You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|[Custom allocator leak](./cpp/src/docs/crypto/CustomAllocatorLeak.md"crypto, security")|Finds memory leaks from custom allocated memory|warning|medium|
33
-
|[Custom allocator use-after-free](./cpp/src/docs/crypto/CustomAllocatorUseAfterFree.md"correctness, crypto")|Finds use-after-frees related to custom allocators like `BN_new`|warning|medium|
34
-
|[Invalid key size](./cpp/src/docs/crypto/InvalidKeySize.md"correctness, crypto")|Tests if keys passed to EncryptInit_ex have the same size as the key size of the cipher used|warning|medium|
35
-
|[Legacy cryptographic algorithm](./cpp/src/docs/crypto/UseOfLegacyAlgorithm.md"correctness, crypto")|Detects potential instantiations of legacy cryptographic algorithms|warning|medium|
36
-
|[Missing engine initialization](./cpp/src/docs/crypto/MissingEngineInit.md"correctness, crypto")|Finds created OpenSSL engines that may not be properly initialized|warning|medium|
37
-
|[Missing zeroization of random BIGNUMs](./cpp/src/docs/crypto/MissingZeroization.md"correctness, crypto")|Determines if random bignums are properly zeroized|warning|medium|
38
-
|[Proper error handling](./cpp/src/docs/crypto/ErrorHandling.md"correctness, crypto")|Checks if returned error codes are properly checked|warning|high|
39
-
|[Random buffer too small](./cpp/src/docs/crypto/RandomBufferTooSmall.md"crypto, security")|Finds buffer overflows in calls to CSPRNGs|warning|high|
40
-
|[Static key flow](./cpp/src/docs/crypto/StaticKeyFlow.md"crypto, security")|Finds crypto variables initialized using static keys|error|high|
41
-
|[Static password flow](./cpp/src/docs/crypto/StaticPasswordFlow.md"crypto, security")|Finds crypto variables initialized using static passwords|error|high|
42
-
|[Weak randomness taint](./cpp/src/docs/crypto/WeakRandomnessTaint.md"crypto, security")|Finds crypto variables initialized using weak randomness|error|high|
43
-
32
+
|[Crypto variable initialized using static key](./cpp/src/docs/crypto/StaticKeyFlow.md)|Finds crypto variables initialized using static keys|error|high|
33
+
|[Crypto variable initialized using static password](./cpp/src/docs/crypto/StaticPasswordFlow.md)|Finds crypto variables initialized using static passwords|error|high|
34
+
|[Crypto variable initialized using weak randomness](./cpp/src/docs/crypto/WeakRandomnessTaint.md)|Finds crypto variables initialized using weak randomness|error|high|
35
+
|[Invalid key size](./cpp/src/docs/crypto/InvalidKeySize.md)|Tests if keys passed to EVP_EncryptInit and EVP_EncryptInit_ex have the same size as the key size of the cipher used|warning|medium|
36
+
|[Memory leak related to custom allocator](./cpp/src/docs/crypto/CustomAllocatorLeak.md)|Finds memory leaks from custom allocated memory|warning|medium|
37
+
|[Memory use after free related to custom allocator](./cpp/src/docs/crypto/CustomAllocatorUseAfterFree.md)|Finds use-after-frees related to custom allocators like `BN_new`|warning|medium|
38
+
|[Missing OpenSSL engine initialization](./cpp/src/docs/crypto/MissingEngineInit.md)|Finds created OpenSSL engines that may not be properly initialized|warning|medium|
39
+
|[Missing error handling](./cpp/src/docs/crypto/ErrorHandling.md)|Checks if returned error codes are properly checked|warning|high|
40
+
|[Missing zeroization of potentially sensitive random BIGNUM](./cpp/src/docs/crypto/MissingZeroization.md)|Determines if random bignums are properly zeroized|warning|medium|
41
+
|[Random buffer too small](./cpp/src/docs/crypto/RandomBufferTooSmall.md)|Finds buffer overflows in calls to CSPRNGs|warning|high|
42
+
|[Use of legacy cryptographic algorithm](./cpp/src/docs/crypto/UseOfLegacyAlgorithm.md)|Detects potential instantiations of legacy cryptographic algorithms|warning|medium|
44
43
45
44
#### Security
46
45
47
46
| Name | Description | Severity | Precision |
48
47
| --- | ----------- | :----: | :--------: |
49
-
|[CStrNFinder](./cpp/src/docs/security/CStrnFinder/CStrnFinder.md"security")|Finds calls to functions that take as input a string and its size as separate arguments (e.g., `strncmp`, `strncat`, ...) and the size argument is wrong|error|low|
50
-
|[Missing null terminator](./cpp/src/docs/security/NoNullTerminator/NoNullTerminator.md"security")|This query finds incorrectly initialized strings that are passed to functions expecting null-byte-terminated strings|error|high|
51
-
|[Unsafe Implicit Conversions](./cpp/src/docs/security/UnsafeImplicitConversions/UnsafeImplicitConversions.md"experimental, security")|Finds implicit integer casts that may overflow or be truncated, with false positive reduction via Value Range Analysis|warning|low|
52
-
48
+
|[Invalid string size passed to string manipulation function](./cpp/src/docs/security/CStrnFinder/CStrnFinder.md)|Finds calls to functions that take as input a string and its size as separate arguments (e.g., `strncmp`, `strncat`, ...) and the size argument is wrong|error|low|
49
+
|[Missing null terminator](./cpp/src/docs/security/NoNullTerminator/NoNullTerminator.md)|This query finds incorrectly initialized strings that are passed to functions expecting null-byte-terminated strings|error|high|
50
+
|[Unsafe implicit integer conversion](./cpp/src/docs/security/UnsafeImplicitConversions/UnsafeImplicitConversions.md)|Finds implicit integer casts that may overflow or be truncated, with false positive reduction via Value Range Analysis|warning|low|
53
51
54
52
### Go
55
53
56
54
#### Cryptography
57
55
58
56
| Name | Description | Severity | Precision |
59
57
| --- | ----------- | :----: | :--------: |
60
-
|[Message not hashed before signature verification](./go/src/docs/crypto/MsgNotHashedBeforeSigVerfication/MsgNotHashedBeforeSigVerfication.md"security")|Detects calls to (EC)DSA APIs with a message that was not hashed. If the message is longer than the expected hash digest size, it is silently truncated|error|medium|
61
-
58
+
|[Message not hashed before signature verification](./go/src/docs/crypto/MsgNotHashedBeforeSigVerfication/MsgNotHashedBeforeSigVerfication.md)|Detects calls to (EC)DSA APIs with a message that was not hashed. If the message is longer than the expected hash digest size, it is silently truncated|error|medium|
62
59
63
60
#### Security
64
61
65
62
| Name | Description | Severity | Precision |
66
63
| --- | ----------- | :----: | :--------: |
67
-
|[File permission flaws](./go/src/docs/security/FilePermsFlaws/FilePermsFlaws.md"security")|Finds non-octal (e.g., `755` vs `0o755`) and unsupported (e.g., `04666`) literals used as a filesystem permission parameter (`FileMode`)|error|medium|
68
-
|[Missing MinVersion in tls.Config](./go/src/docs/security/MissingMinVersionTLS/MissingMinVersionTLS.md"security")|This rule finds cases when you do not set the `tls.Config.MinVersion` explicitly for servers. By default version 1.0 is used, which is considered insecure. This rule does not mark explicitly set insecure versions|error|medium|
69
-
|[Trim functions misuse](./go/src/docs/security/TrimMisuse/TrimMisuse.md"security")|Finds calls to `string.{Trim,TrimLeft,TrimRight}` with the 2nd argument not being a cutset but a continuous substring to be trimmed|error|low|
70
-
64
+
|[Invalid file permission parameter](./go/src/docs/security/FilePermsFlaws/FilePermsFlaws.md)|Finds non-octal (e.g., `755` vs `0o755`) and unsupported (e.g., `04666`) literals used as a filesystem permission parameter (`FileMode`)|error|medium|
65
+
|[Missing MinVersion in tls.Config](./go/src/docs/security/MissingMinVersionTLS/MissingMinVersionTLS.md)|This rule finds cases when you do not set the `tls.Config.MinVersion` explicitly for servers. By default version 1.0 is used, which is considered insecure. This rule does not mark explicitly set insecure versions|error|medium|
66
+
|[Trim functions misuse](./go/src/docs/security/TrimMisuse/TrimMisuse.md)|Finds calls to `string.{Trim,TrimLeft,TrimRight}` with the 2nd argument not being a cutset but a continuous substring to be trimmed|error|low|
71
67
72
68
## Query suites
73
69
@@ -79,7 +75,6 @@ The recommended suit - `tob-cpp-code-scanning.qls` - is chosen and executed when
79
75
*`tob-<lang>-security.qls` - queries targeting standard security issues
80
76
*`tob-<lang>-full.qls` - all queries, including experimental ones
0 commit comments