Skip to content

Commit 18be459

Browse files
hvitvedhvitved
committed
temp2
1 parent 2031b0c commit 18be459

File tree

3 files changed

+143
-64
lines changed

3 files changed

+143
-64
lines changed

‎csharp/ql/src/Security Features/CWE-798/HardcodedCredentials.ql

+2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ import csharp
1616
import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery
1717
import HardcodedCredentials::PathGraph
1818

19+
predicate stats = HardcodedCredentials::stageStats/10;
20+
1921
from
2022
Source source, Sink sink, HardcodedCredentials::PathNode sourcePath,
2123
HardcodedCredentials::PathNode sinkPath, string value

‎shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

+35-3
Original file line numberDiff line numberDiff line change
@@ -3430,6 +3430,27 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
34303430
private module StoreReadMatchingInput implements StoreReadMatchingInputSig {
34313431
class NodeEx = NodeExAlias;
34323432

3433+
predicate nodeRange(NodeEx node, boolean fromArg) {
3434+
exists(PrevStage::Ap ap |
3435+
PrevStage::revFlowAp(node, ap) and
3436+
(
3437+
ap = true
3438+
or
3439+
PrevStage::storeStepCand(node, ap, _, _, _, _)
3440+
or
3441+
PrevStage::readStepCand(_, _, node)
3442+
)
3443+
|
3444+
exists(PrevStage::Cc cc | PrevStage::fwdFlow(node, _, cc, _, _, _, _, ap, _) |
3445+
PrevStage::instanceofCcCall(cc) and
3446+
fromArg = true
3447+
or
3448+
PrevStage::instanceofCcNoCall(cc) and
3449+
fromArg = false
3450+
)
3451+
)
3452+
}
3453+
34333454
predicate localValueStep(NodeEx node1, NodeEx node2) {
34343455
exists(FlowState state, PrevStage::ApOption returnAp |
34353456
PrevStage::revFlow(node1, pragma[only_bind_into](state), _,
@@ -3442,12 +3463,23 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
34423463

34433464
predicate jumpValueStep = jumpStepEx/2;
34443465

3466+
pragma[nomagic]
3467+
private predicate flowThroughOutOfCall(RetNodeEx ret, NodeEx out) {
3468+
exists(DataFlowCall call, CcCall ccc, ReturnKindExt kind |
3469+
PrevStage::callEdgeReturn(call, _, ret, kind, out, true, true) and
3470+
PrevStage::callMayFlowThroughRev(call) and
3471+
PrevStage::returnMayFlowThrough(ret, true, true, kind) and
3472+
matchesCall(ccc, call)
3473+
)
3474+
}
3475+
34453476
predicate callEdgeArgParam(NodeEx arg, NodeEx param) {
3446-
PrevStage::callEdgeArgParam(_, _, arg, param, true, _)
3477+
PrevStage::callEdgeArgParam(_, _, arg, param, true, true)
34473478
}
34483479

3449-
predicate callEdgeReturn(NodeEx ret, NodeEx out) {
3450-
PrevStage::callEdgeReturn(_, _, ret, _, out, true, _)
3480+
predicate callEdgeReturn(NodeEx ret, NodeEx out, boolean mayFlowThrough) {
3481+
PrevStage::callEdgeReturn(_, _, ret, _, out, true, true) and
3482+
if flowThroughOutOfCall(ret, out) then mayFlowThrough = true else mayFlowThrough = false
34513483
}
34523484

34533485
predicate readContentStep = PrevStage::readStepCand/3;

‎shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll

+106-61
Original file line numberDiff line numberDiff line change
@@ -2358,13 +2358,15 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
23582358
string toString();
23592359
}
23602360

2361+
predicate nodeRange(NodeEx node, boolean fromArg);
2362+
23612363
predicate localValueStep(NodeEx node1, NodeEx node2);
23622364

23632365
predicate jumpValueStep(NodeEx node1, NodeEx node2);
23642366

23652367
predicate callEdgeArgParam(NodeEx arg, NodeEx param);
23662368

2367-
predicate callEdgeReturn(NodeEx ret, NodeEx out);
2369+
predicate callEdgeReturn(NodeEx ret, NodeEx out, boolean mayFlowThrough);
23682370

23692371
predicate readContentStep(NodeEx node1, Content c, NodeEx node2);
23702372

@@ -2394,23 +2396,16 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
23942396
module StoreReadMatching<StoreReadMatchingInputSig Input> {
23952397
private import Input
23962398

2397-
pragma[nomagic]
2398-
private predicate valueStep(NodeEx node1, NodeEx node2) {
2399-
localValueStep(node1, node2)
2400-
or
2401-
jumpValueStep(node1, node2)
2402-
or
2403-
callEdgeArgParam(node1, node2)
2404-
or
2405-
callEdgeReturn(node1, node2)
2406-
}
2407-
24082399
private signature module StoreReachesReadInputSig {
24092400
int iteration();
24102401

2411-
predicate storeMayReachReadDelta(NodeEx storeSource, Content c, NodeEx readTarget);
2402+
predicate storeMayReachReadDelta(
2403+
NodeEx storeSource, Content c, NodeEx readTarget, boolean fromArg1, boolean fromArg2
2404+
);
24122405

2413-
predicate storeMayReachReadPrev(NodeEx storeSource, Content c, NodeEx readTarget);
2406+
predicate storeMayReachReadPrev(
2407+
NodeEx storeSource, Content c, NodeEx readTarget, boolean fromArg1, boolean fromArg2
2408+
);
24142409
}
24152410

24162411
private signature class UsesPrevDeltaInfoSig {
@@ -2428,13 +2423,15 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
24282423
private predicate enabled() { accessPathConfigLimit() > Prev::iteration() }
24292424

24302425
private newtype TNodeOrContent =
2431-
TNodeOrContentNode(NodeEx n, UsesPrevDeltaInfo usesPrevDelta) { enabled() } or
2426+
TNodeOrContentNode(NodeEx n, UsesPrevDeltaInfo usesPrevDelta, boolean fromArg) {
2427+
enabled() and nodeRange(n, fromArg)
2428+
} or
24322429
TNodeOrContentStoreContent(Content c) { enabled() and storeContentStep(_, c, _) } or
24332430
TNodeOrContentReadContent(Content c) { enabled() and readContentStep(_, c, _) }
24342431

24352432
private class NodeOrContent extends TNodeOrContent {
2436-
NodeEx asNodeEx(UsesPrevDeltaInfo usesPrevDelta) {
2437-
this = TNodeOrContentNode(result, usesPrevDelta)
2433+
NodeEx asNodeEx(UsesPrevDeltaInfo usesPrevDelta, boolean fromArg) {
2434+
this = TNodeOrContentNode(result, usesPrevDelta, fromArg)
24382435
}
24392436

24402437
Content asStoreContent() { this = TNodeOrContentStoreContent(result) }
@@ -2446,41 +2443,68 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
24462443
or
24472444
result = this.asReadContent().toString()
24482445
or
2449-
result = this.asNodeEx(_).toString()
2446+
result = this.asNodeEx(_, _).toString()
24502447
}
24512448
}
24522449

2450+
bindingset[usesPrevDelta]
2451+
pragma[inline_late]
2452+
private predicate usesPrevDelta(UsesPrevDeltaInfo usesPrevDelta, boolean b) {
2453+
usesPrevDelta.toBoolean() = b
2454+
}
2455+
2456+
pragma[nomagic]
2457+
private predicate stepNode(
2458+
NodeOrContent node1, NodeEx n2, UsesPrevDeltaInfo usesPrevDelta1,
2459+
UsesPrevDeltaInfo usesPrevDelta2, Boolean fromArg1, Boolean fromArg2
2460+
) {
2461+
exists(NodeEx n1 | n1 = node1.asNodeEx(usesPrevDelta1, fromArg1) |
2462+
usesPrevDelta1 = usesPrevDelta2 and
2463+
(
2464+
localValueStep(n1, n2) and
2465+
fromArg1 = fromArg2
2466+
or
2467+
jumpValueStep(n1, n2) and
2468+
fromArg2 = false
2469+
or
2470+
callEdgeArgParam(n1, n2) and
2471+
fromArg2 = true
2472+
or
2473+
exists(boolean mayFlowThrough | callEdgeReturn(n1, n2, mayFlowThrough) |
2474+
fromArg1 = false or mayFlowThrough = true
2475+
)
2476+
)
2477+
or
2478+
Prev::storeMayReachReadDelta(n1, _, n2, fromArg1, fromArg2) and
2479+
usesPrevDelta(usesPrevDelta2, true)
2480+
or
2481+
Prev::storeMayReachReadPrev(n1, _, n2, fromArg1, fromArg2) and
2482+
usesPrevDelta1 = usesPrevDelta2
2483+
)
2484+
}
2485+
24532486
pragma[nomagic]
24542487
private predicate step(NodeOrContent node1, NodeOrContent node2) {
24552488
exists(
2456-
NodeEx n1, NodeEx n2, UsesPrevDeltaInfo usesPrevDelta1, UsesPrevDeltaInfo usesPrevDelta2
2489+
NodeEx n2, UsesPrevDeltaInfo usesPrevDelta1, UsesPrevDeltaInfo usesPrevDelta2,
2490+
boolean fromArg1, boolean fromArg2
24572491
|
2458-
n1 = node1.asNodeEx(usesPrevDelta1) and
2459-
n2 = node2.asNodeEx(usesPrevDelta2)
2460-
|
2461-
valueStep(n1, n2) and
2462-
pragma[only_bind_into](pragma[only_bind_out](usesPrevDelta2)) =
2463-
pragma[only_bind_into](pragma[only_bind_out](usesPrevDelta1))
2464-
or
2465-
Prev::storeMayReachReadDelta(n1, _, n2) and usesPrevDelta2.toBoolean() = true
2466-
or
2467-
Prev::storeMayReachReadPrev(n1, _, n2) and
2468-
pragma[only_bind_into](pragma[only_bind_out](usesPrevDelta2)) =
2469-
pragma[only_bind_into](pragma[only_bind_out](usesPrevDelta1))
2492+
n2 = node2.asNodeEx(usesPrevDelta2, fromArg2) and
2493+
stepNode(node1, n2, usesPrevDelta1, usesPrevDelta2, fromArg1, fromArg2)
24702494
)
24712495
or
24722496
exists(NodeEx n2, Content c, UsesPrevDeltaInfo usesPrevDelta2 |
2473-
n2 = node2.asNodeEx(usesPrevDelta2) and
2497+
n2 = node2.asNodeEx(usesPrevDelta2, _) and
24742498
c = node1.asStoreContent() and
24752499
storeContentStep(_, c, n2) and
2476-
usesPrevDelta2.toBoolean() = false
2500+
usesPrevDelta(usesPrevDelta2, false)
24772501
)
24782502
or
24792503
exists(NodeEx n1, Content c, UsesPrevDeltaInfo usesPrevDelta1 |
2480-
n1 = node1.asNodeEx(usesPrevDelta1) and
2504+
n1 = node1.asNodeEx(usesPrevDelta1, _) and
24812505
c = node2.asReadContent() and
24822506
readContentStep(n1, c, _) and
2483-
usesPrevDelta1.toBoolean() = true
2507+
usesPrevDelta(usesPrevDelta1, true)
24842508
)
24852509
}
24862510

@@ -2508,8 +2532,8 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
25082532
private predicate isStoreTarget0(NodeOrContent node, Content c) {
25092533
exists(UsesPrevDeltaInfo usesPrevDelta |
25102534
contentIsReadAndStored(c) and
2511-
storeContentStep(_, c, node.asNodeEx(usesPrevDelta)) and
2512-
usesPrevDelta.toBoolean() = false
2535+
storeContentStep(_, c, node.asNodeEx(usesPrevDelta, _)) and
2536+
usesPrevDelta(usesPrevDelta, false)
25132537
)
25142538
}
25152539

@@ -2519,8 +2543,8 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
25192543
private predicate isReadSource0(NodeOrContent node, Content c) {
25202544
exists(UsesPrevDeltaInfo usesPrevDelta |
25212545
contentIsReadAndStored(c) and
2522-
readContentStep(node.asNodeEx(usesPrevDelta), c, _) and
2523-
usesPrevDelta.toBoolean() = true
2546+
readContentStep(node.asNodeEx(usesPrevDelta, _), c, _) and
2547+
usesPrevDelta(usesPrevDelta, true)
25242548
)
25252549
}
25262550

@@ -2566,47 +2590,63 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
25662590
doublyBoundedFastTC(step/2, isStoreTargetPruned/1, isReadSourcePruned/1)(node1, node2)
25672591

25682592
pragma[nomagic]
2569-
private predicate storeMayReachReadDeltaJoinLeft(NodeEx node1, Content c, NodeOrContent node2) {
2593+
private predicate storeMayReachReadDeltaJoinLeft(
2594+
NodeEx node1, Content c, NodeOrContent node2, boolean fromArg
2595+
) {
25702596
exists(UsesPrevDeltaInfo usesPrevDelta |
2571-
storeMayReachARead(node2, c) and
2572-
storeContentStep(node1, c, node2.asNodeEx(usesPrevDelta)) and
2573-
usesPrevDelta.toBoolean() = false
2597+
storeMayReachARead(pragma[only_bind_into](node2), pragma[only_bind_into](c)) and
2598+
storeContentStep(node1, c, node2.asNodeEx(usesPrevDelta, fromArg)) and
2599+
usesPrevDelta(usesPrevDelta, false)
25742600
)
25752601
}
25762602

25772603
pragma[nomagic]
2578-
private predicate storeMayReachReadDeltaJoinRight(NodeOrContent node1, Content c, NodeEx node2) {
2604+
private predicate storeMayReachReadDeltaJoinRight(
2605+
NodeOrContent node1, Content c, NodeEx node2, boolean fromArg
2606+
) {
25792607
exists(UsesPrevDeltaInfo usesPrevDelta |
2580-
aStoreMayReachRead(node1, c) and
2581-
readContentStep(node1.asNodeEx(usesPrevDelta), c, node2) and
2582-
usesPrevDelta.toBoolean() = true
2608+
aStoreMayReachRead(pragma[only_bind_into](node1), pragma[only_bind_into](c)) and
2609+
readContentStep(node1.asNodeEx(usesPrevDelta, fromArg), c, node2) and
2610+
usesPrevDelta(usesPrevDelta, true)
25832611
)
25842612
}
25852613

25862614
pragma[nomagic]
2587-
predicate storeMayReachReadDelta(NodeEx storeSource, Content c, NodeEx readTarget) {
2615+
predicate storeMayReachReadDelta(
2616+
NodeEx storeSource, Content c, NodeEx readTarget, boolean fromArg1, boolean fromArg2
2617+
) {
25882618
exists(NodeOrContent storeTarget, NodeOrContent readSource |
25892619
storeMayReachReadTc(storeTarget, readSource) and
2590-
storeMayReachReadDeltaJoinLeft(storeSource, c, storeTarget) and
2591-
storeMayReachReadDeltaJoinRight(readSource, c, readTarget)
2620+
storeMayReachReadDeltaJoinLeft(storeSource, c, storeTarget, fromArg1) and
2621+
storeMayReachReadDeltaJoinRight(readSource, c, readTarget, fromArg2)
25922622
) and
2593-
not Prev::storeMayReachReadPrev(storeSource, c, readTarget)
2623+
not Prev::storeMayReachReadPrev(storeSource, c, readTarget, fromArg1, fromArg2)
25942624
}
25952625

25962626
pragma[nomagic]
2597-
predicate storeMayReachReadPrev(NodeEx storeSource, Content c, NodeEx readTarget) {
2598-
Prev::storeMayReachReadPrev(storeSource, c, readTarget)
2627+
predicate storeMayReachReadPrev(
2628+
NodeEx storeSource, Content c, NodeEx readTarget, boolean fromArg1, boolean fromArg2
2629+
) {
2630+
Prev::storeMayReachReadPrev(storeSource, c, readTarget, fromArg1, fromArg2)
25992631
or
2600-
Prev::storeMayReachReadDelta(storeSource, c, readTarget)
2632+
Prev::storeMayReachReadDelta(storeSource, c, readTarget, fromArg1, fromArg2)
26012633
}
26022634
}
26032635

26042636
module Iteration0 implements StoreReachesReadInputSig {
26052637
int iteration() { result = 0 }
26062638

2607-
predicate storeMayReachReadDelta(NodeEx node1, Content c, NodeEx node2) { none() }
2639+
predicate storeMayReachReadDelta(
2640+
NodeEx node1, Content c, NodeEx node2, boolean fromArg1, boolean fromArg2
2641+
) {
2642+
none()
2643+
}
26082644

2609-
predicate storeMayReachReadPrev(NodeEx node1, Content c, NodeEx node2) { none() }
2645+
predicate storeMayReachReadPrev(
2646+
NodeEx node1, Content c, NodeEx node2, boolean fromArg1, boolean fromArg2
2647+
) {
2648+
none()
2649+
}
26102650
}
26112651

26122652
// in the first iteration there is no previous delta to use
@@ -2619,15 +2659,20 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
26192659

26202660
import M
26212661

2622-
predicate storeMayReachReadDelta(NodeEx storeSource, Content c, NodeEx readTarget) {
2623-
M::storeMayReachReadDelta(storeSource, c, readTarget)
2662+
predicate storeMayReachReadDelta(
2663+
NodeEx storeSource, Content c, NodeEx readTarget, boolean fromArg1, boolean fromArg2
2664+
) {
2665+
M::storeMayReachReadDelta(storeSource, c, readTarget, fromArg1, fromArg2)
26242666
or
26252667
// special case only needed for the first iteration: a store immediately followed by a read
26262668
exists(NodeEx storeTargetReadSource |
26272669
StoreReachesRead1::contentIsReadAndStored(c) and
26282670
storeContentStep(storeSource, c, storeTargetReadSource) and
26292671
readContentStep(storeTargetReadSource, c, readTarget)
2630-
)
2672+
) and
2673+
nodeRange(storeSource, fromArg1) and
2674+
nodeRange(readTarget, fromArg2) and
2675+
fromArg1 = fromArg2
26312676
}
26322677
}
26332678

@@ -2650,9 +2695,9 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
26502695
StoreReachesRead<StoreReachesRead4, UsesPrevDeltaInfoBoolean>;
26512696

26522697
predicate storeMayReachRead(NodeEx storeSource, Content c, NodeEx readTarget) {
2653-
StoreReachesRead5::storeMayReachReadDelta(storeSource, c, readTarget)
2698+
StoreReachesRead5::storeMayReachReadDelta(storeSource, c, readTarget, _, _)
26542699
or
2655-
StoreReachesRead5::storeMayReachReadPrev(storeSource, c, readTarget)
2700+
StoreReachesRead5::storeMayReachReadPrev(storeSource, c, readTarget, _, _)
26562701
}
26572702
}
26582703
}

0 commit comments

Comments
 (0)