Skip to content

Commit 476df7d

Browse files
MathiasVPMathiasVP
authored
Merge pull request #21260 from MathiasVP/add-windows-remote-flow-sources
C++: Add more Win32 and Azure SDK remote flow sources
2 parents 29e0174 + 092d254 commit 476df7d

File tree

11 files changed

+811
-67
lines changed

11 files changed

+811
-67
lines changed

‎cpp/ql/lib/change-notes/2026-02-03-windows-remote-flow-sources.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added remote flow source models for the `winhttp.h` windows header and the Azure SDK core library for C/C++.

‎cpp/ql/lib/ext/Windows.model.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ extensions:
2424
- ["", "", False, "MapViewOfFileNuma2", "", "", "ReturnValue[*]", "local", "manual"]
2525
# ntifs.h
2626
- ["", "", False, "NtReadFile", "", "", "Argument[*5]", "local", "manual"]
27+
# winhttp.h
28+
- ["", "", False, "WinHttpReadData", "", "", "Argument[*1]", "remote", "manual"]
29+
- ["", "", False, "WinHttpReadDataEx", "", "", "Argument[*1]", "remote", "manual"]
30+
- ["", "", False, "WinHttpQueryHeaders", "", "", "Argument[*3]", "remote", "manual"]
31+
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[*5]", "remote", "manual"]
32+
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[*6]", "remote", "manual"]
33+
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[**8]", "remote", "manual"]
2734
- addsTo:
2835
pack: codeql/cpp-all
2936
extensible: summaryModel
@@ -46,4 +53,6 @@ extensions:
4653
- ["", "", False, "RtlMoveMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
4754
- ["", "", False, "RtlMoveVolatileMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
4855
# winternl.h
49-
- ["", "", False, "RtlInitUnicodeString", "", "", "Argument[*1]", "Argument[*0].Field[*Buffer]", "value", "manual"]
56+
- ["", "", False, "RtlInitUnicodeString", "", "", "Argument[*1]", "Argument[*0].Field[*Buffer]", "value", "manual"]
57+
# winhttp.h
58+
- ["", "", False, "WinHttpCrackUrl", "", "", "Argument[*0]", "Argument[*3]", "taint", "manual"]

‎cpp/ql/lib/ext/azure.core.model.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: sourceModel
5+
data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
6+
- ["Azure::Core::Http", "RawResponse", True, "GetHeaders", "", "", "ReturnValue[*]", "remote", "manual"]
7+
- ["Azure::Core::Http", "RawResponse", True, "GetBody", "", "", "ReturnValue[*]", "remote", "manual"]
8+
- ["Azure::Core::Http", "RawResponse", True, "ExtractBodyStream", "", "", "ReturnValue[*]", "remote", "manual"]
9+
- ["Azure::Core::Http", "Request", True, "GetHeaders", "", "", "ReturnValue", "remote", "manual"]
10+
- ["Azure::Core::Http", "Request", True, "GetHeader", "", "", "ReturnValue", "remote", "manual"]
11+
- ["Azure::Core::Http", "Request", True, "GetBodyStream", "", "", "ReturnValue[*]", "remote", "manual"]
12+
13+
- addsTo:
14+
pack: codeql/cpp-all
15+
extensible: summaryModel
16+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
17+
- ["Azure::Core", "Url", True, "Url", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
18+
- ["Azure::Core", "Url", True, "SetScheme", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
19+
- ["Azure::Core", "Url", True, "SetHost", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
20+
- ["Azure::Core", "Url", True, "SetPort", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
21+
- ["Azure::Core", "Url", True, "SetPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
22+
- ["Azure::Core", "Url", True, "SetQueryParameters", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
23+
- ["Azure::Core", "Url", True, "AppendPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
24+
- ["Azure::Core", "Url", True, "AppendQueryParameter", "", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
25+
- ["Azure::Core", "Url", True, "GetHost", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
26+
- ["Azure::Core", "Url", True, "GetPath", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
27+
- ["Azure::Core", "Url", True, "GetPort", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
28+
- ["Azure::Core", "Url", True, "GetQueryParameters", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
29+
- ["Azure::Core", "Url", True, "GetScheme", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
30+
- ["Azure::Core", "Url", True, "GetRelativeUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
31+
- ["Azure::Core", "Url", True, "GetAbsoluteUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
32+
- ["Azure::Core", "Url", True, "Decode", "", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
33+
- ["Azure::Core", "Url", True, "Encode", "", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
34+
- ["Azure::Core::IO", "BodyStream", True, "Read", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
35+
- ["Azure::Core::IO", "BodyStream", True, "ReadToCount", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
36+
- ["Azure::Core::IO", "BodyStream", True, "ReadToEnd", "", "", "Argument[-1]", "ReturnValue.Element", "taint", "manual"]
37+
- ["Azure", "Nullable", True, "Nullable", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
38+
- ["Azure", "Nullable", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
39+
- ["Azure", "Nullable", True, "Value", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
40+
- ["Azure", "Nullable", True, "operator->", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
41+
- ["Azure", "Nullable", True, "operator*", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]

‎cpp/ql/lib/semmle/code/cpp/models/Models.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,4 @@ private import implementations.CAtlFile
5757
private import implementations.CAtlFileMapping
5858
private import implementations.CAtlTemporaryFile
5959
private import implementations.CRegKey
60+
private import implementations.WinHttp

‎cpp/ql/lib/semmle/code/cpp/models/implementations/WinHttp.qll‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
private import cpp
2+
private import semmle.code.cpp.ir.dataflow.FlowSteps
3+
private import semmle.code.cpp.dataflow.new.DataFlow
4+
5+
/** The `WINHTTP_HEADER_NAME` class from `winhttp.h`. */
6+
class WinHttpHeaderName extends Class {
7+
WinHttpHeaderName() { this.hasGlobalName("_WINHTTP_HEADER_NAME") }
8+
}
9+
10+
/** The `WINHTTP_EXTENDED_HEADER` class from `winhttp.h`. */
11+
class WinHttpExtendedHeader extends Class {
12+
WinHttpExtendedHeader() { this.hasGlobalName("_WINHTTP_EXTENDED_HEADER") }
13+
}
14+
15+
private class WinHttpHeaderNameInheritingContent extends TaintInheritingContent,
16+
DataFlow::FieldContent
17+
{
18+
WinHttpHeaderNameInheritingContent() {
19+
this.getIndirectionIndex() = 2 and
20+
(
21+
this.getAField().getDeclaringType() instanceof WinHttpHeaderName
22+
or
23+
// The extended header looks like:
24+
// struct WINHTTP_EXTENDED_HEADER {
25+
// union { [...] };
26+
// union { [...] };
27+
// };
28+
// So the first declaring type is the anonymous unions, and the declaring
29+
// type of those anonymous unions is the `WINHTTP_EXTENDED_HEADER` struct.
30+
this.getAField().getDeclaringType().getDeclaringType() instanceof WinHttpExtendedHeader
31+
)
32+
}
33+
}
34+
35+
/** The `URL_COMPONENTS` class from `winhttp.h`. */
36+
class WinHttpUrlComponents extends Class {
37+
WinHttpUrlComponents() { this.hasGlobalName("_WINHTTP_URL_COMPONENTS") }
38+
}
39+
40+
private class WinHttpUrlComponentsInheritingContent extends TaintInheritingContent,
41+
DataFlow::FieldContent
42+
{
43+
WinHttpUrlComponentsInheritingContent() {
44+
exists(Field f | f = this.getField() and f.getDeclaringType() instanceof WinHttpUrlComponents |
45+
if f.getType().getUnspecifiedType() instanceof PointerType
46+
then this.getIndirectionIndex() = 2
47+
else this.getIndirectionIndex() = 1
48+
)
49+
}
50+
}

0 commit comments

Comments
 (0)