C++: Add a test for simple sinks involving ZMQ networking library.

Author: geoffw0

cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp

@@ -1,15 +1,15 @@
 // Semmle test cases for rule CWE-497
 
-// library functions etc
+// --- library functions etc ---
 
 #include "tests.h"
 
+typedef unsigned long size_t;
+
+void *memcpy(void *dest, const void *src, size_t count);
 char *getenv(const char *name);
 char *strcpy(char *s1, const char *s2);
-
-
-
-
+size_t strlen(const char *s);
 
 
 
@@ -45,7 +45,7 @@ passwd *getpwuid(int uid);
 
 int val();
 
-// test cases
+// --- test cases ---
 
 const char *global1 = mysql_get_client_info();
 const char *global2 = "abc";
@@ -112,3 +112,51 @@ void test1()
 		send(sock, c2.ptr, val(), val()); // GOOD: not system data
 	}
 }
+
+struct zmq_msg_t {
+};
+typedef void (*zmq_free_fn)();
+
+int zmq_msg_init_data(zmq_msg_t *msg, void *data, size_t size, zmq_free_fn *ffn, void *hint);
+int zmq_msg_init_size(zmq_msg_t *msg, size_t size);
+void *zmq_msg_data(zmq_msg_t *msg);
+int zmq_send(void *socket, const void *buf, size_t len, int flags);
+int zmq_sendmsg(void *socket, zmq_msg_t *msg, int flags); // deprecated
+int zmq_msg_send(zmq_msg_t *msg, void *socket, int flags);
+
+void test_zmq(void *remoteSocket)
+{
+	zmq_msg_t message;
+	char *message_data;
+	size_t message_len;
+
+	// prepare data
+	message_data = getenv("HOME");
+	message_len = strlen(message_data) + 1;
+
+	// send as data
+	if (zmq_send(socket, message_data, message_len, 0) >= 0) { // BAD: outputs HOME environment variable [NOT DETECTED]
+		// ...
+	}
+
+	// send as message
+	if (zmq_msg_init_data(&message, message_data, message_len, 0, 0)) {
+		if (zmq_sendmsg(remoteSocket, &message, message_len)) { // BAD: outputs HOME environment variable [NOT DETECTED]
+			// ...
+		}
+		if (zmq_msg_send(&message, remoteSocket, message_len)) { // BAD: outputs HOME environment variable [NOT DETECTED]
+			// ...
+		}
+	}
+
+	// send as message (alternative path)
+	if (zmq_msg_init_size(&message, message_len) == 0) {
+		memcpy(zmq_msg_data(&message), message_data, message_len);
+		if (zmq_sendmsg(remoteSocket,&message, message_len)) { // BAD: outputs HOME environment variable [NOT DETECTED]
+			// ...
+		}
+		if (zmq_msg_send(&message, remoteSocket, message_len)) { // BAD: outputs HOME environment variable [NOT DETECTED]
+			// ...
+		}
+	}
+}