Skip to content

Commit 7a9ea52

Browse files
geoffw0geoffw0
committed
Rust: Add source models for io.
1 parent 4f9f550 commit 7a9ea52

File tree

4 files changed

+60
-14
lines changed

4 files changed

+60
-14
lines changed

‎rust/ql/lib/codeql/rust/Concepts.qll

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,32 @@ module FileSource {
128128
}
129129
}
130130

131+
/**
132+
* A data flow source corresponding to standard input.
133+
*/
134+
final class StdInSource = StdInSource::Range;
135+
136+
/**
137+
* An externally modeled source for data from standard input.
138+
*/
139+
class ModeledStdInSourceSource extends StdInSource::Range {
140+
ModeledStdInSourceSource() { sourceNode(this, "stdin") }
141+
}
142+
143+
/**
144+
* Provides a class for modeling new sources for standard input.
145+
*/
146+
module StdInSource {
147+
/**
148+
* A data flow source corresponding to standard input.
149+
*/
150+
abstract class Range extends ThreatModelSource::Range {
151+
override string getThreatModel() { result = "stdin" }
152+
153+
override string getSourceType() { result = "StdInSource" }
154+
}
155+
}
156+
131157
/**
132158
* A data flow source corresponding to the program's database reads.
133159
*/

‎rust/ql/lib/codeql/rust/frameworks/stdlib/io.model.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
- ["lang:std", "crate::io::stdio::stdin", "ReturnValue", "stdin", "manual"]

‎rust/ql/test/library-tests/dataflow/sources/TaintSources.expected

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,22 @@
2828
| test.rs:221:22:221:25 | path | Flow source 'FileSource' of type file (DEFAULT). |
2929
| test.rs:222:27:222:35 | file_name | Flow source 'FileSource' of type file (DEFAULT). |
3030
| test.rs:228:22:228:34 | ...::read_link | Flow source 'FileSource' of type file (DEFAULT). |
31+
| test.rs:243:22:243:35 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
32+
| test.rs:249:22:249:35 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
33+
| test.rs:255:22:255:35 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
34+
| test.rs:261:9:261:22 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
35+
| test.rs:265:17:265:30 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
3136
| test.rs:271:20:271:38 | ...::open | Flow source 'FileSource' of type file (DEFAULT). |
37+
| test.rs:304:50:304:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
38+
| test.rs:310:50:310:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
39+
| test.rs:317:50:317:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
40+
| test.rs:324:50:324:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
41+
| test.rs:331:56:331:69 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
42+
| test.rs:338:50:338:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
43+
| test.rs:345:50:345:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
44+
| test.rs:351:50:351:63 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
3245
| test.rs:360:25:360:43 | ...::open | Flow source 'FileSource' of type file (DEFAULT). |
3346
| test.rs:361:25:361:43 | ...::open | Flow source 'FileSource' of type file (DEFAULT). |
3447
| test.rs:369:25:369:43 | ...::open | Flow source 'FileSource' of type file (DEFAULT). |
48+
| test.rs:377:22:377:35 | ...::stdin | Flow source 'StdInSource' of type stdin (DEFAULT). |
3549
| test.rs:386:16:386:29 | ...::args | Flow source 'CommandLineArgs' of type commandargs (DEFAULT). |

‎rust/ql/test/library-tests/dataflow/sources/test.rs

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -240,29 +240,29 @@ fn test_io_fs() -> std::io::Result<()> {
240240

241241
{
242242
let mut buffer = [0u8; 100];
243-
let _bytes = std::io::stdin().read(&mut buffer)?; // $ MISSING: Alert[rust/summary/taint-sources]
243+
let _bytes = std::io::stdin().read(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
244244
sink(&buffer); // $ MISSING: hasTaintFlow
245245
}
246246

247247
{
248248
let mut buffer = Vec::<u8>::new();
249-
let _bytes = std::io::stdin().read_to_end(&mut buffer)?; // $ MISSING: Alert[rust/summary/taint-sources]
249+
let _bytes = std::io::stdin().read_to_end(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
250250
sink(&buffer); // $ MISSING: hasTaintFlow
251251
}
252252

253253
{
254254
let mut buffer = String::new();
255-
let _bytes = std::io::stdin().read_to_string(&mut buffer)?; // $ MISSING: Alert[rust/summary/taint-sources]
255+
let _bytes = std::io::stdin().read_to_string(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
256256
sink(&buffer); // $ MISSING: hasTaintFlow
257257
}
258258

259259
{
260260
let mut buffer = [0; 100];
261-
std::io::stdin().read_exact(&mut buffer)?; // $ MISSING: Alert[rust/summary/taint-sources]
261+
std::io::stdin().read_exact(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
262262
sink(&buffer); // $ MISSING: hasTaintFlow
263263
}
264264

265-
for byte in std::io::stdin().bytes() { // $ MISSING: Alert[rust/summary/taint-sources]
265+
for byte in std::io::stdin().bytes() { // $ Alert[rust/summary/taint-sources]
266266
sink(byte); // $ MISSING: hasTaintFlow
267267
}
268268

@@ -301,54 +301,54 @@ fn test_io_fs() -> std::io::Result<()> {
301301
// --- BufReader ---
302302

303303
{
304-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
304+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
305305
let data = reader.fill_buf()?;
306306
sink(&data); // $ MISSING: hasTaintFlow
307307
}
308308

309309
{
310-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
310+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
311311
let data = reader.buffer();
312312
sink(&data); // $ MISSING: hasTaintFlow
313313
}
314314

315315
{
316316
let mut buffer = String::new();
317-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
317+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
318318
reader.read_line(&mut buffer)?;
319319
sink(&buffer); // $ MISSING: hasTaintFlow
320320
}
321321

322322
{
323323
let mut buffer = Vec::<u8>::new();
324-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
324+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
325325
reader.read_until(b',', &mut buffer)?;
326326
sink(&buffer); // $ MISSING: hasTaintFlow
327327
}
328328

329329
{
330330
let mut buffer = Vec::<u8>::new();
331-
let mut reader_split = std::io::BufReader::new(std::io::stdin()).split(b','); // $ MISSING: Alert[rust/summary/taint-sources]
331+
let mut reader_split = std::io::BufReader::new(std::io::stdin()).split(b','); // $ Alert[rust/summary/taint-sources]
332332
while let Some(chunk) = reader_split.next() {
333333
sink(chunk.unwrap()); // $ MISSING: hasTaintFlow
334334
}
335335
}
336336

337337
{
338-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
338+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
339339
for line in reader.lines() {
340340
sink(line); // $ MISSING: Alert[rust/summary/taint-sources]
341341
}
342342
}
343343

344344
{
345-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
345+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
346346
let line = reader.lines().nth(1).unwrap();
347347
sink(line.unwrap().clone()); // $ MISSING: hasTaintFlow
348348
}
349349

350350
{
351-
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ MISSING: Alert[rust/summary/taint-sources]
351+
let mut reader = std::io::BufReader::new(std::io::stdin()); // $ Alert[rust/summary/taint-sources]
352352
let lines: Vec<_> = reader.lines().collect();
353353
sink(lines[1].as_ref().unwrap().clone()); // $ MISSING: hasTaintFlow
354354
}
@@ -374,7 +374,7 @@ fn test_io_fs() -> std::io::Result<()> {
374374

375375
{
376376
let mut buffer = String::new();
377-
let _bytes = std::io::stdin().lock().read_to_string(&mut buffer)?; // $ MISSING: Alert[rust/summary/taint-sources]
377+
let _bytes = std::io::stdin().lock().read_to_string(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
378378
sink(&buffer); // $ MISSING: hasTaintFlow
379379
}
380380

0 commit comments

Comments
 (0)