Skip to content

Commit d3cccca

Browse files
jketemajketema
committed
C++: Filter duplicate (source, sink)-pairs
1 parent 378206a commit d3cccca

File tree

3 files changed

+17
-9
lines changed

3 files changed

+17
-9
lines changed

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,9 @@ class FileFunction extends FunctionWithWrappers {
4848
}
4949

5050
Expr asSourceExpr(DataFlow::Node node) {
51-
result in [node.asConvertedExpr(), node.asDefiningArgument()]
51+
result = node.asConvertedExpr()
52+
or
53+
result = node.asDefiningArgument()
5254
}
5355

5456
Expr asSinkExpr(DataFlow::Node node) {
@@ -79,6 +81,19 @@ class TaintedPathConfiguration extends TaintTracking::Configuration {
7981
override predicate isSanitizer(DataFlow::Node node) {
8082
node.asExpr().(Call).getTarget().getUnspecifiedType() instanceof ArithmeticType
8183
}
84+
85+
predicate hasFilteredFlowPath(DataFlow::PathNode source, DataFlow::PathNode sink) {
86+
this.hasFlowPath(source, sink) and
87+
not exists(DataFlow::PathNode source2, DataFlow::PathNode sink2 |
88+
this.hasFlowPath(source2, sink2) and
89+
asSourceExpr(source.getNode()) = asSourceExpr(source2.getNode()) and
90+
asSinkExpr(sink.getNode()) = asSinkExpr(sink2.getNode())
91+
|
92+
not exists(source.getNode().asConvertedExpr()) and exists(source2.getNode().asConvertedExpr())
93+
or
94+
not exists(sink.getNode().asConvertedExpr()) and exists(sink2.getNode().asConvertedExpr())
95+
)
96+
}
8297
}
8398

8499
from
@@ -87,7 +102,7 @@ from
87102
where
88103
taintedArg = asSinkExpr(sinkNode.getNode()) and
89104
fileFunction.outermostWrapperFunctionCall(taintedArg, callChain) and
90-
cfg.hasFlowPath(sourceNode, sinkNode) and
105+
cfg.hasFilteredFlowPath(sourceNode, sinkNode) and
91106
taintSource = asSourceExpr(sourceNode.getNode()) and
92107
isUserInput(taintSource, taintCause)
93108
select taintedArg, sourceNode, sinkNode,

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,3 @@ nodes
88
subpaths
99
#select
1010
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |
11-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | ... + ... | user input (fgets) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,6 @@ nodes
2626
subpaths
2727
#select
2828
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (argv) |
29-
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (argv) |
3029
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv | user input (argv) |
31-
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv | test.c:32:11:32:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv | user input (argv) |
3230
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | fileName | test.c:38:11:38:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | fileName | user input (scanf) |
33-
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | fileName | user input (scanf) |
3431
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | fileName | test.c:44:11:44:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | fileName | user input (scanf) |
35-
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | fileName | test.c:44:11:44:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | fileName | user input (scanf) |
36-
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | fileName | user input (scanf) |
37-
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | fileName | user input (scanf) |

0 commit comments

Comments
 (0)