Skip to content

Commit 6896b20

Browse files
geoffw0geoffw0
committed
C++: Redesign and fix results that appear to be encrypted.
1 parent 511bee7 commit 6896b20

File tree

2 files changed

+93
-5
lines changed

2 files changed

+93
-5
lines changed

‎cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ class FromSensitiveConfiguration extends TaintTracking::Configuration {
125125
sink.asExpr() = any(NetworkSendRecv nsr | nsr.checkSocket()).getDataExpr()
126126
or
127127
sink.asExpr() instanceof Encrypted
128+
or
129+
sink.asExpr() instanceof SensitiveExpr
128130
}
129131

130132
override predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) {
@@ -150,11 +152,16 @@ where
150152
sink.getNode().asExpr() = networkSendRecv.getDataExpr() and
151153
networkSendRecv.checkSocket() and
152154
// no flow from sensitive -> evidence of encryption
153-
not exists(DataFlow::Node anySource, DataFlow::Node encrypted |
154-
config.hasFlow(anySource, sink.getNode()) and
155-
config.hasFlow(anySource, encrypted) and
155+
not exists(DataFlow::Node encrypted |
156+
config.hasFlow(source.getNode(), encrypted) and
156157
encrypted.asExpr() instanceof Encrypted
157158
) and
159+
// only use the 'first' sensitive expression
160+
not exists(DataFlow::Node sensitive |
161+
config.hasFlow(sensitive, source.getNode()) and
162+
sensitive.asExpr() instanceof SensitiveExpr and
163+
not source.getNode() = sensitive
164+
) and
158165
// construct result
159166
if networkSendRecv instanceof NetworkSend
160167
then
@@ -165,4 +172,4 @@ where
165172
msg =
166173
"This operation receives into '" + sink.toString() +
167174
"', which may put unencrypted sensitive data into $@"
168-
select networkSendRecv, source, sink, msg, source, source.getNode().asExpr().toString()
175+
select networkSendRecv, source, sink, msg, source, source.getNode().toString()

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected‎

Lines changed: 82 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,32 @@
11
edges
2+
| test2.cpp:43:34:43:34 | s [post update] [password] | test2.cpp:62:16:62:16 | s [password] |
23
| test2.cpp:43:34:43:34 | s [post update] [password] | test2.cpp:63:22:63:22 | s [password] |
4+
| test2.cpp:43:34:43:34 | s [post update] [password] | test2.cpp:72:15:72:15 | s [password] |
5+
| test2.cpp:43:34:43:34 | s [post update] [password] | test2.cpp:79:34:79:34 | s [password] |
6+
| test2.cpp:43:34:43:34 | s [post update] [password] | test2.cpp:91:43:91:43 | s [password] |
37
| test2.cpp:43:36:43:43 | password | test2.cpp:43:36:43:43 | ref arg password |
48
| test2.cpp:43:36:43:43 | ref arg password | test2.cpp:43:34:43:34 | s [post update] [password] |
9+
| test2.cpp:54:39:54:39 | s [post update] [widepassword] | test2.cpp:55:38:55:38 | s [widepassword] |
10+
| test2.cpp:54:41:54:52 | ref arg widepassword | test2.cpp:54:39:54:39 | s [post update] [widepassword] |
11+
| test2.cpp:54:41:54:52 | widepassword | test2.cpp:54:41:54:52 | ref arg widepassword |
12+
| test2.cpp:55:38:55:38 | s [widepassword] | test2.cpp:55:40:55:51 | widepassword |
13+
| test2.cpp:62:16:62:16 | s [password] | test2.cpp:62:18:62:25 | password |
514
| test2.cpp:63:22:63:22 | s [password] | test2.cpp:63:24:63:31 | password |
615
| test2.cpp:63:22:63:22 | s [password] | test2.cpp:63:24:63:31 | password |
16+
| test2.cpp:63:22:63:22 | s [post update] [password] | test2.cpp:72:15:72:15 | s [password] |
17+
| test2.cpp:63:22:63:22 | s [post update] [password] | test2.cpp:79:34:79:34 | s [password] |
18+
| test2.cpp:63:22:63:22 | s [post update] [password] | test2.cpp:91:43:91:43 | s [password] |
719
| test2.cpp:63:24:63:31 | password | test2.cpp:63:16:63:20 | call to crypt |
20+
| test2.cpp:63:24:63:31 | password | test2.cpp:63:24:63:31 | ref arg password |
21+
| test2.cpp:63:24:63:31 | ref arg password | test2.cpp:63:22:63:22 | s [post update] [password] |
22+
| test2.cpp:72:15:72:15 | s [password] | test2.cpp:72:17:72:24 | password |
23+
| test2.cpp:79:34:79:34 | s [password] | test2.cpp:79:36:79:43 | password |
24+
| test2.cpp:79:34:79:34 | s [password] | test2.cpp:79:36:79:43 | password |
25+
| test2.cpp:79:34:79:34 | s [post update] [password] | test2.cpp:91:43:91:43 | s [password] |
26+
| test2.cpp:79:36:79:43 | password | test2.cpp:79:36:79:43 | ref arg password |
27+
| test2.cpp:79:36:79:43 | ref arg password | test2.cpp:79:34:79:34 | s [post update] [password] |
28+
| test2.cpp:91:43:91:43 | s [password] | test2.cpp:91:45:91:52 | password |
29+
| test3.cpp:47:15:47:22 | password | test3.cpp:49:28:49:35 | password |
830
| test3.cpp:74:21:74:29 | password1 | test3.cpp:76:15:76:17 | ptr |
931
| test3.cpp:81:15:81:22 | password | test3.cpp:83:15:83:17 | ptr |
1032
| test3.cpp:112:20:112:25 | buffer | test3.cpp:114:14:114:19 | buffer |
@@ -20,6 +42,7 @@ edges
2042
| test3.cpp:173:15:173:22 | password | test3.cpp:175:19:175:26 | password |
2143
| test3.cpp:173:15:173:22 | password | test3.cpp:175:19:175:26 | password |
2244
| test3.cpp:175:19:175:26 | password | test3.cpp:175:3:175:17 | call to decrypt_inplace |
45+
| test3.cpp:181:15:181:22 | password | test3.cpp:182:3:182:10 | password |
2346
| test3.cpp:181:15:181:22 | password | test3.cpp:184:3:184:17 | call to decrypt_inplace |
2447
| test3.cpp:181:15:181:22 | password | test3.cpp:184:19:184:26 | password |
2548
| test3.cpp:181:15:181:22 | password | test3.cpp:184:19:184:26 | password |
@@ -30,45 +53,90 @@ edges
3053
| test3.cpp:193:30:193:37 | password | test3.cpp:193:18:193:28 | call to rtn_decrypt |
3154
| test3.cpp:199:19:199:26 | password | test3.cpp:199:3:199:17 | call to encrypt_inplace |
3255
| test3.cpp:199:19:199:26 | password | test3.cpp:201:15:201:22 | password |
56+
| test3.cpp:199:19:199:26 | password | test3.cpp:201:32:201:39 | password |
3357
| test3.cpp:207:19:207:26 | password | test3.cpp:207:3:207:17 | call to encrypt_inplace |
58+
| test3.cpp:207:19:207:26 | password | test3.cpp:208:3:208:10 | password |
3459
| test3.cpp:207:19:207:26 | password | test3.cpp:210:15:210:22 | password |
60+
| test3.cpp:207:19:207:26 | password | test3.cpp:210:32:210:39 | password |
3561
| test3.cpp:217:18:217:28 | call to rtn_encrypt | test3.cpp:219:15:219:26 | password_ptr |
62+
| test3.cpp:217:18:217:28 | call to rtn_encrypt | test3.cpp:219:36:219:47 | password_ptr |
3663
| test3.cpp:217:30:217:37 | password | test3.cpp:217:18:217:28 | call to rtn_encrypt |
3764
| test3.cpp:217:30:217:37 | password | test3.cpp:217:18:217:28 | call to rtn_encrypt |
3865
| test3.cpp:217:30:217:37 | password | test3.cpp:219:15:219:26 | password_ptr |
66+
| test3.cpp:217:30:217:37 | password | test3.cpp:219:36:219:47 | password_ptr |
3967
| test3.cpp:241:8:241:15 | password | test3.cpp:242:8:242:15 | password |
4068
| test.cpp:48:29:48:39 | thePassword | test.cpp:48:21:48:27 | call to encrypt |
69+
| test.cpp:58:11:58:16 | passwd | test.cpp:61:11:61:16 | passwd |
4170
| test.cpp:76:29:76:39 | thePassword | test.cpp:76:21:76:27 | call to encrypt |
4271
nodes
4372
| test2.cpp:43:34:43:34 | s [post update] [password] | semmle.label | s [post update] [password] |
4473
| test2.cpp:43:36:43:43 | password | semmle.label | password |
74+
| test2.cpp:43:36:43:43 | password | semmle.label | password |
4575
| test2.cpp:43:36:43:43 | ref arg password | semmle.label | ref arg password |
76+
| test2.cpp:44:37:44:45 | thepasswd | semmle.label | thepasswd |
77+
| test2.cpp:50:41:50:53 | passwd_config | semmle.label | passwd_config |
78+
| test2.cpp:52:44:52:57 | password_tries | semmle.label | password_tries |
79+
| test2.cpp:54:39:54:39 | s [post update] [widepassword] | semmle.label | s [post update] [widepassword] |
80+
| test2.cpp:54:41:54:52 | ref arg widepassword | semmle.label | ref arg widepassword |
81+
| test2.cpp:54:41:54:52 | widepassword | semmle.label | widepassword |
82+
| test2.cpp:54:41:54:52 | widepassword | semmle.label | widepassword |
83+
| test2.cpp:55:38:55:38 | s [widepassword] | semmle.label | s [widepassword] |
84+
| test2.cpp:55:40:55:51 | widepassword | semmle.label | widepassword |
85+
| test2.cpp:57:39:57:49 | call to getPassword | semmle.label | call to getPassword |
86+
| test2.cpp:62:16:62:16 | s [password] | semmle.label | s [password] |
87+
| test2.cpp:62:18:62:25 | password | semmle.label | password |
4688
| test2.cpp:63:16:63:20 | call to crypt | semmle.label | call to crypt |
4789
| test2.cpp:63:22:63:22 | s [password] | semmle.label | s [password] |
90+
| test2.cpp:63:22:63:22 | s [post update] [password] | semmle.label | s [post update] [password] |
4891
| test2.cpp:63:24:63:31 | password | semmle.label | password |
4992
| test2.cpp:63:24:63:31 | password | semmle.label | password |
93+
| test2.cpp:63:24:63:31 | ref arg password | semmle.label | ref arg password |
94+
| test2.cpp:72:15:72:15 | s [password] | semmle.label | s [password] |
95+
| test2.cpp:72:17:72:24 | password | semmle.label | password |
96+
| test2.cpp:79:34:79:34 | s [password] | semmle.label | s [password] |
97+
| test2.cpp:79:34:79:34 | s [post update] [password] | semmle.label | s [post update] [password] |
98+
| test2.cpp:79:36:79:43 | password | semmle.label | password |
99+
| test2.cpp:79:36:79:43 | password | semmle.label | password |
100+
| test2.cpp:79:36:79:43 | ref arg password | semmle.label | ref arg password |
101+
| test2.cpp:82:15:82:28 | passwd_config2 | semmle.label | passwd_config2 |
102+
| test2.cpp:84:50:84:63 | passwd_config2 | semmle.label | passwd_config2 |
103+
| test2.cpp:91:43:91:43 | s [password] | semmle.label | s [password] |
104+
| test2.cpp:91:45:91:52 | password | semmle.label | password |
105+
| test3.cpp:20:28:20:36 | password1 | semmle.label | password1 |
50106
| test3.cpp:22:15:22:23 | password1 | semmle.label | password1 |
107+
| test3.cpp:22:33:22:41 | password1 | semmle.label | password1 |
51108
| test3.cpp:26:15:26:23 | password2 | semmle.label | password2 |
109+
| test3.cpp:26:33:26:41 | password2 | semmle.label | password2 |
52110
| test3.cpp:38:23:38:31 | password2 | semmle.label | password2 |
111+
| test3.cpp:38:41:38:49 | password2 | semmle.label | password2 |
112+
| test3.cpp:47:15:47:22 | password | semmle.label | password |
53113
| test3.cpp:47:15:47:22 | password | semmle.label | password |
114+
| test3.cpp:49:28:49:35 | password | semmle.label | password |
54115
| test3.cpp:55:15:55:22 | password | semmle.label | password |
55116
| test3.cpp:74:21:74:29 | password1 | semmle.label | password1 |
117+
| test3.cpp:74:21:74:29 | password1 | semmle.label | password1 |
56118
| test3.cpp:76:15:76:17 | ptr | semmle.label | ptr |
57119
| test3.cpp:81:15:81:22 | password | semmle.label | password |
120+
| test3.cpp:81:15:81:22 | password | semmle.label | password |
58121
| test3.cpp:83:15:83:17 | ptr | semmle.label | ptr |
59122
| test3.cpp:101:12:101:19 | password | semmle.label | password |
123+
| test3.cpp:108:12:108:19 | password | semmle.label | password |
60124
| test3.cpp:112:20:112:25 | buffer | semmle.label | buffer |
61125
| test3.cpp:114:14:114:19 | buffer | semmle.label | buffer |
62126
| test3.cpp:117:28:117:33 | buffer | semmle.label | buffer |
63127
| test3.cpp:119:9:119:14 | buffer | semmle.label | buffer |
64128
| test3.cpp:126:9:126:23 | global_password | semmle.label | global_password |
129+
| test3.cpp:126:9:126:23 | global_password | semmle.label | global_password |
130+
| test3.cpp:134:11:134:18 | password | semmle.label | password |
65131
| test3.cpp:134:11:134:18 | password | semmle.label | password |
66132
| test3.cpp:138:21:138:22 | call to id | semmle.label | call to id |
67133
| test3.cpp:138:24:138:32 | password1 | semmle.label | password1 |
134+
| test3.cpp:138:24:138:32 | password1 | semmle.label | password1 |
68135
| test3.cpp:140:15:140:17 | ptr | semmle.label | ptr |
69136
| test3.cpp:144:16:144:29 | call to get_global_str | semmle.label | call to get_global_str |
70137
| test3.cpp:146:15:146:18 | data | semmle.label | data |
71138
| test3.cpp:157:19:157:26 | password | semmle.label | password |
139+
| test3.cpp:157:19:157:26 | password | semmle.label | password |
72140
| test3.cpp:159:15:159:20 | buffer | semmle.label | buffer |
73141
| test3.cpp:173:15:173:22 | password | semmle.label | password |
74142
| test3.cpp:173:15:173:22 | password | semmle.label | password |
@@ -77,35 +145,49 @@ nodes
77145
| test3.cpp:175:19:175:26 | password | semmle.label | password |
78146
| test3.cpp:181:15:181:22 | password | semmle.label | password |
79147
| test3.cpp:181:15:181:22 | password | semmle.label | password |
148+
| test3.cpp:182:3:182:10 | password | semmle.label | password |
80149
| test3.cpp:184:3:184:17 | call to decrypt_inplace | semmle.label | call to decrypt_inplace |
81150
| test3.cpp:184:19:184:26 | password | semmle.label | password |
82151
| test3.cpp:184:19:184:26 | password | semmle.label | password |
83152
| test3.cpp:191:15:191:22 | password | semmle.label | password |
84153
| test3.cpp:191:15:191:22 | password | semmle.label | password |
154+
| test3.cpp:193:3:193:14 | password_ptr | semmle.label | password_ptr |
85155
| test3.cpp:193:18:193:28 | call to rtn_decrypt | semmle.label | call to rtn_decrypt |
86156
| test3.cpp:193:30:193:37 | password | semmle.label | password |
87157
| test3.cpp:193:30:193:37 | password | semmle.label | password |
88158
| test3.cpp:199:3:199:17 | call to encrypt_inplace | semmle.label | call to encrypt_inplace |
89159
| test3.cpp:199:19:199:26 | password | semmle.label | password |
90160
| test3.cpp:199:19:199:26 | password | semmle.label | password |
91161
| test3.cpp:201:15:201:22 | password | semmle.label | password |
162+
| test3.cpp:201:32:201:39 | password | semmle.label | password |
92163
| test3.cpp:207:3:207:17 | call to encrypt_inplace | semmle.label | call to encrypt_inplace |
93164
| test3.cpp:207:19:207:26 | password | semmle.label | password |
94165
| test3.cpp:207:19:207:26 | password | semmle.label | password |
166+
| test3.cpp:208:3:208:10 | password | semmle.label | password |
95167
| test3.cpp:210:15:210:22 | password | semmle.label | password |
168+
| test3.cpp:210:32:210:39 | password | semmle.label | password |
169+
| test3.cpp:217:3:217:14 | password_ptr | semmle.label | password_ptr |
96170
| test3.cpp:217:18:217:28 | call to rtn_encrypt | semmle.label | call to rtn_encrypt |
97171
| test3.cpp:217:18:217:28 | call to rtn_encrypt | semmle.label | call to rtn_encrypt |
98172
| test3.cpp:217:30:217:37 | password | semmle.label | password |
99173
| test3.cpp:217:30:217:37 | password | semmle.label | password |
100174
| test3.cpp:219:15:219:26 | password_ptr | semmle.label | password_ptr |
175+
| test3.cpp:219:36:219:47 | password_ptr | semmle.label | password_ptr |
101176
| test3.cpp:227:22:227:29 | password | semmle.label | password |
102177
| test3.cpp:228:26:228:33 | password | semmle.label | password |
103178
| test3.cpp:241:8:241:15 | password | semmle.label | password |
104179
| test3.cpp:241:8:241:15 | password | semmle.label | password |
105180
| test3.cpp:242:8:242:15 | password | semmle.label | password |
181+
| test.cpp:45:9:45:19 | thePassword | semmle.label | thePassword |
106182
| test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
107183
| test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
108184
| test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
185+
| test.cpp:58:11:58:16 | passwd | semmle.label | passwd |
186+
| test.cpp:58:11:58:16 | passwd | semmle.label | passwd |
187+
| test.cpp:61:11:61:16 | passwd | semmle.label | passwd |
188+
| test.cpp:70:38:70:48 | thePassword | semmle.label | thePassword |
189+
| test.cpp:73:43:73:53 | thePassword | semmle.label | thePassword |
190+
| test.cpp:73:63:73:73 | thePassword | semmle.label | thePassword |
109191
| test.cpp:76:21:76:27 | call to encrypt | semmle.label | call to encrypt |
110192
| test.cpp:76:29:76:39 | thePassword | semmle.label | thePassword |
111193
| test.cpp:76:29:76:39 | thePassword | semmle.label | thePassword |
@@ -128,4 +210,3 @@ subpaths
128210
| test3.cpp:228:2:228:5 | call to send | test3.cpp:228:26:228:33 | password | test3.cpp:228:26:228:33 | password | This operation transmits 'password', which may contain unencrypted sensitive data from $@ | test3.cpp:228:26:228:33 | password | password |
129211
| test3.cpp:241:2:241:6 | call to fgets | test3.cpp:241:8:241:15 | password | test3.cpp:241:8:241:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:241:8:241:15 | password | password |
130212
| test3.cpp:242:2:242:6 | call to fgets | test3.cpp:241:8:241:15 | password | test3.cpp:242:8:242:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:241:8:241:15 | password | password |
131-
| test3.cpp:242:2:242:6 | call to fgets | test3.cpp:242:8:242:15 | password | test3.cpp:242:8:242:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:242:8:242:15 | password | password |

0 commit comments

Comments
 (0)