Skip to content

Commit 2e61ae2

Browse files
geoffw0geoffw0
committed
C++: Set literals.
1 parent 169cc75 commit 2e61ae2

File tree

14 files changed

+83
-175
lines changed

14 files changed

+83
-175
lines changed

‎cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateData.qll‎

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,26 +13,25 @@ import cpp
1313

1414
/** A string for `match` that identifies strings that look like they represent private data. */
1515
private string privateNames() {
16-
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
17-
// Government identifiers, such as Social Security Numbers
18-
result = "%social%security%number%" or
19-
// Contact information, such as home addresses and telephone numbers
20-
result = "%postcode%" or
21-
result = "%zipcode%" or
22-
// result = "%telephone%" or
23-
// Geographic location - where the user is (or was)
24-
result = "%latitude%" or
25-
result = "%longitude%" or
26-
// Financial data - such as credit card numbers, salary, bank accounts, and debts
27-
result = "%creditcard%" or
28-
result = "%salary%" or
29-
result = "%bankaccount%" or
30-
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
31-
// result = "%email%" or
32-
// result = "%mobile%" or
33-
result = "%employer%" or
34-
// Health - medical conditions, insurance status, prescription records
35-
result = "%medical%"
16+
result =
17+
[
18+
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
19+
// Government identifiers, such as Social Security Numbers
20+
"%social%security%number%",
21+
// Contact information, such as home addresses and telephone numbers
22+
"%postcode%", "%zipcode%",
23+
// result = "%telephone%" or
24+
// Geographic location - where the user is (or was)
25+
"%latitude%", "%longitude%",
26+
// Financial data - such as credit card numbers, salary, bank accounts, and debts
27+
"%creditcard%", "%salary%", "%bankaccount%",
28+
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
29+
// result = "%email%" or
30+
// result = "%mobile%" or
31+
"%employer%",
32+
// Health - medical conditions, insurance status, prescription records
33+
"%medical%"
34+
]
3635
}
3736

3837
/** An expression that might contain private data. */

‎cpp/ql/lib/semmle/code/cpp/Specifier.qll‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,7 @@ class Specifier extends Element, @specifier {
3232
*/
3333
class FunctionSpecifier extends Specifier {
3434
FunctionSpecifier() {
35-
this.hasName("inline") or
36-
this.hasName("virtual") or
37-
this.hasName("explicit")
35+
this.hasName(["inline", "virtual", "explicit"])
3836
}
3937

4038
override string getAPrimaryQlClass() { result = "FunctionSpecifier" }
@@ -46,11 +44,7 @@ class FunctionSpecifier extends Specifier {
4644
*/
4745
class StorageClassSpecifier extends Specifier {
4846
StorageClassSpecifier() {
49-
this.hasName("auto") or
50-
this.hasName("register") or
51-
this.hasName("static") or
52-
this.hasName("extern") or
53-
this.hasName("mutable")
47+
this.hasName(["auto", "register", "static", "extern", "mutable"])
5448
}
5549

5650
override string getAPrimaryQlClass() { result = "StorageClassSpecifier" }
@@ -61,9 +55,7 @@ class StorageClassSpecifier extends Specifier {
6155
*/
6256
class AccessSpecifier extends Specifier {
6357
AccessSpecifier() {
64-
this.hasName("public") or
65-
this.hasName("protected") or
66-
this.hasName("private")
58+
this.hasName(["public", "protected", "private"])
6759
}
6860

6961
/**

‎cpp/ql/lib/semmle/code/cpp/security/CommandExecution.qll‎

Lines changed: 19 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -28,35 +28,19 @@ class SystemFunction extends FunctionWithWrappers instanceof CommandExecutionFun
2828
*/
2929
class VarargsExecFunctionCall extends FunctionCall {
3030
VarargsExecFunctionCall() {
31-
getTarget().hasGlobalName("execl") or
32-
getTarget().hasGlobalName("execle") or
33-
getTarget().hasGlobalName("execlp") or
34-
// Windows
35-
getTarget().hasGlobalName("_execl") or
36-
getTarget().hasGlobalName("_execle") or
37-
getTarget().hasGlobalName("_execlp") or
38-
getTarget().hasGlobalName("_execlpe") or
39-
getTarget().hasGlobalName("_spawnl") or
40-
getTarget().hasGlobalName("_spawnle") or
41-
getTarget().hasGlobalName("_spawnlp") or
42-
getTarget().hasGlobalName("_spawnlpe") or
43-
getTarget().hasGlobalName("_wexecl") or
44-
getTarget().hasGlobalName("_wexecle") or
45-
getTarget().hasGlobalName("_wexeclp") or
46-
getTarget().hasGlobalName("_wexeclpe") or
47-
getTarget().hasGlobalName("_wspawnl") or
48-
getTarget().hasGlobalName("_wspawnle") or
49-
getTarget().hasGlobalName("_wspawnlp") or
50-
getTarget().hasGlobalName("_wspawnlpe")
31+
getTarget()
32+
.hasGlobalName([
33+
"execl", "execle", "execlp",
34+
// Windows
35+
"_execl", "_execle", "_execlp", "_execlpe", "_spawnl", "_spawnle", "_spawnlp",
36+
"_spawnlpe", "_wexecl", "_wexecle", "_wexeclp", "_wexeclpe", "_wspawnl", "_wspawnle",
37+
"_wspawnlp", "_wspawnlpe"
38+
])
5139
}
5240

5341
/** Whether the last argument to the function is an environment pointer */
5442
predicate hasEnvironmentArgument() {
55-
getTarget().hasGlobalName("execle") or
56-
getTarget().hasGlobalName("_execle") or
57-
getTarget().hasGlobalName("_execlpe") or
58-
getTarget().hasGlobalName("_wexecle") or
59-
getTarget().hasGlobalName("_wexeclpe")
43+
getTarget().hasGlobalName(["execle", "_execle", "_execlpe", "_wexecle", "_wexeclpe"])
6044
}
6145

6246
/**
@@ -83,11 +67,7 @@ class VarargsExecFunctionCall extends FunctionCall {
8367
* all the other ones start with the command.
8468
*/
8569
private int getCommandIdx() {
86-
if
87-
getTarget().getName().matches("\\_spawn%") or
88-
getTarget().getName().matches("\\_wspawn%")
89-
then result = 1
90-
else result = 0
70+
if getTarget().getName().matches(["\\_spawn%", "\\_wspawn%"]) then result = 1 else result = 0
9171
}
9272
}
9373

@@ -98,28 +78,14 @@ class VarargsExecFunctionCall extends FunctionCall {
9878
*/
9979
class ArrayExecFunctionCall extends FunctionCall {
10080
ArrayExecFunctionCall() {
101-
getTarget().hasGlobalName("execv") or
102-
getTarget().hasGlobalName("execvp") or
103-
getTarget().hasGlobalName("execvpe") or
104-
getTarget().hasGlobalName("execve") or
105-
getTarget().hasGlobalName("fexecve") or
106-
// Windows variants
107-
getTarget().hasGlobalName("_execv") or
108-
getTarget().hasGlobalName("_execve") or
109-
getTarget().hasGlobalName("_execvp") or
110-
getTarget().hasGlobalName("_execvpe") or
111-
getTarget().hasGlobalName("_spawnv") or
112-
getTarget().hasGlobalName("_spawnve") or
113-
getTarget().hasGlobalName("_spawnvp") or
114-
getTarget().hasGlobalName("_spawnvpe") or
115-
getTarget().hasGlobalName("_wexecv") or
116-
getTarget().hasGlobalName("_wexecve") or
117-
getTarget().hasGlobalName("_wexecvp") or
118-
getTarget().hasGlobalName("_wexecvpe") or
119-
getTarget().hasGlobalName("_wspawnv") or
120-
getTarget().hasGlobalName("_wspawnve") or
121-
getTarget().hasGlobalName("_wspawnvp") or
122-
getTarget().hasGlobalName("_wspawnvpe")
81+
getTarget()
82+
.hasGlobalName([
83+
"execv", "execvp", "execvpe", "execve", "fexecve",
84+
// Windows variants
85+
"_execv", "_execve", "_execvp", "_execvpe", "_spawnv", "_spawnve", "_spawnvp",
86+
"_spawnvpe", "_wexecv", "_wexecve", "_wexecvp", "_wexecvpe", "_wspawnv", "_wspawnve",
87+
"_wspawnvp", "_wspawnvpe"
88+
])
12389
}
12490

12591
/** The argument with the array of command arguments */
@@ -133,11 +99,7 @@ class ArrayExecFunctionCall extends FunctionCall {
13399
* all the other ones start with the command.
134100
*/
135101
private int getCommandIdx() {
136-
if
137-
getTarget().getName().matches("\\_spawn%") or
138-
getTarget().getName().matches("\\_wspawn%")
139-
then result = 1
140-
else result = 0
102+
if getTarget().getName().matches(["\\_spawn%", "\\_wspawn%"]) then result = 1 else result = 0
141103
}
142104
}
143105

‎cpp/ql/lib/semmle/code/cpp/security/OutputWrite.qll‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,12 @@ class OutputWrite extends Expr {
2121
* A standard output or standard error variable.
2222
*/
2323
private predicate outputVariable(Variable v) {
24-
// standard output
25-
v.hasName("cout") or
26-
v.hasName("wcout") or
27-
// standard error
28-
v.hasName("cerr") or
29-
v.hasName("clog") or
30-
v.hasName("wcerr") or
31-
v.hasName("wclog")
24+
v.hasName([
25+
// standard output
26+
"cout", "wcout",
27+
// standard error
28+
"cerr", "clog", "wcerr", "wclog"
29+
])
3230
}
3331

3432
/**
@@ -64,10 +62,7 @@ private predicate outputWrite(Expr write, Expr source) {
6462
arg >= f.(FormattingFunction).getFormatParameterIndex()
6563
or
6664
// puts, putchar
67-
(
68-
f.hasGlobalOrStdName("puts") or
69-
f.hasGlobalOrStdName("putchar")
70-
) and
65+
f.hasGlobalOrStdName(["puts", "putchar"]) and
7166
arg = 0
7267
or
7368
exists(Call wrappedCall, Expr wrappedSource |

‎cpp/ql/lib/semmle/code/cpp/security/SensitiveExprs.qll‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,8 @@ import cpp
1111
*/
1212
bindingset[s]
1313
private predicate suspicious(string s) {
14-
(
15-
s.matches("%password%") or
16-
s.matches("%passwd%") or
17-
s.matches("%trusted%")
18-
) and
19-
not (
20-
s.matches("%hash%") or
21-
s.matches("%crypt%") or
22-
s.matches("%file%") or
23-
s.matches("%path%")
24-
)
14+
s.matches(["%password%", "%passwd%", "%trusted%"]) and
15+
not s.matches(["%hash%", "%crypt%", "%file%", "%path%"])
2516
}
2617

2718
/**

‎cpp/ql/src/Best Practices/Magic Constants/MagicConstants.qll‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,7 @@ predicate intTrivial(Literal lit) { exists(string v | trivialIntValue(v) and v =
5858
predicate longTrivial(Literal lit) { exists(string v | trivialLongValue(v) and v = lit.getValue()) }
5959

6060
predicate powerOfTen(float f) {
61-
f = 10 or
62-
f = 100 or
63-
f = 1000 or
64-
f = 10000 or
65-
f = 100000 or
66-
f = 1000000 or
67-
f = 10000000 or
68-
f = 100000000 or
69-
f = 1000000000
61+
f = [10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000, 1000000000]
7062
}
7163

7264
predicate floatTrivial(Literal lit) {

‎cpp/ql/src/Likely Bugs/Conversion/NonzeroValueCastToPointer.ql‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,15 @@
1313
import cpp
1414

1515
predicate commonErrorCode(string value) {
16-
value = "0" or
17-
value = "1" or
18-
value = "-1" or
19-
value = "18446744073709551615" or // 2^64-1, i.e. -1 as an unsigned int64
20-
value = "4294967295" or // 2^32-1, i.e. -1 as an unsigned int32
21-
value = "3735928559" or // 0xdeadbeef
22-
value = "3735929054" or // 0xdeadc0de
23-
value = "3405691582" // 0xcafebabe
16+
value =
17+
[
18+
"0", "1", "-1", // common error codes
19+
"18446744073709551615", // 2^64-1, i.e. -1 as an unsigned int64
20+
"4294967295", // 2^32-1, i.e. -1 as an unsigned int32
21+
"3735928559", // 0xdeadbeef
22+
"3735929054", // 0xdeadc0de
23+
"3405691582" // 0xcafebabe
24+
]
2425
}
2526

2627
from Expr e

‎cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.ql‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -43,23 +43,25 @@ predicate isSizePlus(Expr e, BufferSizeExpr baseSize, int plus) {
4343

4444
predicate strncpyFunction(Function f, int argDest, int argSrc, int argLimit) {
4545
exists(string name | name = f.getName() |
46-
(
47-
name = "strcpy_s" or // strcpy_s(dst, max_amount, src)
48-
name = "wcscpy_s" or // wcscpy_s(dst, max_amount, src)
49-
name = "_mbscpy_s" // _mbscpy_s(dst, max_amount, src)
50-
) and
46+
name =
47+
[
48+
"strcpy_s", // strcpy_s(dst, max_amount, src)
49+
"wcscpy_s", // wcscpy_s(dst, max_amount, src)
50+
"_mbscpy_s" // _mbscpy_s(dst, max_amount, src)
51+
] and
5152
argDest = 0 and
5253
argSrc = 2 and
5354
argLimit = 1
5455
or
55-
(
56-
name = "strncpy" or // strncpy(dst, src, max_amount)
57-
name = "strncpy_l" or // strncpy_l(dst, src, max_amount, locale)
58-
name = "wcsncpy" or // wcsncpy(dst, src, max_amount)
59-
name = "_wcsncpy_l" or // _wcsncpy_l(dst, src, max_amount, locale)
60-
name = "_mbsncpy" or // _mbsncpy(dst, src, max_amount)
61-
name = "_mbsncpy_l" // _mbsncpy_l(dst, src, max_amount, locale)
62-
) and
56+
name =
57+
[
58+
"strncpy", // strncpy(dst, src, max_amount)
59+
"strncpy_l", // strncpy_l(dst, src, max_amount, locale)
60+
"wcsncpy", // wcsncpy(dst, src, max_amount)
61+
"_wcsncpy_l", // _wcsncpy_l(dst, src, max_amount, locale)
62+
"_mbsncpy", // _mbsncpy(dst, src, max_amount)
63+
"_mbsncpy_l" // _mbsncpy_l(dst, src, max_amount, locale)
64+
] and
6365
argDest = 0 and
6466
argSrc = 1 and
6567
argLimit = 2

‎cpp/ql/src/Power of 10/Rule 1/UseOfJmp.ql‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@ import cpp
1515
class ForbiddenFunction extends Function {
1616
ForbiddenFunction() {
1717
exists(string name | name = this.getName() |
18-
name = "setjmp" or
19-
name = "longjmp" or
20-
name = "sigsetjmp" or
21-
name = "siglongjmp"
18+
name = ["setjmp", "longjmp", "sigsetjmp", "siglongjmp"]
2219
)
2320
}
2421
}

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,8 @@ import TaintedWithPath
2626
class FileFunction extends FunctionWithWrappers {
2727
FileFunction() {
2828
exists(string nme | this.hasGlobalName(nme) |
29-
nme = "fopen" or
30-
nme = "_fopen" or
31-
nme = "_wfopen" or
32-
nme = "open" or
33-
nme = "_open" or
34-
nme = "_wopen" or
29+
nme = ["fopen", "_fopen", "_wfopen", "open", "_open", "_wopen"]
30+
or
3531
// create file function on windows
3632
nme.matches("CreateFile%")
3733
)
@@ -40,10 +36,7 @@ class FileFunction extends FunctionWithWrappers {
4036
or
4137
// on any of the fstream classes, or filebuf
4238
exists(string nme | this.getDeclaringType().hasQualifiedName("std", nme) |
43-
nme = "basic_fstream" or
44-
nme = "basic_ifstream" or
45-
nme = "basic_ofstream" or
46-
nme = "basic_filebuf"
39+
nme = ["basic_fstream", "basic_ifstream", "basic_ofstream", "basic_filebuf"]
4740
) and
4841
// we look for either the open method or the constructor
4942
(this.getName() = "open" or this instanceof Constructor)

0 commit comments

Comments
 (0)