Skip to content

Commit aacbfc0

Browse files
geoffw0geoffw0
committed
Rust: Improve alert messages.
1 parent a6e106e commit aacbfc0

3 files changed

Lines changed: 62 additions & 46 deletions

File tree

‎rust/ql/lib/codeql/rust/security/HardcodedCryptographicValueExtensions.qll‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,26 @@ private import codeql.rust.dataflow.DataFlow
88
private import codeql.rust.dataflow.internal.DataFlowImpl
99
private import codeql.rust.security.SensitiveData
1010

11+
/**
12+
* A kind of cryptographic value.
13+
*/
14+
class CryptographicValueKind extends string {
15+
CryptographicValueKind() { this = ["password", "key", "iv", "salt"] }
16+
17+
/**
18+
* Gets a description of this value kind for user-facing messages.
19+
*/
20+
string getDescription() {
21+
this = "password" and result = "a password"
22+
or
23+
this = "key" and result = "a key"
24+
or
25+
this = "iv" and result = "an initialization vector"
26+
or
27+
this = "salt" and result = "a salt"
28+
}
29+
}
30+
1131
/**
1232
* Provides default sources, sinks and barriers for detecting hardcoded cryptographic
1333
* value vulnerabilities, as well as extension points for adding your own.
@@ -23,10 +43,9 @@ module HardcodedCryptographicValue {
2343
*/
2444
abstract class Sink extends DataFlow::Node {
2545
/**
26-
* Gets the kind of credential this sink is interpreted as,
27-
* for example "password", "key", "iv", "salt".
46+
* Gets the kind of credential this sink is interpreted as.
2847
*/
29-
abstract string getKind();
48+
abstract CryptographicValueKind getKind();
3049
}
3150

3251
/**
@@ -45,13 +64,10 @@ module HardcodedCryptographicValue {
4564
* A sink for hardcoded cryptographic value from model data.
4665
*/
4766
private class ModelsAsDataSinks extends Sink {
48-
string kind;
67+
CryptographicValueKind kind;
4968

50-
ModelsAsDataSinks() {
51-
kind = ["password", "key", "iv", "salt"] and
52-
sinkNode(this, "credentials-" + kind)
53-
}
69+
ModelsAsDataSinks() { sinkNode(this, "credentials-" + kind) }
5470

55-
override string getKind() { result = kind }
71+
override CryptographicValueKind getKind() { result = kind }
5672
}
5773
}

‎rust/ql/src/queries/security/CWE-798/HardcodedCryptographicValue.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,4 +47,4 @@ from
4747
HardcodedCryptographicValueFlow::PathNode source, HardcodedCryptographicValueFlow::PathNode sink
4848
where HardcodedCryptographicValueFlow::flowPath(source, sink)
4949
select source.getNode(), source, sink, "This hard-coded value is used as $@.", sink,
50-
sink.getNode().(HardcodedCryptographicValueConfig::Sink).getKind()
50+
sink.getNode().(HardcodedCryptographicValueConfig::Sink).getKind().getDescription()

‎rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,40 @@
11
#select
2-
| test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:19:30:19:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:19:30:19:47 | ...::new | key |
3-
| test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:26:30:26:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:26:30:26:40 | ...::new | key |
4-
| test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | iv |
5-
| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
6-
| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
7-
| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
8-
| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
9-
| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
10-
| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
11-
| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
12-
| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
13-
| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
14-
| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
15-
| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
16-
| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
17-
| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
18-
| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
19-
| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
20-
| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | key |
21-
| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
22-
| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
23-
| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
24-
| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
25-
| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
26-
| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
27-
| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
28-
| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
29-
| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
30-
| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
31-
| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
32-
| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
33-
| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
34-
| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
35-
| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
36-
| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | key |
37-
| test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | key |
2+
| test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:18:30:18:32 | 0u8 | test_cipher.rs:19:30:19:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:19:30:19:47 | ...::new | a key |
3+
| test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:25:30:25:32 | 0u8 | test_cipher.rs:26:30:26:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:26:30:26:40 | ...::new | a key |
4+
| test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:29:30:29:32 | 0u8 | test_cipher.rs:30:30:30:40 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:30:30:30:40 | ...::new | an initialization vector |
5+
| test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:37:28:37:28 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
6+
| test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:37:31:37:31 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
7+
| test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:37:34:37:34 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
8+
| test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:37:37:37:37 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
9+
| test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:37:40:37:40 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
10+
| test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:37:43:37:43 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
11+
| test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:37:46:37:46 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
12+
| test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:37:49:37:49 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
13+
| test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:37:52:37:52 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
14+
| test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:37:55:37:55 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
15+
| test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:37:58:37:58 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
16+
| test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:37:61:37:61 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
17+
| test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:37:64:37:64 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
18+
| test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:37:67:37:67 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
19+
| test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:37:70:37:70 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
20+
| test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:37:73:37:73 | 0 | test_cipher.rs:38:30:38:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:38:30:38:47 | ...::new | a key |
21+
| test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:41:30:41:30 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
22+
| test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:41:33:41:33 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
23+
| test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:41:36:41:36 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
24+
| test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:41:39:41:39 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
25+
| test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:41:42:41:42 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
26+
| test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:41:45:41:45 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
27+
| test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:41:48:41:48 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
28+
| test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:41:51:41:51 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
29+
| test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:41:54:41:54 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
30+
| test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:41:57:41:57 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
31+
| test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:41:60:41:60 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
32+
| test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:41:63:41:63 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
33+
| test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:41:66:41:66 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
34+
| test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:41:69:41:69 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
35+
| test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:41:72:41:72 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
36+
| test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:41:75:41:75 | 0 | test_cipher.rs:42:30:42:47 | ...::new | This hard-coded value is used as $@. | test_cipher.rs:42:30:42:47 | ...::new | a key |
37+
| test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:73:20:73:22 | 0u8 | test_cipher.rs:74:23:74:44 | ...::new_from_slice | This hard-coded value is used as $@. | test_cipher.rs:74:23:74:44 | ...::new_from_slice | a key |
3838
edges
3939
| test_cipher.rs:18:9:18:14 | const1 [&ref, element] | test_cipher.rs:19:73:19:78 | const1 [&ref, element] | provenance | |
4040
| test_cipher.rs:18:28:18:36 | &... [&ref, element] | test_cipher.rs:18:9:18:14 | const1 [&ref, element] | provenance | |

0 commit comments

Comments
 (0)