Skip to content

Commit ab7d30a

Browse files
criemencriemen
authored
Merge branch 'main' into criemen/move-win-autobuilder
2 parents 8ea1d13 + 64b8f97 commit ab7d30a

File tree

362 files changed

+4622
-1278
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

362 files changed

+4622
-1278
lines changed

‎.github/workflows/go-tests-other-os.yml

+4-61
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ on:
77
- .github/workflows/go-tests-other-os.yml
88
- .github/actions/**
99
- codeql-workspace.yml
10-
env:
11-
GO_VERSION: '~1.22.0'
1210

1311
permissions:
1412
contents: read
@@ -18,72 +16,17 @@ jobs:
1816
name: Test MacOS
1917
runs-on: macos-latest
2018
steps:
21-
- name: Set up Go ${{ env.GO_VERSION }}
22-
uses: actions/setup-go@v5
23-
with:
24-
go-version: ${{ env.GO_VERSION }}
25-
cache: false
26-
id: go
27-
2819
- name: Check out code
2920
uses: actions/checkout@v4
30-
31-
- name: Set up CodeQL CLI
32-
uses: ./.github/actions/fetch-codeql
33-
34-
- name: Enable problem matchers in repository
35-
shell: bash
36-
run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
37-
38-
- name: Build
39-
run: |
40-
cd go
41-
make
42-
43-
- name: Cache compilation cache
44-
id: query-cache
45-
uses: ./.github/actions/cache-query-compilation
46-
with:
47-
key: go-qltest
48-
- name: Test
49-
run: |
50-
cd go
51-
make test cache="${{ steps.query-cache.outputs.cache-dir }}"
21+
- name: Run tests
22+
uses: ./go/actions/test
5223

5324
test-win:
5425
if: github.repository_owner == 'github'
5526
name: Test Windows
5627
runs-on: windows-latest-xl
5728
steps:
58-
- name: Set up Go ${{ env.GO_VERSION }}
59-
uses: actions/setup-go@v5
60-
with:
61-
go-version: ${{ env.GO_VERSION }}
62-
cache: false
63-
id: go
64-
6529
- name: Check out code
6630
uses: actions/checkout@v4
67-
68-
- name: Set up CodeQL CLI
69-
uses: ./.github/actions/fetch-codeql
70-
71-
- name: Enable problem matchers in repository
72-
shell: bash
73-
run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
74-
75-
- name: Build
76-
run: |
77-
cd go
78-
make
79-
80-
- name: Cache compilation cache
81-
id: query-cache
82-
uses: ./.github/actions/cache-query-compilation
83-
with:
84-
key: go-qltest
85-
86-
- name: Test
87-
run: |
88-
cd go
89-
make test cache="${{ steps.query-cache.outputs.cache-dir }}"
31+
- name: Run tests
32+
uses: ./go/actions/test

‎.github/workflows/go-tests.yml

+3-48
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@ on:
1616
- .github/actions/**
1717
- codeql-workspace.yml
1818

19-
env:
20-
GO_VERSION: '~1.22.0'
21-
2219
permissions:
2320
contents: read
2421

@@ -28,51 +25,9 @@ jobs:
2825
name: Test Linux (Ubuntu)
2926
runs-on: ubuntu-latest-xl
3027
steps:
31-
- name: Set up Go ${{ env.GO_VERSION }}
32-
uses: actions/setup-go@v5
33-
with:
34-
go-version: ${{ env.GO_VERSION }}
35-
cache: false
36-
id: go
37-
3828
- name: Check out code
3929
uses: actions/checkout@v4
40-
41-
- name: Set up CodeQL CLI
42-
uses: ./.github/actions/fetch-codeql
43-
44-
- name: Enable problem matchers in repository
45-
shell: bash
46-
run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
47-
48-
- name: Build
49-
run: |
50-
cd go
51-
make
52-
53-
- name: Check that all Go code is autoformatted
54-
run: |
55-
cd go
56-
make check-formatting
57-
58-
- name: Compile qhelp files to markdown
59-
run: |
60-
cd go
61-
env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
62-
63-
- name: Upload qhelp markdown
64-
uses: actions/upload-artifact@v3
30+
- name: Run tests
31+
uses: ./go/actions/test
6532
with:
66-
name: qhelp-markdown
67-
path: go/qhelp-out/**/*.md
68-
69-
- name: Cache compilation cache
70-
id: query-cache
71-
uses: ./.github/actions/cache-query-compilation
72-
with:
73-
key: go-qltest
74-
75-
- name: Test
76-
run: |
77-
cd go
78-
make test cache="${{ steps.query-cache.outputs.cache-dir }}"
33+
run-code-checks: true

‎.pre-commit-config.yaml

+7-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,13 @@ repos:
2929
entry: bazel run //misc/bazel:buildifier
3030
pass_filenames: false
3131

32-
- id: go-gen
33-
name: Check checked in generated files in go
34-
files: ^go/.*
35-
language: system
36-
entry: bazel run //go:gen
37-
pass_filenames: false
32+
# DISABLED: can be enabled by copying this config and installing `pre-commit` with `--config` on the copy
33+
# - id: go-gen
34+
# name: Check checked in generated files in go
35+
# files: ^go/.*
36+
# language: system
37+
# entry: bazel run //go:gen
38+
# pass_filenames: false
3839

3940
- id: codeql-format
4041
name: Fix QL file formatting

‎cpp/ql/lib/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 0.13.1
2+
3+
No user-facing changes.
4+
15
## 0.13.0
26

37
### Breaking Changes

‎cpp/ql/lib/change-notes/released/0.13.1.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 0.13.1
2+
3+
No user-facing changes.

‎cpp/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.13.0
2+
lastReleaseVersion: 0.13.1

‎cpp/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 0.13.1-dev
2+
version: 0.13.2-dev
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

-3
Original file line numberDiff line numberDiff line change
@@ -1844,9 +1844,6 @@ class TranslatedAssignExpr extends TranslatedNonConstantExpr {
18441844
child = this.getRightOperand() and
18451845
result = this.getLeftOperand().getFirstInstruction(kind)
18461846
or
1847-
child = this.getRightOperand() and
1848-
result = this.getLeftOperand().getFirstInstruction(kind)
1849-
or
18501847
kind instanceof GotoEdge and
18511848
child = this.getLeftOperand() and
18521849
result = this.getInstruction(AssignmentStoreTag())

‎cpp/ql/src/CHANGELOG.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## 0.9.12
2+
3+
### New Queries
4+
5+
* Added a new query, `cpp/iterator-to-expired-container`, to detect the creation of iterators owned by a temporary objects that are about to be destroyed.
6+
17
## 0.9.11
28

39
### Minor Analysis Improvements

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c

-22
This file was deleted.

‎cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp

+39-17
Original file line numberDiff line numberDiff line change
@@ -3,36 +3,57 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>Accessing paths controlled by users can allow an attacker to access unexpected resources. This
6+
<p>Accessing paths controlled by users can allow an attacker to access unexpected resources. This
77
can result in sensitive information being revealed or deleted, or an attacker being able to influence
88
behavior by modifying unexpected files.</p>
99

10-
<p>Paths that are naively constructed from data controlled by a user may contain unexpected special characters,
11-
such as "..". Such a path may potentially point to any directory on the filesystem.</p>
10+
<p>Paths that are naively constructed from data controlled by a user may be absolute paths, or may contain
11+
unexpected special characters such as "..". Such a path could point anywhere on the file system.</p>
1212

1313
</overview>
1414
<recommendation>
1515

16-
<p>Validate user input before using it to construct a filepath. Ideally, follow these rules:</p>
16+
<p>Validate user input before using it to construct a file path.</p>
1717

18-
<ul>
19-
<li>Do not allow more than a single "." character.</li>
20-
<li>Do not allow directory separators such as "/" or "\" (depending on the filesystem).</li>
21-
<li>Do not rely on simply replacing problematic sequences such as "../". For example, after applying this filter to
22-
".../...//" the resulting string would still be "../".</li>
23-
<li>Ideally use a whitelist of known good patterns.</li>
24-
</ul>
18+
<p>Common validation methods include checking that the normalized path is relative and does not contain
19+
any ".." components, or checking that the path is contained within a safe folder. The method you should use depends
20+
on how the path is used in the application, and whether the path should be a single path component.
21+
</p>
22+
23+
<p>If the path should be a single path component (such as a file name), you can check for the existence
24+
of any path separators ("/" or "\"), or ".." sequences in the input, and reject the input if any are found.
25+
</p>
26+
27+
<p>
28+
Note that removing "../" sequences is <i>not</i> sufficient, since the input could still contain a path separator
29+
followed by "..". For example, the input ".../...//" would still result in the string "../" if only "../" sequences
30+
are removed.
31+
</p>
32+
33+
<p>Finally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that
34+
the user input matches one of these patterns.</p>
2535

2636
</recommendation>
2737
<example>
2838

29-
<p>In this example, a username and file are read from the arguments to main and then used to access a file in the
30-
user's home directory. However, a malicious user could enter a filename which contains special
31-
characters. For example, the string "../../etc/passwd" will result in the code reading the file located at
32-
"/home/[user]/../../etc/passwd", which is the system's password file. This could potentially allow them to
33-
access all the system's passwords.</p>
39+
<p>In this example, a file name is read from a user and then used to access a file.
40+
However, a malicious user could enter a file name anywhere on the file system,
41+
such as "/etc/passwd" or "../../../etc/passwd".</p>
42+
43+
<sample src="examples/TaintedPath.c" />
44+
45+
<p>
46+
If the input should only be a file name, you can check that it doesn't contain any path separators or ".." sequences.
47+
</p>
48+
49+
<sample src="examples/TaintedPathNormalize.c" />
50+
51+
<p>
52+
If the input should be within a specific directory, you can check that the resolved path
53+
is still contained within that directory.
54+
</p>
3455

35-
<sample src="TaintedPath.c" />
56+
<sample src="examples/TaintedPathFolder.c" />
3657

3758
</example>
3859
<references>
@@ -41,6 +62,7 @@ access all the system's passwords.</p>
4162
OWASP:
4263
<a href="https://owasp.org/www-community/attacks/Path_Traversal">Path Traversal</a>.
4364
</li>
65+
<li>Linux man pages: <a href="https://man7.org/linux/man-pages/man3/realpath.3.html">realpath(3)</a>.</li>
4466

4567
</references>
4668
</qhelp>

‎cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPath.c

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
int main(int argc, char** argv) {
2+
char *userAndFile = argv[2];
3+
4+
{
5+
char fileBuffer[PATH_MAX];
6+
snprintf(fileBuffer, sizeof(fileBuffer), "/home/%s", userAndFile);
7+
// BAD: a string from the user is used in a filename
8+
fopen(fileBuffer, "wb+");
9+
}
10+
}

‎cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathFolder.c

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
4+
int main(int argc, char** argv) {
5+
char *userAndFile = argv[2];
6+
const char *baseDir = "/home/user/public/";
7+
char fullPath[PATH_MAX];
8+
9+
// Attempt to concatenate the base directory and the user-supplied path
10+
snprintf(fullPath, sizeof(fullPath), "%s%s", baseDir, userAndFile);
11+
12+
// Resolve the absolute path, normalizing any ".." or "."
13+
char *resolvedPath = realpath(fullPath, NULL);
14+
if (resolvedPath == NULL) {
15+
perror("Error resolving path");
16+
return 1;
17+
}
18+
19+
// Check if the resolved path starts with the base directory
20+
if (strncmp(baseDir, resolvedPath, strlen(baseDir)) != 0) {
21+
free(resolvedPath);
22+
return 1;
23+
}
24+
25+
// GOOD: Path is within the intended directory
26+
FILE *file = fopen(resolvedPath, "wb+");
27+
free(resolvedPath);
28+
}

‎cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathNormalize.c

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
4+
int main(int argc, char** argv) {
5+
char *fileName = argv[2];
6+
// Check for invalid sequences in the user input
7+
if (strstr(fileName , "..") || strchr(fileName , '/') || strchr(fileName , '\\')) {
8+
printf("Invalid filename.\n");
9+
return 1;
10+
}
11+
12+
char fileBuffer[PATH_MAX];
13+
snprintf(fileBuffer, sizeof(fileBuffer), "/home/user/files/%s", fileName);
14+
// GOOD: We know that the filename is safe and stays within the public folder
15+
FILE *file = fopen(fileBuffer, "wb+");
16+
}

‎cpp/ql/src/change-notes/2024-04-29-iterator-to-expired-container.md renamed to ‎cpp/ql/src/change-notes/released/0.9.12.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
---
2-
category: newQuery
3-
---
1+
## 0.9.12
2+
3+
### New Queries
4+
45
* Added a new query, `cpp/iterator-to-expired-container`, to detect the creation of iterators owned by a temporary objects that are about to be destroyed.

‎cpp/ql/src/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.9.11
2+
lastReleaseVersion: 0.9.12

‎cpp/ql/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-queries
2-
version: 0.9.12-dev
2+
version: 0.9.13-dev
33
groups:
44
- cpp
55
- queries

0 commit comments

Comments
 (0)