private import semmle.code.powershell.Frameworks
9+
private import semmle.code.powershell.dataflow.flowsources.FlowSources
910

1011
/**
1112
* A data flow source of remote user input.
1213
*
1314
* Extend this class to refine existing API models. If you want to model new APIs,
1415
* extend `RemoteFlowSource::Range` instead.
1516
*/
16-
class RemoteFlowSource extends DataFlow::Node instanceof RemoteFlowSource::Range {
17-
/** Gets a string that describes the type of this remote flow source. */
18-
string getSourceType() { result = super.getSourceType() }
17+
class RemoteFlowSource extends SourceNode instanceof RemoteFlowSource::Range {
18+
override string getSourceType() { result = "remote flow source" }
19+
20+
override string getThreatModel() { result = "remote" }
1921
}
2022

2123
/** Provides a class for modeling new sources of remote user input. */
@@ -31,3 +33,9 @@ module RemoteFlowSource {
3133
abstract string getSourceType();
3234
}
3335
}
36+
37+
private class ExternalRemoteFlowSource extends RemoteFlowSource::Range {
38+
ExternalRemoteFlowSource() { this = ModelOutput::getASourceNode("remote", _).asSource() }
39+
40+
override string getSourceType() { result = "remote flow" }
41+
}

‎powershell/ql/lib/semmle/code/powershell/dataflow/flowsources/Stored.qll

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Provides classes representing sources of stored data.
3+
*/
4+
5+
import powershell
6+
private import FlowSources
7+
8+
/** A data flow source of stored user input. */
9+
abstract class StoredFlowSource extends SourceNode {
10+
override string getThreatModel() { result = "local" }
11+
}
12+
13+
/**
14+
* A node with input from a database.
15+
*/
16+
abstract class DatabaseInputSource extends StoredFlowSource {
17+
override string getThreatModel() { result = "database" }
18+
19+
override string getSourceType() { result = "database input" }
20+
}
21+
22+
private class ExternalDatabaseInputSource extends DatabaseInputSource {
23+
ExternalDatabaseInputSource() { this = ModelOutput::getASourceNode("database", _).asSource() }
24+
}
25+
26+
/** A file stream source is considered a stored flow source. */
27+
abstract class FileStreamStoredFlowSource extends StoredFlowSource {
28+
override string getThreatModel() { result = "file" }
29+
30+
override string getSourceType() { result = "file stream" }
31+
}
32+
33+
private class ExternalFileStreamStoredFlowSource extends FileStreamStoredFlowSource {
34+
ExternalFileStreamStoredFlowSource() { this = ModelOutput::getASourceNode("file", _).asSource() }
35+
}

‎powershell/ql/lib/semmle/code/powershell/frameworks/Accessibility/model.yml

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,25 @@ extensions:
33
pack: microsoft-sdl/powershell-all
44
extensible: typeModel
55
data:
6-
- ["system.string", "accessibility.iaccessible", "Property[acchelp]"]
6+
- ["system.string", "accessibility.iaccessible", "Member[acchelp]"]
77
- ["system.object", "accessibility.iaccessible", "Method[acchittest].ReturnValue"]
8-
- ["system.int32", "accessibility._remotablehandle", "Field[fcontext]"]
9-
- ["system.int32", "accessibility.iaccessible", "Property[accchildcount]"]
10-
- ["system.object", "accessibility.iaccessible", "Property[accstate]"]
11-
- ["accessibility.annoscope", "accessibility.annoscope!", "Field[anno_this]"]
12-
- ["system.int32", "accessibility.__midl_iwintypes_0009", "Field[hremote]"]
13-
- ["system.object", "accessibility.iaccessible", "Property[accparent]"]
14-
- ["system.object", "accessibility.iaccessible", "Property[accrole]"]
15-
- ["system.object", "accessibility.iaccessible", "Property[accchild]"]
16-
- ["system.string", "accessibility.iaccessible", "Property[acckeyboardshortcut]"]
17-
- ["system.object", "accessibility.iaccessible", "Property[accselection]"]
18-
- ["system.int32", "accessibility.iaccessible", "Property[acchelptopic]"]
19-
- ["system.string", "accessibility.iaccessible", "Property[accdescription]"]
20-
- ["system.string", "accessibility.iaccessible", "Property[accdefaultaction]"]
21-
- ["system.object", "accessibility.iaccessible", "Property[accfocus]"]
22-
- ["accessibility.__midl_iwintypes_0009", "accessibility._remotablehandle", "Field[u]"]
23-
- ["system.string", "accessibility.iaccessible", "Property[accvalue]"]
24-
- ["system.int32", "accessibility.__midl_iwintypes_0009", "Field[hinproc]"]
25-
- ["system.string", "accessibility.iaccessible", "Property[accname]"]
26-
- ["accessibility.annoscope", "accessibility.annoscope!", "Field[anno_container]"]
8+
- ["system.int32", "accessibility._remotablehandle", "Member[fcontext]"]
9+
- ["system.int32", "accessibility.iaccessible", "Member[accchildcount]"]
10+
- ["system.object", "accessibility.iaccessible", "Member[accstate]"]
11+
- ["accessibility.annoscope", "accessibility.annoscope!", "Member[anno_this]"]
12+
- ["system.int32", "accessibility.__midl_iwintypes_0009", "Member[hremote]"]
13+
- ["system.object", "accessibility.iaccessible", "Member[accparent]"]
14+
- ["system.object", "accessibility.iaccessible", "Member[accrole]"]
15+
- ["system.object", "accessibility.iaccessible", "Member[accchild]"]
16+
- ["system.string", "accessibility.iaccessible", "Member[acckeyboardshortcut]"]
17+
- ["system.object", "accessibility.iaccessible", "Member[accselection]"]
18+
- ["system.int32", "accessibility.iaccessible", "Member[acchelptopic]"]
19+
- ["system.string", "accessibility.iaccessible", "Member[accdescription]"]
20+
- ["system.string", "accessibility.iaccessible", "Member[accdefaultaction]"]
21+
- ["system.object", "accessibility.iaccessible", "Member[accfocus]"]
22+
- ["accessibility.__midl_iwintypes_0009", "accessibility._remotablehandle", "Member[u]"]
23+
- ["system.string", "accessibility.iaccessible", "Member[accvalue]"]
24+
- ["system.int32", "accessibility.__midl_iwintypes_0009", "Member[hinproc]"]
25+
- ["system.string", "accessibility.iaccessible", "Member[accname]"]
26+
- ["accessibility.annoscope", "accessibility.annoscope!", "Member[anno_container]"]
2727
- ["system.object", "accessibility.iaccessible", "Method[accnavigate].ReturnValue"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/IEHostExecute/model.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ extensions:
44
extensible: typeModel
55
data:
66
- ["system.int32", "iehost.execute.ieexecuteremote", "Method[executeasdll].ReturnValue"]
7-
- ["system.io.stream", "iehost.execute.ieexecuteremote", "Property[exception]"]
7+
- ["system.io.stream", "iehost.execute.ieexecuteremote", "Member[exception]"]
88
- ["system.object", "iehost.execute.ieexecuteremote", "Method[initializelifetimeservice].ReturnValue"]
99
- ["system.int32", "iehost.execute.ieexecuteremote", "Method[executeasassembly].ReturnValue"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/MicrosoftActivitiesBuild/model.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@ extensions:
44
extensible: typeModel
55
data:
66
- ["system.boolean", "microsoft.activities.build.workflowbuildmessagetask", "Method[execute].ReturnValue"]
7-
- ["system.string", "microsoft.activities.build.workflowbuildmessagetask", "Property[resourcename]"]
8-
- ["system.string", "microsoft.activities.build.workflowbuildmessagetask", "Property[messagetype]"]
7+
- ["system.string", "microsoft.activities.build.workflowbuildmessagetask", "Member[resourcename]"]
8+
- ["system.string", "microsoft.activities.build.workflowbuildmessagetask", "Member[messagetype]"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/MicrosoftActivitiesBuildValidation/model.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ extensions:
44
extensible: typeModel
55
data:
66
- ["system.boolean", "microsoft.activities.build.validation.reportdeferredvalidationerrorstask", "Method[execute].ReturnValue"]
7-
- ["system.string", "microsoft.activities.build.validation.deferredvalidationtask", "Property[deferredvalidationerrorsfilepath]"]
8-
- ["system.string", "microsoft.activities.build.validation.reportdeferredvalidationerrorstask", "Property[deferredvalidationerrorsfilepath]"]
7+
- ["system.string", "microsoft.activities.build.validation.deferredvalidationtask", "Member[deferredvalidationerrorsfilepath]"]
8+
- ["system.string", "microsoft.activities.build.validation.reportdeferredvalidationerrorstask", "Member[deferredvalidationerrorsfilepath]"]
99
- ["system.boolean", "microsoft.activities.build.validation.deferredvalidationtask", "Method[execute].ReturnValue"]

‎powershell/ql/lib/semmle/code/powershell/frameworks/MicrosoftAspnetSnapin/model.yml

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,30 @@ extensions:
44
extensible: typeModel
55
data:
66
- ["system.int32", "microsoft.aspnet.snapin.iextendpropertysheet2", "Method[createpropertypages].ReturnValue"]
7-
- ["microsoft.aspnet.snapin.mmc_control_type", "microsoft.aspnet.snapin.mmc_control_type!", "Field[toolbar]"]
8-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[mask]"]
7+
- ["microsoft.aspnet.snapin.mmc_control_type", "microsoft.aspnet.snapin.mmc_control_type!", "Member[toolbar]"]
8+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[mask]"]
99
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[enumdadvise].ReturnValue"]
10-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[cchildren]"]
11-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[lparam]"]
10+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[cchildren]"]
11+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[lparam]"]
1212
- ["system.int32", "microsoft.aspnet.snapin.iextendpropertysheet", "Method[querypagesfor].ReturnValue"]
13-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[relativeid]"]
13+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[relativeid]"]
1414
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[dadvise].ReturnValue"]
1515
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[enumformatetc].ReturnValue"]
1616
- ["system.int32", "microsoft.aspnet.snapin.iextendpropertysheet2", "Method[getwatermarks].ReturnValue"]
1717
- ["system.int32", "microsoft.aspnet.snapin.icontextmenucallback", "Method[additem].ReturnValue"]
18-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[nopenimage]"]
18+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[nopenimage]"]
1919
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[querygetdata].ReturnValue"]
20-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[id]"]
20+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[id]"]
2121
- ["system.intptr", "microsoft.aspnet.snapin.aspnetmanagementutility!", "Method[getactivewindow].ReturnValue"]
22-
- ["microsoft.aspnet.snapin.mmc_control_type", "microsoft.aspnet.snapin.mmc_control_type!", "Field[comboboxbar]"]
23-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[nstate]"]
22+
- ["microsoft.aspnet.snapin.mmc_control_type", "microsoft.aspnet.snapin.mmc_control_type!", "Member[comboboxbar]"]
23+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[nstate]"]
2424
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[setdata].ReturnValue"]
2525
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[getdata].ReturnValue"]
2626
- ["system.int32", "microsoft.aspnet.snapin.iextendpropertysheet", "Method[createpropertypages].ReturnValue"]
27-
- ["system.intptr", "microsoft.aspnet.snapin.scopedataitem", "Field[displayname]"]
27+
- ["system.intptr", "microsoft.aspnet.snapin.scopedataitem", "Member[displayname]"]
2828
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[dunadvise].ReturnValue"]
29-
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Field[nimage]"]
30-
- ["microsoft.aspnet.snapin.mmc_control_type", "microsoft.aspnet.snapin.mmc_control_type!", "Field[menubutton]"]
29+
- ["system.int32", "microsoft.aspnet.snapin.scopedataitem", "Member[nimage]"]
30+
- ["microsoft.aspnet.snapin.mmc_control_type", "microsoft.aspnet.snapin.mmc_control_type!", "Member[menubutton]"]
3131
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[getdatahere].ReturnValue"]
3232
- ["system.int32", "microsoft.aspnet.snapin.iextendpropertysheet2", "Method[querypagesfor].ReturnValue"]
3333
- ["system.int32", "microsoft.aspnet.snapin.idataobject", "Method[getcanonicalformatetc].ReturnValue"]

0 commit comments

Comments
 (0)