Skip to content

Commit 002f7cd

Browse files
MathiasVPMathiasVP
authored
Merge pull request #8623 from geoffw0/privdata2
C++: Some enhancements to SensitiveExprs.qll
2 parents ba011fb + fbd71cd commit 002f7cd

File tree

6 files changed

+13
-5
lines changed

6 files changed

+13
-5
lines changed

‎cpp/ql/lib/change-notes/2022-03-31-sensitive-exprs.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `semmle.code.cpp.security.SensitiveExprs` library has been enhanced with some additional rules for detecting credentials.

‎cpp/ql/lib/semmle/code/cpp/security/SensitiveExprs.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ import cpp
1414
*/
1515
bindingset[s]
1616
private predicate suspicious(string s) {
17-
s.matches(["%password%", "%passwd%", "%trusted%"]) and
18-
not s.matches(["%hash%", "%crypt%", "%file%", "%path%"])
17+
s.regexpMatch(".*(password|passwd|accountid|account.?key|accnt.?key|license.?key|trusted).*") and
18+
not s.matches(["%hash%", "%crypt%", "%file%", "%path%", "%invalid%"])
1919
}
2020

2121
/**

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ edges
77
nodes
88
| test2.cpp:43:36:43:43 | password | semmle.label | password |
99
| test2.cpp:44:37:44:45 | thepasswd | semmle.label | thepasswd |
10+
| test2.cpp:45:38:45:47 | accountkey | semmle.label | accountkey |
1011
| test2.cpp:50:41:50:53 | passwd_config | semmle.label | passwd_config |
1112
| test2.cpp:52:40:52:58 | * ... | semmle.label | * ... |
1213
| test2.cpp:52:44:52:57 | password_tries | semmle.label | password_tries |
@@ -29,6 +30,7 @@ subpaths
2930
#select
3031
| test2.cpp:43:2:43:8 | call to fprintf | test2.cpp:43:36:43:43 | password | test2.cpp:43:36:43:43 | password | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:43:36:43:43 | password | this source. |
3132
| test2.cpp:44:2:44:8 | call to fprintf | test2.cpp:44:37:44:45 | thepasswd | test2.cpp:44:37:44:45 | thepasswd | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:44:37:44:45 | thepasswd | this source. |
33+
| test2.cpp:45:2:45:8 | call to fprintf | test2.cpp:45:38:45:47 | accountkey | test2.cpp:45:38:45:47 | accountkey | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:45:38:45:47 | accountkey | this source. |
3234
| test2.cpp:50:2:50:8 | call to fprintf | test2.cpp:50:41:50:53 | passwd_config | test2.cpp:50:41:50:53 | passwd_config | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:50:41:50:53 | passwd_config | this source. |
3335
| test2.cpp:54:2:54:8 | call to fprintf | test2.cpp:54:41:54:52 | widepassword | test2.cpp:54:41:54:52 | widepassword | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:54:41:54:52 | widepassword | this source. |
3436
| test2.cpp:55:2:55:8 | call to fprintf | test2.cpp:55:40:55:51 | widepassword | test2.cpp:55:40:55:51 | widepassword | This write into file 'log' may contain unencrypted data from $@ | test2.cpp:55:40:55:51 | widepassword | this source. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,7 @@ nodes
236236
| test3.cpp:515:18:515:35 | my_bank_account_no | semmle.label | my_bank_account_no |
237237
| test3.cpp:516:18:516:29 | employerName | semmle.label | employerName |
238238
| test3.cpp:517:18:517:29 | medical_info | semmle.label | medical_info |
239+
| test3.cpp:518:18:518:28 | license_key | semmle.label | license_key |
239240
| test3.cpp:526:44:526:54 | my_latitude | semmle.label | my_latitude |
240241
| test3.cpp:527:15:527:20 | buffer | semmle.label | buffer |
241242
| test3.cpp:532:45:532:58 | home_longitude | semmle.label | home_longitude |
@@ -288,6 +289,7 @@ subpaths
288289
| test3.cpp:515:2:515:5 | call to send | test3.cpp:515:18:515:35 | my_bank_account_no | test3.cpp:515:18:515:35 | my_bank_account_no | This operation transmits 'my_bank_account_no', which may contain unencrypted sensitive data from $@ | test3.cpp:515:18:515:35 | my_bank_account_no | my_bank_account_no |
289290
| test3.cpp:516:2:516:5 | call to send | test3.cpp:516:18:516:29 | employerName | test3.cpp:516:18:516:29 | employerName | This operation transmits 'employerName', which may contain unencrypted sensitive data from $@ | test3.cpp:516:18:516:29 | employerName | employerName |
290291
| test3.cpp:517:2:517:5 | call to send | test3.cpp:517:18:517:29 | medical_info | test3.cpp:517:18:517:29 | medical_info | This operation transmits 'medical_info', which may contain unencrypted sensitive data from $@ | test3.cpp:517:18:517:29 | medical_info | medical_info |
292+
| test3.cpp:518:2:518:5 | call to send | test3.cpp:518:18:518:28 | license_key | test3.cpp:518:18:518:28 | license_key | This operation transmits 'license_key', which may contain unencrypted sensitive data from $@ | test3.cpp:518:18:518:28 | license_key | license_key |
291293
| test3.cpp:527:3:527:6 | call to send | test3.cpp:526:44:526:54 | my_latitude | test3.cpp:527:15:527:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:526:44:526:54 | my_latitude | my_latitude |
292294
| test3.cpp:533:3:533:6 | call to send | test3.cpp:532:45:532:58 | home_longitude | test3.cpp:533:15:533:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:532:45:532:58 | home_longitude | home_longitude |
293295
| test3.cpp:552:3:552:6 | call to send | test3.cpp:551:47:551:58 | salaryString | test3.cpp:552:15:552:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:551:47:551:58 | salaryString | salaryString |

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ void tests(FILE *log, myStruct &s)
4242
{
4343
fprintf(log, "password = %s\n", s.password); // BAD
4444
fprintf(log, "thepasswd = %s\n", s.thepasswd); // BAD
45-
fprintf(log, "accountkey = %s\n", s.accountkey); // DUBIOUS [NOT REPORTED]
45+
fprintf(log, "accountkey = %s\n", s.accountkey); // BAD
4646
fprintf(log, "password_hash = %s\n", s.password_hash); // GOOD
4747
fprintf(log, "encrypted_passwd = %s\n", s.encrypted_passwd); // GOOD
4848
fprintf(log, "password_file = %s\n", s.password_file); // GOOD
@@ -109,4 +109,4 @@ void test_gets()
109109

110110
gets(password); // BAD
111111
}
112-
}
112+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -515,7 +515,7 @@ void tests2(person_info *pi)
515515
send(val(), pi->my_bank_account_no, strlen(pi->my_bank_account_no), val()); // BAD
516516
send(val(), pi->employerName, strlen(pi->employerName), val()); // BAD
517517
send(val(), pi->medical_info, strlen(pi->medical_info), val()); // BAD
518-
send(val(), pi->license_key, strlen(pi->license_key), val()); // BAD [NOT DETECTED]
518+
send(val(), pi->license_key, strlen(pi->license_key), val()); // BAD
519519
send(val(), pi->license_key_hash, strlen(pi->license_key_hash), val()); // GOOD
520520
send(val(), pi->my_zip_file, strlen(pi->my_zip_file), val()); // GOOD
521521

0 commit comments

Comments
 (0)