Skip to content

Commit 16e0de0

Browse files
geoffw0geoffw0
committed
Rust: Fill gaps in the tokio models.
1 parent 29e7b6a commit 16e0de0

File tree

3 files changed

+86
-28
lines changed

3 files changed

+86
-28
lines changed

‎rust/ql/lib/codeql/rust/frameworks/tokio/fs.model.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,42 @@ extensions:
99
- ["<tokio::fs::read_dir::DirEntry>::path", "ReturnValue", "file", "manual"]
1010
- ["<tokio::fs::read_dir::DirEntry>::file_name", "ReturnValue", "file", "manual"]
1111
- ["<tokio::fs::file::File>::open", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "file", "manual"]
12+
- addsTo:
13+
pack: codeql/rust-all
14+
extensible: sinkModel
15+
data:
16+
- ["tokio::fs::copy::copy", "Argument[0]", "path-injection", "manual"]
17+
- ["tokio::fs::copy::copy", "Argument[1]", "path-injection", "manual"]
18+
- ["tokio::fs::create_dir::create_dir", "Argument[0]", "path-injection", "manual"]
19+
- ["tokio::fs::create_dir_all::create_dir_all", "Argument[0]", "path-injection", "manual"]
20+
- ["tokio::fs::hard_link::hard_link", "Argument[0]", "path-injection", "manual"]
21+
- ["tokio::fs::hard_link::hard_link", "Argument[1]", "path-injection", "manual"]
22+
- ["tokio::fs::metadata::metadata", "Argument[0]", "path-injection", "manual"]
23+
- ["tokio::fs::read::read", "Argument[0]", "path-injection", "manual"]
24+
- ["tokio::fs::read_dir::read_dir", "Argument[0]", "path-injection", "manual"]
25+
- ["tokio::fs::read_link::read_link", "Argument[0]", "path-injection", "manual"]
26+
- ["tokio::fs::read_to_string::read_to_string", "Argument[0]", "path-injection", "manual"]
27+
- ["tokio::fs::remove_dir::remove_dir", "Argument[0]", "path-injection", "manual"]
28+
- ["tokio::fs::remove_dir_all::remove_dir_all", "Argument[0]", "path-injection", "manual"]
29+
- ["tokio::fs::remove_file::remove_file", "Argument[0]", "path-injection", "manual"]
30+
- ["tokio::fs::rename::rename", "Argument[0]", "path-injection", "manual"]
31+
- ["tokio::fs::rename::rename", "Argument[1]", "path-injection", "manual"]
32+
- ["tokio::fs::set_permissions::set_permissions", "Argument[0]", "path-injection", "manual"]
33+
- ["tokio::fs::symlink::symlink", "Argument[0]", "path-injection", "manual"]
34+
- ["tokio::fs::symlink::symlink", "Argument[1]", "path-injection", "manual"]
35+
- ["tokio::fs::symlink_dir::symlink_dir", "Argument[0]", "path-injection", "manual"]
36+
- ["tokio::fs::symlink_dir::symlink_dir", "Argument[1]", "path-injection", "manual"]
37+
- ["tokio::fs::symlink_file::symlink_file", "Argument[0]", "path-injection", "manual"]
38+
- ["tokio::fs::symlink_file::symlink_file", "Argument[1]", "path-injection", "manual"]
39+
- ["tokio::fs::symlink_metadata::symlink_metadata", "Argument[0]", "path-injection", "manual"]
40+
- ["tokio::fs::try_exists::try_exists", "Argument[0]", "path-injection", "manual"]
41+
- ["tokio::fs::write::write", "Argument[0]", "path-injection", "manual"]
42+
- ["<tokio::fs::dir_builder::DirBuilder>::create", "Argument[0]", "path-injection", "manual"]
43+
- ["<tokio::fs::file::File>::create", "Argument[0]", "path-injection", "manual"]
44+
- ["<tokio::fs::file::File>::create_new", "Argument[0]", "path-injection", "manual"]
45+
- ["<tokio::fs::file::File>::open", "Argument[0]", "path-injection", "manual"]
46+
- addsTo:
47+
pack: codeql/rust-all
48+
extensible: summaryModel
49+
data:
50+
- ["tokio::fs::canonicalize::canonicalize", "Argument[0]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]

‎rust/ql/test/query-tests/security/CWE-022/TaintedPath.expected‎

Lines changed: 41 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,48 +2,59 @@
22
| src/main.rs:11:5:11:22 | ...::read_to_string | src/main.rs:7:11:7:19 | file_name | src/main.rs:11:5:11:22 | ...::read_to_string | This path depends on a $@. | src/main.rs:7:11:7:19 | file_name | user-provided value |
33
| src/main.rs:104:13:104:31 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:104:13:104:31 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
44
| src/main.rs:107:13:107:31 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:107:13:107:31 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
5+
| src/main.rs:110:13:110:33 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:110:13:110:33 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
56
| src/main.rs:113:13:113:37 | ...::open | src/main.rs:103:17:103:30 | ...::args | src/main.rs:113:13:113:37 | ...::open | This path depends on a $@. | src/main.rs:103:17:103:30 | ...::args | user-provided value |
67
edges
78
| src/main.rs:7:11:7:19 | file_name | src/main.rs:9:35:9:43 | file_name | provenance | |
89
| src/main.rs:9:9:9:17 | file_path | src/main.rs:11:24:11:32 | file_path | provenance | |
910
| src/main.rs:9:21:9:44 | ...::from(...) | src/main.rs:9:9:9:17 | file_path | provenance | |
10-
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:9 |
11-
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:9 |
12-
| src/main.rs:11:24:11:32 | file_path | src/main.rs:11:5:11:22 | ...::read_to_string | provenance | MaD:3 Sink:MaD:3 |
11+
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:10 |
12+
| src/main.rs:9:35:9:43 | file_name | src/main.rs:9:21:9:44 | ...::from(...) | provenance | MaD:10 |
13+
| src/main.rs:11:24:11:32 | file_path | src/main.rs:11:5:11:22 | ...::read_to_string | provenance | MaD:4 Sink:MaD:4 |
1314
| src/main.rs:103:9:103:13 | path1 | src/main.rs:104:33:104:37 | path1 | provenance | |
1415
| src/main.rs:103:9:103:13 | path1 | src/main.rs:106:39:106:43 | path1 | provenance | |
16+
| src/main.rs:103:9:103:13 | path1 | src/main.rs:109:41:109:45 | path1 | provenance | |
1517
| src/main.rs:103:9:103:13 | path1 | src/main.rs:112:45:112:49 | path1 | provenance | |
16-
| src/main.rs:103:17:103:30 | ...::args | src/main.rs:103:17:103:32 | ...::args(...) [element] | provenance | Src:MaD:4 |
17-
| src/main.rs:103:17:103:32 | ...::args(...) [element] | src/main.rs:103:17:103:39 | ... .nth(...) [Some] | provenance | MaD:6 |
18-
| src/main.rs:103:17:103:39 | ... .nth(...) [Some] | src/main.rs:103:17:103:48 | ... .unwrap() | provenance | MaD:7 |
18+
| src/main.rs:103:17:103:30 | ...::args | src/main.rs:103:17:103:32 | ...::args(...) [element] | provenance | Src:MaD:5 |
19+
| src/main.rs:103:17:103:32 | ...::args(...) [element] | src/main.rs:103:17:103:39 | ... .nth(...) [Some] | provenance | MaD:7 |
20+
| src/main.rs:103:17:103:39 | ... .nth(...) [Some] | src/main.rs:103:17:103:48 | ... .unwrap() | provenance | MaD:8 |
1921
| src/main.rs:103:17:103:48 | ... .unwrap() | src/main.rs:103:9:103:13 | path1 | provenance | |
20-
| src/main.rs:104:33:104:37 | path1 | src/main.rs:104:33:104:45 | path1.clone() | provenance | MaD:5 |
22+
| src/main.rs:104:33:104:37 | path1 | src/main.rs:104:33:104:45 | path1.clone() | provenance | MaD:6 |
2123
| src/main.rs:104:33:104:45 | path1.clone() | src/main.rs:104:13:104:31 | ...::open | provenance | MaD:2 Sink:MaD:2 |
2224
| src/main.rs:106:9:106:13 | path2 | src/main.rs:107:33:107:37 | path2 | provenance | |
23-
| src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | src/main.rs:106:17:106:61 | ... .unwrap() | provenance | MaD:8 |
25+
| src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | src/main.rs:106:17:106:61 | ... .unwrap() | provenance | MaD:9 |
2426
| src/main.rs:106:17:106:61 | ... .unwrap() | src/main.rs:106:9:106:13 | path2 | provenance | |
25-
| src/main.rs:106:39:106:43 | path1 | src/main.rs:106:39:106:51 | path1.clone() | provenance | MaD:5 |
26-
| src/main.rs:106:39:106:51 | path1.clone() | src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | provenance | MaD:11 |
27+
| src/main.rs:106:39:106:43 | path1 | src/main.rs:106:39:106:51 | path1.clone() | provenance | MaD:6 |
28+
| src/main.rs:106:39:106:51 | path1.clone() | src/main.rs:106:17:106:52 | ...::canonicalize(...) [Ok] | provenance | MaD:12 |
2729
| src/main.rs:107:33:107:37 | path2 | src/main.rs:107:13:107:31 | ...::open | provenance | MaD:2 Sink:MaD:2 |
30+
| src/main.rs:109:9:109:13 | path3 | src/main.rs:110:35:110:39 | path3 | provenance | |
31+
| src/main.rs:109:17:109:54 | ...::canonicalize(...) [future, Ok] | src/main.rs:109:17:109:60 | await ... [Ok] | provenance | |
32+
| src/main.rs:109:17:109:60 | await ... [Ok] | src/main.rs:109:17:109:69 | ... .unwrap() | provenance | MaD:9 |
33+
| src/main.rs:109:17:109:69 | ... .unwrap() | src/main.rs:109:9:109:13 | path3 | provenance | |
34+
| src/main.rs:109:41:109:45 | path1 | src/main.rs:109:41:109:53 | path1.clone() | provenance | MaD:6 |
35+
| src/main.rs:109:41:109:53 | path1.clone() | src/main.rs:109:17:109:54 | ...::canonicalize(...) [future, Ok] | provenance | MaD:13 |
36+
| src/main.rs:110:35:110:39 | path3 | src/main.rs:110:13:110:33 | ...::open | provenance | MaD:3 Sink:MaD:3 |
2837
| src/main.rs:112:9:112:13 | path4 | src/main.rs:113:39:113:43 | path4 | provenance | |
2938
| src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | src/main.rs:112:17:112:64 | await ... [Ok] | provenance | |
30-
| src/main.rs:112:17:112:64 | await ... [Ok] | src/main.rs:112:17:112:73 | ... .unwrap() | provenance | MaD:8 |
39+
| src/main.rs:112:17:112:64 | await ... [Ok] | src/main.rs:112:17:112:73 | ... .unwrap() | provenance | MaD:9 |
3140
| src/main.rs:112:17:112:73 | ... .unwrap() | src/main.rs:112:9:112:13 | path4 | provenance | |
32-
| src/main.rs:112:45:112:49 | path1 | src/main.rs:112:45:112:57 | path1.clone() | provenance | MaD:5 |
33-
| src/main.rs:112:45:112:57 | path1.clone() | src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | provenance | MaD:10 |
41+
| src/main.rs:112:45:112:49 | path1 | src/main.rs:112:45:112:57 | path1.clone() | provenance | MaD:6 |
42+
| src/main.rs:112:45:112:57 | path1.clone() | src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | provenance | MaD:11 |
3443
| src/main.rs:113:39:113:43 | path4 | src/main.rs:113:13:113:37 | ...::open | provenance | MaD:1 Sink:MaD:1 |
3544
models
3645
| 1 | Sink: <async_std::fs::file::File>::open; Argument[0]; path-injection |
3746
| 2 | Sink: <std::fs::File>::open; Argument[0]; path-injection |
38-
| 3 | Sink: std::fs::read_to_string; Argument[0]; path-injection |
39-
| 4 | Source: std::env::args; ReturnValue.Element; commandargs |
40-
| 5 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
41-
| 6 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
42-
| 7 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
43-
| 8 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
44-
| 9 | Summary: <std::path::PathBuf as core::convert::From>::from; Argument[0]; ReturnValue; taint |
45-
| 10 | Summary: async_std::fs::canonicalize::canonicalize; Argument[0]; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
46-
| 11 | Summary: std::fs::canonicalize; Argument[0]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
47+
| 3 | Sink: <tokio::fs::file::File>::open; Argument[0]; path-injection |
48+
| 4 | Sink: std::fs::read_to_string; Argument[0]; path-injection |
49+
| 5 | Source: std::env::args; ReturnValue.Element; commandargs |
50+
| 6 | Summary: <_ as core::clone::Clone>::clone; Argument[self].Reference; ReturnValue; value |
51+
| 7 | Summary: <_ as core::iter::traits::iterator::Iterator>::nth; Argument[self].Element; ReturnValue.Field[core::option::Option::Some(0)]; value |
52+
| 8 | Summary: <core::option::Option>::unwrap; Argument[self].Field[core::option::Option::Some(0)]; ReturnValue; value |
53+
| 9 | Summary: <core::result::Result>::unwrap; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
54+
| 10 | Summary: <std::path::PathBuf as core::convert::From>::from; Argument[0]; ReturnValue; taint |
55+
| 11 | Summary: async_std::fs::canonicalize::canonicalize; Argument[0]; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
56+
| 12 | Summary: std::fs::canonicalize; Argument[0]; ReturnValue.Field[core::result::Result::Ok(0)]; taint |
57+
| 13 | Summary: tokio::fs::canonicalize::canonicalize; Argument[0]; ReturnValue.Future.Field[core::result::Result::Ok(0)]; taint |
4758
nodes
4859
| src/main.rs:7:11:7:19 | file_name | semmle.label | file_name |
4960
| src/main.rs:9:9:9:17 | file_path | semmle.label | file_path |
@@ -66,6 +77,14 @@ nodes
6677
| src/main.rs:106:39:106:51 | path1.clone() | semmle.label | path1.clone() |
6778
| src/main.rs:107:13:107:31 | ...::open | semmle.label | ...::open |
6879
| src/main.rs:107:33:107:37 | path2 | semmle.label | path2 |
80+
| src/main.rs:109:9:109:13 | path3 | semmle.label | path3 |
81+
| src/main.rs:109:17:109:54 | ...::canonicalize(...) [future, Ok] | semmle.label | ...::canonicalize(...) [future, Ok] |
82+
| src/main.rs:109:17:109:60 | await ... [Ok] | semmle.label | await ... [Ok] |
83+
| src/main.rs:109:17:109:69 | ... .unwrap() | semmle.label | ... .unwrap() |
84+
| src/main.rs:109:41:109:45 | path1 | semmle.label | path1 |
85+
| src/main.rs:109:41:109:53 | path1.clone() | semmle.label | path1.clone() |
86+
| src/main.rs:110:13:110:33 | ...::open | semmle.label | ...::open |
87+
| src/main.rs:110:35:110:39 | path3 | semmle.label | path3 |
6988
| src/main.rs:112:9:112:13 | path4 | semmle.label | path4 |
7089
| src/main.rs:112:17:112:58 | ...::canonicalize(...) [future, Ok] | semmle.label | ...::canonicalize(...) [future, Ok] |
7190
| src/main.rs:112:17:112:64 | await ... [Ok] | semmle.label | await ... [Ok] |

‎rust/ql/test/query-tests/security/CWE-022/src/main.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ async fn more_simple_cases() {
107107
let _ = std::fs::File::open(path2); // $ path-injection-sink Alert[rust/path-injection]=arg1
108108

109109
let path3 = tokio::fs::canonicalize(path1.clone()).await.unwrap();
110-
let _ = tokio::fs::File::open(path3); // $ MISSING: path-injection-sink Alert[rust/path-injection]=arg1
110+
let _ = tokio::fs::File::open(path3); // $ path-injection-sink Alert[rust/path-injection]=arg1
111111

112112
let path4 = async_std::fs::canonicalize(path1.clone()).await.unwrap();
113113
let _ = async_std::fs::File::open(path4); // $ path-injection-sink Alert[rust/path-injection]=arg1
@@ -146,11 +146,11 @@ fn sinks(path1: &Path, path2: &Path) {
146146
let _ = std::fs::DirBuilder::new().recursive(true).create(path1); // $ path-injection-sink
147147
let _ = std::fs::OpenOptions::new().open(path1); // $ MISSING: path-injection-sink
148148

149-
let _ = tokio::fs::read(path1); // $ MISSING: path-injection-sink
150-
let _ = tokio::fs::read_to_string(path1); // $ MISSING: path-injection-sink
151-
let _ = tokio::fs::remove_file(path1); // $ MISSING: path-injection-sink
152-
let _ = tokio::fs::DirBuilder::new().create(path1); // $ MISSING: path-injection-sink
153-
let _ = tokio::fs::DirBuilder::new().recursive(true).create(path1); // $ MISSING: path-injection-sink
149+
let _ = tokio::fs::read(path1); // $ path-injection-sink
150+
let _ = tokio::fs::read_to_string(path1); // $ path-injection-sink
151+
let _ = tokio::fs::remove_file(path1); // $ path-injection-sink
152+
let _ = tokio::fs::DirBuilder::new().create(path1); // $ path-injection-sink
153+
let _ = tokio::fs::DirBuilder::new().recursive(true).create(path1); // $ path-injection-sink
154154
let _ = tokio::fs::OpenOptions::new().open(path1); // $ MISSING: path-injection-sink
155155

156156
let _ = async_std::fs::read(path1); // $ path-injection-sink

0 commit comments

Comments
 (0)