Skip to content

Commit 64abf5b

Browse files
MathiasVPMathiasVP
committed
C++: Add conflation into DefaultTaintTracking.
1 parent b951bf0 commit 64abf5b

4 files changed

Lines changed: 28 additions & 20 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DefaultTaintTrackingImpl.qll‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ private import semmle.code.cpp.ir.dataflow.TaintTracking
1919
private import semmle.code.cpp.ir.dataflow.TaintTracking2
2020
private import semmle.code.cpp.ir.dataflow.TaintTracking3
2121
private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
22+
private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
2223

2324
/**
2425
* A predictable instruction is one where an external user can predict
@@ -75,6 +76,20 @@ private DataFlow::Node getNodeForExpr(Expr node) {
7576
not argv(node.(VariableAccess).getTarget())
7677
}
7778

79+
private predicate conflatePointerAndPointee(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
80+
// Flow from `op` to `*op`.
81+
exists(Operand operand, int indirectionIndex |
82+
nodeHasOperand(nodeFrom, operand, indirectionIndex) and
83+
nodeHasOperand(nodeTo, operand, indirectionIndex - 1)
84+
)
85+
or
86+
// Flow from `instr` to `*instr`.
87+
exists(Instruction instr, int indirectionIndex |
88+
nodeHasInstruction(nodeFrom, instr, indirectionIndex) and
89+
nodeHasInstruction(nodeTo, instr, indirectionIndex - 1)
90+
)
91+
}
92+
7893
private class DefaultTaintTrackingCfg extends TaintTracking::Configuration {
7994
DefaultTaintTrackingCfg() { this = "DefaultTaintTrackingCfg" }
8095

@@ -85,6 +100,10 @@ private class DefaultTaintTrackingCfg extends TaintTracking::Configuration {
85100
override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
86101

87102
override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
103+
104+
override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
105+
conflatePointerAndPointee(nodeFrom, nodeTo)
106+
}
88107
}
89108

90109
private class ToGlobalVarTaintTrackingCfg extends TaintTracking::Configuration {
@@ -417,6 +436,8 @@ module TaintedWithPath {
417436
}
418437

419438
override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
439+
conflatePointerAndPointee(n1, n2)
440+
or
420441
// Steps into and out of global variables
421442
exists(TaintTrackingConfiguration cfg | cfg.taintThroughGlobals() |
422443
writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/tainted.expected‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,2 @@
11
WARNING: Module TaintedWithPath has been deprecated and may be removed in future (tainted.ql:10,8-47)
22
WARNING: Predicate tainted has been deprecated and may be removed in future (tainted.ql:21,3-28)
3-
| defaulttainttracking.cpp:4:33:4:52 | // $ ir MISSING: ast | Missing result:ir= |
4-
| defaulttainttracking.cpp:5:32:5:42 | // $ ast,ir | Missing result:ir= |
5-
| defaulttainttracking.cpp:10:37:10:47 | // $ ast,ir | Missing result:ir= |
6-
| defaulttainttracking.cpp:12:14:12:24 | // $ ast,ir | Missing result:ir= |
7-
| defaulttainttracking.cpp:174:16:174:26 | // $ ast,ir | Missing result:ir= |
8-
| defaulttainttracking.cpp:178:14:178:24 | // $ ast,ir | Missing result:ir= |
9-
| defaulttainttracking.cpp:179:14:179:34 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
10-
| defaulttainttracking.cpp:198:14:198:34 | // $ SPURIOUS: ast,ir | Fixed spurious result:ir= |
11-
| stl.cpp:74:11:74:30 | // $ ir MISSING: ast | Missing result:ir= |
12-
| stl.cpp:91:13:91:32 | // $ ir MISSING: ast | Missing result:ir= |
13-
| stl.cpp:92:13:92:32 | // $ ir MISSING: ast | Missing result:ir= |
14-
| stl.cpp:93:13:93:32 | // $ ir MISSING: ast | Missing result:ir= |
15-
| stl.cpp:94:13:94:32 | // $ ir MISSING: ast | Missing result:ir= |
16-
| stl.cpp:144:12:144:31 | // $ ir MISSING: ast | Missing result:ir= |
17-
| stl.cpp:158:12:158:31 | // $ ir MISSING: ast | Missing result:ir= |

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ WARNING: Predicate taintedIncludingGlobalVars has been deprecated and may be rem
2828
| test.cpp:68:28:68:33 | call to getenv | test.cpp:69:10:69:13 | copy | AST only |
2929
| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:5:70:10 | call to strcpy | AST only |
3030
| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:12:70:15 | copy | AST only |
31-
| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy | AST only |
31+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | array to pointer conversion | IR only |
3232
| test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr | AST only |
3333
| test.cpp:83:28:83:33 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
3434
| test.cpp:83:28:83:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
@@ -37,8 +37,6 @@ WARNING: Predicate taintedIncludingGlobalVars has been deprecated and may be rem
3737
| test.cpp:83:28:83:33 | call to getenv | test.cpp:85:8:85:11 | copy | AST only |
3838
| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:2:86:7 | call to strcpy | AST only |
3939
| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:9:86:12 | copy | AST only |
40-
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | (const char *)... | AST only |
41-
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | copy | AST only |
4240
| test.cpp:100:12:100:15 | call to gets | test.cpp:98:8:98:14 | pointer | AST only |
4341
| test.cpp:100:12:100:15 | call to gets | test.cpp:100:2:100:8 | pointer | AST only |
4442
| test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s | AST only |
@@ -51,5 +49,3 @@ WARNING: Predicate taintedIncludingGlobalVars has been deprecated and may be rem
5149
| test.cpp:106:28:106:33 | call to getenv | test.cpp:108:8:108:11 | copy | AST only |
5250
| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:2:109:7 | call to strcpy | AST only |
5351
| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:9:109:12 | copy | AST only |
54-
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | (const char *)... | AST only |
55-
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | copy | AST only |

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ WARNING: Module TaintedWithPath has been deprecated and may be removed in future
2222
| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:33 | call to getenv |
2323
| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:46 | (const char *)... |
2424
| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:18:70:25 | userName |
25+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | array to pointer conversion |
26+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy |
2527
| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi |
2628
| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv |
2729
| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:45 | (const char *)... |
@@ -31,6 +33,8 @@ WARNING: Module TaintedWithPath has been deprecated and may be removed in future
3133
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:6:88:27 | ! ... |
3234
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:12 | call to strcmp |
3335
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:27 | (bool)... |
36+
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | (const char *)... |
37+
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | copy |
3438
| test.cpp:100:12:100:15 | call to gets | test.cpp:100:12:100:15 | call to gets |
3539
| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion |
3640
| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer |
@@ -40,3 +44,5 @@ WARNING: Module TaintedWithPath has been deprecated and may be removed in future
4044
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:6:111:27 | ! ... |
4145
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:12 | call to strcmp |
4246
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:27 | (bool)... |
47+
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | (const char *)... |
48+
| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | copy |

0 commit comments

Comments
 (0)