Skip to content

Commit a462669

Browse files
jketemajketema
committed
C++: Make the command line models work and add environment models
1 parent 23077fc commit a462669

File tree

3 files changed

+57
-14
lines changed

3 files changed

+57
-14
lines changed

‎cpp/ql/lib/ext/Windows.model.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,16 @@ extensions:
55
extensible: sourceModel
66
data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
77
# processenv.h
8-
- ["", "", False, "GetCommandLineA", "", "", "ReturnValue[*]", "local", "manual"]
9-
- ["", "", False, "GetCommandLineW", "", "", "ReturnValue[*]", "local", "manual"]
8+
- ["", "", False, "GetCommandLineA", "", "", "ReturnValue", "local", "manual"]
9+
- ["", "", False, "GetCommandLineW", "", "", "ReturnValue", "local", "manual"]
10+
- ["", "", False, "GetEnvironmentStringsA", "", "", "ReturnValue", "local", "manual"]
11+
- ["", "", False, "GetEnvironmentStringsW", "", "", "ReturnValue", "local", "manual"]
12+
- ["", "", False, "GetEnvironmentVariableA", "", "", "Argument[*1]", "local", "manual"]
13+
- ["", "", False, "GetEnvironmentVariableW", "", "", "Argument[*1]", "local", "manual"]
1014
- addsTo:
1115
pack: codeql/cpp-all
1216
extensible: summaryModel
1317
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
1418
# shellapi.h
15-
- ["", "", False, "CommandLineToArgvA", "", "", "Argument[*0]", "ReturnValue[**]", "taint", "manual"]
16-
- ["", "", False, "CommandLineToArgvW", "", "", "Argument[*0]", "ReturnValue[**]", "taint", "manual"]
19+
- ["", "", False, "CommandLineToArgvA", "", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]
20+
- ["", "", False, "CommandLineToArgvW", "", "", "Argument[0]", "ReturnValue[*]", "taint", "manual"]

‎cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected‎

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,18 @@ edges
99
| test.c:48:20:48:33 | *globalUsername | test.c:51:18:51:23 | *query1 | provenance | TaintFunction |
1010
| test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | provenance | |
1111
| test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | provenance | |
12-
| test.c:99:57:99:64 | *pCmdLine | test.c:103:18:103:23 | *query1 | provenance | TaintFunction |
12+
| test.c:81:8:81:25 | [summary param] 0 in CommandLineToArgvA | test.c:81:8:81:25 | [summary] to write: ReturnValue[*] in CommandLineToArgvA | provenance | MaD:331 |
13+
| test.c:86:15:86:29 | call to GetCommandLineA | test.c:86:15:86:29 | call to GetCommandLineA | provenance | Src:MaD:325 |
14+
| test.c:86:15:86:29 | call to GetCommandLineA | test.c:88:36:88:38 | cmd | provenance | |
15+
| test.c:86:15:86:29 | call to GetCommandLineA | test.c:92:18:92:23 | *query1 | provenance | TaintFunction |
16+
| test.c:88:17:88:34 | *call to CommandLineToArgvA | test.c:88:17:88:34 | *call to CommandLineToArgvA | provenance | |
17+
| test.c:88:17:88:34 | *call to CommandLineToArgvA | test.c:96:18:96:23 | *query2 | provenance | TaintFunction |
18+
| test.c:88:36:88:38 | cmd | test.c:81:8:81:25 | [summary param] 0 in CommandLineToArgvA | provenance | |
19+
| test.c:88:36:88:38 | cmd | test.c:88:17:88:34 | *call to CommandLineToArgvA | provenance | MaD:331 |
20+
| test.c:98:15:98:36 | call to GetEnvironmentStringsA | test.c:98:15:98:36 | call to GetEnvironmentStringsA | provenance | Src:MaD:327 |
21+
| test.c:98:15:98:36 | call to GetEnvironmentStringsA | test.c:101:18:101:23 | *query3 | provenance | TaintFunction |
22+
| test.c:98:15:98:36 | call to GetEnvironmentStringsA | test.c:106:18:106:23 | *query4 | provenance | TaintFunction |
23+
| test.c:110:57:110:64 | *pCmdLine | test.c:113:18:113:23 | *query1 | provenance | TaintFunction |
1324
| test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | provenance | |
1425
nodes
1526
| test.c:14:27:14:30 | **argv | semmle.label | **argv |
@@ -24,15 +35,33 @@ nodes
2435
| test.c:75:8:75:16 | gets output argument | semmle.label | gets output argument |
2536
| test.c:76:17:76:25 | *userInput | semmle.label | *userInput |
2637
| test.c:77:20:77:28 | *userInput | semmle.label | *userInput |
27-
| test.c:99:57:99:64 | *pCmdLine | semmle.label | *pCmdLine |
28-
| test.c:103:18:103:23 | *query1 | semmle.label | *query1 |
38+
| test.c:81:8:81:25 | [summary param] 0 in CommandLineToArgvA | semmle.label | [summary param] 0 in CommandLineToArgvA |
39+
| test.c:81:8:81:25 | [summary] to write: ReturnValue[*] in CommandLineToArgvA | semmle.label | [summary] to write: ReturnValue[*] in CommandLineToArgvA |
40+
| test.c:86:15:86:29 | call to GetCommandLineA | semmle.label | call to GetCommandLineA |
41+
| test.c:86:15:86:29 | call to GetCommandLineA | semmle.label | call to GetCommandLineA |
42+
| test.c:88:17:88:34 | *call to CommandLineToArgvA | semmle.label | *call to CommandLineToArgvA |
43+
| test.c:88:17:88:34 | *call to CommandLineToArgvA | semmle.label | *call to CommandLineToArgvA |
44+
| test.c:88:36:88:38 | cmd | semmle.label | cmd |
45+
| test.c:92:18:92:23 | *query1 | semmle.label | *query1 |
46+
| test.c:96:18:96:23 | *query2 | semmle.label | *query2 |
47+
| test.c:98:15:98:36 | call to GetEnvironmentStringsA | semmle.label | call to GetEnvironmentStringsA |
48+
| test.c:98:15:98:36 | call to GetEnvironmentStringsA | semmle.label | call to GetEnvironmentStringsA |
49+
| test.c:101:18:101:23 | *query3 | semmle.label | *query3 |
50+
| test.c:106:18:106:23 | *query4 | semmle.label | *query4 |
51+
| test.c:110:57:110:64 | *pCmdLine | semmle.label | *pCmdLine |
52+
| test.c:113:18:113:23 | *query1 | semmle.label | *query1 |
2953
| test.cpp:39:27:39:30 | **argv | semmle.label | **argv |
3054
| test.cpp:43:27:43:33 | *access to array | semmle.label | *access to array |
3155
subpaths
56+
| test.c:88:36:88:38 | cmd | test.c:81:8:81:25 | [summary param] 0 in CommandLineToArgvA | test.c:81:8:81:25 | [summary] to write: ReturnValue[*] in CommandLineToArgvA | test.c:88:17:88:34 | *call to CommandLineToArgvA |
3257
#select
3358
| test.c:21:18:21:23 | query1 | test.c:14:27:14:30 | **argv | test.c:21:18:21:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) |
3459
| test.c:51:18:51:23 | query1 | test.c:14:27:14:30 | **argv | test.c:51:18:51:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:14:27:14:30 | **argv | user input (a command-line argument) |
3560
| test.c:76:17:76:25 | userInput | test.c:75:8:75:16 | gets output argument | test.c:76:17:76:25 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLPrepare(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) |
3661
| test.c:77:20:77:28 | userInput | test.c:75:8:75:16 | gets output argument | test.c:77:20:77:28 | *userInput | This argument to a SQL query function is derived from $@ and then passed to SQLExecDirect(StatementText). | test.c:75:8:75:16 | gets output argument | user input (string read by gets) |
37-
| test.c:103:18:103:23 | query1 | test.c:99:57:99:64 | *pCmdLine | test.c:103:18:103:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:99:57:99:64 | *pCmdLine | user input (a command-line) |
62+
| test.c:92:18:92:23 | query1 | test.c:86:15:86:29 | call to GetCommandLineA | test.c:92:18:92:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:86:15:86:29 | call to GetCommandLineA | user input (external) |
63+
| test.c:96:18:96:23 | query2 | test.c:86:15:86:29 | call to GetCommandLineA | test.c:96:18:96:23 | *query2 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:86:15:86:29 | call to GetCommandLineA | user input (external) |
64+
| test.c:101:18:101:23 | query3 | test.c:98:15:98:36 | call to GetEnvironmentStringsA | test.c:101:18:101:23 | *query3 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:98:15:98:36 | call to GetEnvironmentStringsA | user input (external) |
65+
| test.c:106:18:106:23 | query4 | test.c:98:15:98:36 | call to GetEnvironmentStringsA | test.c:106:18:106:23 | *query4 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:98:15:98:36 | call to GetEnvironmentStringsA | user input (external) |
66+
| test.c:113:18:113:23 | query1 | test.c:110:57:110:64 | *pCmdLine | test.c:113:18:113:23 | *query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg). | test.c:110:57:110:64 | *pCmdLine | user input (a command-line) |
3867
| test.cpp:43:27:43:33 | access to array | test.cpp:39:27:39:30 | **argv | test.cpp:43:27:43:33 | *access to array | This argument to a SQL query function is derived from $@ and then passed to pqxx::work::exec1((unnamed parameter 0)). | test.cpp:39:27:39:30 | **argv | user input (a command-line argument) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -78,26 +78,36 @@ void ODBCTests(){
7878
}
7979

8080
char* GetCommandLineA();
81-
char** CommandLineToArgvA(char *, int*);
81+
char** CommandLineToArgvA(char*, int*);
82+
char* GetEnvironmentStringsA();
83+
int GetEnvironmentVariableA(const char*, char*, int);
8284

8385
void getCommandLine() {
84-
char *cmd = GetCommandLineA();
86+
char* cmd = GetCommandLineA();
8587
int argc;
86-
char **argv = CommandLineToArgvA(cmd, &argc);
88+
char** argv = CommandLineToArgvA(cmd, &argc);
8789

88-
// a string from the user is injected directly into an SQL query.
8990
char query1[1000] = {0};
9091
snprintf(query1, 1000, "SELECT UID FROM USERS where name = \"%s\"", cmd);
9192
mysql_query(0, query1); // BAD
9293

93-
// a string from the user is injected directly into an SQL query.
9494
char query2[1000] = {0};
9595
snprintf(query2, 1000, "SELECT UID FROM USERS where name = \"%s\"", argv[1]);
9696
mysql_query(0, query2); // BAD
97+
98+
char* env = GetEnvironmentStringsA();
99+
char query3[1000] = {0};
100+
snprintf(query3, 1000, "SELECT UID FROM USERS where name = \"%s\"", env);
101+
mysql_query(0, query3); // BAD
102+
103+
char query4[1000];
104+
GetEnvironmentVariableA("FOO", query4, sizeof(query4));
105+
snprintf(query4, 1000, "SELECT UID FROM USERS where name = \"%s\"", env);
106+
mysql_query(0, query4); // BAD
107+
97108
}
98109

99110
int WinMain(void *hInstance, void *hPrevInstance, char *pCmdLine, int nCmdShow) {
100-
// a string from the user is injected directly into an SQL query.
101111
char query1[1000] = {0};
102112
snprintf(query1, 1000, "SELECT UID FROM USERS where name = \"%s\"", pCmdLine);
103113
mysql_query(0, query1); // BAD

0 commit comments

Comments
 (0)