Skip to content

Commit 999e37d

Browse files
author
Alvaro Muñoz
committed
Add cpp packs
1 parent 937b6ae commit 999e37d

File tree

22 files changed

+287
-3
lines changed

22 files changed

+287
-3
lines changed

‎.github/workflows/build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
strategy:
1313
fail-fast: false
1414
matrix:
15-
language: [ 'csharp', 'go', 'java', 'python', 'ruby' ]
15+
language: [ 'cpp', 'csharp', 'go', 'java', 'python', 'ruby' ]
1616

1717
steps:
1818
- uses: actions/checkout@v3

‎.github/workflows/publish.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
strategy:
1818
fail-fast: false
1919
matrix:
20-
language: ["csharp", "go", "java", "python", "ruby"]
20+
language: ["cpp", "csharp", "go", "java", "python", "ruby"]
2121

2222
steps:
2323
- uses: actions/checkout@v3
@@ -54,7 +54,7 @@ jobs:
5454
strategy:
5555
fail-fast: false
5656
matrix:
57-
language: ["csharp", "go", "java", "python", "ruby"]
57+
language: ["cpp", "csharp", "go", "java", "python", "ruby"]
5858

5959
steps:
6060
- uses: actions/checkout@v3

‎codeql-workspace.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
provide:
2+
- cpp/**/qlpack.yml
23
- csharp/**/qlpack.yml
34
- go/**/qlpack.yml
45
- java/**/qlpack.yml

‎cpp/lib/applications/.gitkeep

Whitespace-only changes.

‎cpp/lib/frameworks/.gitkeep

Whitespace-only changes.

‎cpp/lib/github/.gitkeep

Whitespace-only changes.

‎cpp/lib/qlpack.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
library: true
2+
name: githubsecuritylab/codeql-cpp-libs
3+
version: 0.0.1
4+
dependencies:
5+
codeql/cpp-all: '*'

‎cpp/src/CVEs/.gitkeep

Whitespace-only changes.

‎cpp/src/audit/explore/Dependencies.ql

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name External dependencies
3+
* @description Count the number of dependencies that a Java project has on external packages.
4+
* @kind treemap
5+
* @id githubsecuritylab/external-dependencies
6+
* @metricType externalDependency
7+
* @tags audit
8+
*/
9+
10+
import Metrics.Dependencies.ExternalDependencies
11+
12+
from File file, int num, string encodedDependency
13+
where encodedDependencies(file, encodedDependency, num)
14+
select encodedDependency, num order by num desc

‎cpp/src/audit/explore/Files.ql

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
/**
2+
* @name Files
3+
* @description List of all files in the repository
4+
* @kind table
5+
* @id githubsecuritylab/files
6+
* @tags audit
7+
*/
8+
9+
import cpp
10+
11+
from File f
12+
where f.getExtension() = ["c", "cpp"] and not f.getRelativePath().matches("%/test/%")
13+
select f.getRelativePath()

‎cpp/src/audit/explore/Hotspots.ql

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/**
2+
* @name Hotspots
3+
* @description Interesting places to review manually
4+
* @kind problem
5+
* @precision low
6+
* @id seclab/cpp-hotspots
7+
* @tags audit
8+
*/
9+
10+
import cpp
11+
import semmle.code.cpp.dataflow.DataFlow
12+
import Critical.OverflowDestination as Pb864640c // cpp/overflow-destination
13+
import Likely_Bugs.Conversion.CastArrayPointerArithmetic as P0f6faebc // cpp/upcast-array-pointer-arithmetic
14+
import Security.CWE.CWE_022.TaintedPath as Pe668a5ba // cpp/path-injection
15+
import Security.CWE.CWE_078.ExecTainted as P84280c45 // cpp/command-line-injection
16+
import Security.CWE.CWE_129.ImproperArrayIndexValidation as Pfd2dfbd5 // cpp/unclear-array-index-validation
17+
import Security.CWE.CWE_190.ArithmeticUncontrolled as P2c62b1f9 // cpp/uncontrolled-arithmetic
18+
import Security.CWE.CWE_190.TaintedAllocationSize as Pbf19fcaf // cpp/uncontrolled-allocation-size
19+
import Security.CWE.CWE_311.CleartextBufferWrite as P9e90c5a1 // cpp/cleartext-storage-buffer
20+
import Security.CWE.CWE_311.CleartextFileWrite as Pcc67a29f // cpp/cleartext-storage-file
21+
import Security.CWE.CWE_311.CleartextTransmission as P6be8d893 // cpp/cleartext-transmission
22+
import Security.CWE.CWE_313.CleartextSqliteDatabase as P7a820024 // cpp/cleartext-storage-database
23+
import Security.CWE.CWE_319.UseOfHttp as Pa582973e // cpp/non-https-url
24+
import Security.CWE.CWE_326.InsufficientKeySize as Pcd949cd0 // cpp/insufficient-key-size
25+
import Security.CWE.CWE_611.XXE as P7c0fe853 // cpp/external-entity-expansion
26+
import experimental.Security.CWE.CWE_078.WordexpTainted as Pd969e4a8 // cpp/wordexp-injection
27+
import experimental.Security.CWE.CWE_190.AllocMultiplicationOverflow as P5eab2d42 // cpp/multiplication-overflow-in-alloc
28+
import experimental.Security.CWE.CWE_193.InvalidPointerDeref as P7597eda8 // cpp/invalid-pointer-deref
29+
import experimental.semmle.code.cpp.security.PrivateCleartextWrite as Pe6180bae // cpp/private-cleartext-write
30+
31+
Expr getSinkExpr(DataFlow::Node n) { result = n.asExpr() }
32+
33+
string getPath(DataFlow::Node n) { result = n.getLocation().getFile().getRelativePath() }
34+
35+
int getStartLine(DataFlow::Node n) { result = n.getLocation().getStartLine() }
36+
37+
int getEndLine(DataFlow::Node n) { result = n.getLocation().getEndLine() }
38+
39+
int getStartColumn(DataFlow::Node n) { result = n.getLocation().getStartColumn() }
40+
41+
int getEndColumn(DataFlow::Node n) { result = n.getLocation().getEndColumn() }
42+
43+
44+
from DataFlow::Node n, string type
45+
where
46+
P0f6faebc::CastToPointerArithFlowConfig::isSink(n, _) and type = "cpp/upcast-array-pointer-arithmetic" or
47+
P2c62b1f9::UncontrolledArithConfig::isSink(n) and type = "cpp/uncontrolled-arithmetic" or
48+
P5eab2d42::MultToAllocConfig::isSink(n) and type = "cpp/multiplication-overflow-in-alloc" or
49+
P6be8d893::FromSensitiveConfig::isSink(n) and type = "cpp/cleartext-transmission" or
50+
P7597eda8::FinalConfig::isSink(n, _) and type = "cpp/invalid-pointer-deref" or
51+
P7a820024::FromSensitiveConfig::isSink(n) and type = "cpp/cleartext-storage-database" or
52+
P7c0fe853::XxeConfig::isSink(n, _) and type = "cpp/external-entity-expansion" or
53+
P84280c45::ExecTaintConfig::isSink(n, _) and type = "cpp/command-line-injection" or
54+
P9e90c5a1::ToBufferConfig::isSink(n) and type = "cpp/cleartext-storage-buffer" or
55+
Pa582973e::HttpStringToUrlOpenConfig::isSink(n) and type = "cpp/non-https-url" or
56+
Pb864640c::OverflowDestinationConfig::isSink(n) and type = "cpp/overflow-destination" or
57+
Pbf19fcaf::TaintedAllocationSizeConfig::isSink(n) and type = "cpp/uncontrolled-allocation-size" or
58+
Pcc67a29f::FromSensitiveConfig::isSink(n) and type = "cpp/cleartext-storage-file" or
59+
Pcd949cd0::KeyStrengthFlowConfig::isSink(n) and type = "cpp/insufficient-key-size" or
60+
Pd969e4a8::WordexpTaintConfig::isSink(n) and type = "cpp/wordexp-injection" or
61+
Pe6180bae::PrivateCleartextWrite::WriteConfig::isSink(n) and type = "cpp/private-cleartext-write" or
62+
Pe668a5ba::TaintedPathConfig::isSink(n) and type = "cpp/path-injection" or
63+
Pfd2dfbd5::ImproperArrayIndexValidationConfig::isSink(n) and type = "cpp/unclear-array-index-validation"
64+
select getSinkExpr(n),
65+
type + " @ " + getPath(n).toString() + ":" + getStartLine(n).toString() + "," +
66+
getEndLine(n).toString() + "," + getStartColumn(n).toString() + "," + getEndColumn(n)

‎cpp/src/audit/explore/RemoteFlowSources.ql

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* @name Attack Surface
3+
* @description Application attack surface
4+
* @kind table
5+
* @id githubsecuritylab/attack-surface
6+
* @tags audit
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.models.interfaces.FlowSource
11+
12+
from RemoteFlowSourceFunction source
13+
where not source.getLocation().getFile().getRelativePath().matches("%/test/%")
14+
select source, "remote", source.getLocation().getFile().getRelativePath(),
15+
source.getLocation().getStartLine(), source.getLocation().getEndLine(),
16+
source.getLocation().getStartColumn(), source.getLocation().getEndColumn()

‎cpp/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* @name Backwards Partial Dataflow
3+
* @description Backwards Partial Dataflow
4+
* @kind table
5+
* @id githubsecuritylab/backwards-partial-dataflow
6+
* @tags template
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.ir.dataflow.TaintTracking
11+
import PartialFlow::PartialPathGraph
12+
13+
private module MyConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) { none() }
15+
16+
predicate isSink(DataFlow::Node sink) {
17+
// Define the sink to run the backwards partial dataflow from. Eg:
18+
// exists(Call c |
19+
// c.getTarget().hasName("sink") and
20+
// c.getAnArgument() = sink.asExpr()
21+
// )
22+
none()
23+
}
24+
}
25+
26+
private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
27+
28+
int explorationLimit() { result = 10 }
29+
30+
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
32+
from PartialFlow::PartialPathNode n, int dist
33+
where PartialFlow::partialFlowRev(n, _, dist)
34+
select dist, n

‎cpp/src/audit/templates/DataFlowConfiguration.ql

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* @name DataFlow configuration
3+
* @description DataFlow TaintTracking configuration
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
7+
* @id githubsecuritylab/dataflow-query
8+
* @tags template
9+
*/
10+
11+
import cpp
12+
import semmle.code.cpp.ir.dataflow.TaintTracking
13+
import MyFlow::PathGraph
14+
15+
private module MyConfig implements DataFlow::ConfigSig {
16+
predicate isSource(DataFlow::Node source) {
17+
// Define your source nodes here
18+
// exists(Call c |
19+
// c.getTarget().hasName("source") and
20+
// c = source.asExpr()
21+
// )
22+
none()
23+
}
24+
25+
predicate isSink(DataFlow::Node sink) {
26+
// Define your sink nodes here
27+
// exists(Call c |
28+
// c.getTarget().hasName("sink") and
29+
// c.getAnArgument() = sink.asExpr()
30+
// )
31+
none()
32+
}
33+
}
34+
35+
module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
36+
37+
from MyFlow::PathNode source, MyFlow::PathNode sink
38+
where MyFlow::flowPath(source, sink)
39+
select sink.getNode(), source, sink, "Sample TaintTracking query"

‎cpp/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* @name Forward Partial Dataflow
3+
* @description Forward Partial Dataflow
4+
* @kind table
5+
* @id githubsecuritylab/forward-partial-dataflow
6+
* @tags template
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.ir.dataflow.TaintTracking
11+
import PartialFlow::PartialPathGraph
12+
13+
private module MyConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) {
15+
// Define the source to run the forward partial dataflow from. Eg:
16+
// exists(Call c |
17+
// c.getTarget().hasName("source") and
18+
// c = source.asExpr()
19+
// )
20+
none()
21+
}
22+
23+
predicate isSink(DataFlow::Node sink) { none() }
24+
}
25+
26+
private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
27+
28+
int explorationLimit() { result = 10 }
29+
30+
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
32+
from PartialFlow::PartialPathNode n, int dist
33+
where PartialFlow::partialFlow(_, n, dist)
34+
select dist, n

‎cpp/src/audit/templates/HoistSink.ql

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* @name Sink Hoisting to method parameter
3+
* @description Hoist a sink using partial dataflow
4+
* @kind table
5+
* @id githubsecuritylab/sink-hoister
6+
* @tags template
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.ir.dataflow.TaintTracking
11+
import PartialFlow::PartialPathGraph
12+
13+
private module MyConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) { none() }
15+
16+
predicate isSink(DataFlow::Node sink) {
17+
// Define the sink to be hoisted here. eg:
18+
// exists(Call c |
19+
// c.getTarget().hasName("sink") and
20+
// c.getAnArgument() = sink.asExpr()
21+
// )
22+
none()
23+
}
24+
}
25+
26+
private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
27+
28+
int explorationLimit() { result = 10 }
29+
30+
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
32+
from PartialFlow::PartialPathNode n, int dist
33+
where
34+
PartialFlow::partialFlowRev(n, _, dist) and
35+
n.getNode() instanceof DataFlow::ParameterNode
36+
select dist, n

‎cpp/src/qlpack.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
library: false
2+
name: githubsecuritylab/codeql-cpp-queries
3+
version: 0.0.1
4+
defaultSuiteFile: suites/cpp.qls
5+
dependencies:
6+
codeql/cpp-all: '*'
7+
codeql/cpp-queries: '*'
8+
githubsecuritylab/codeql-cpp-libs: 0.0.1

‎cpp/src/security/.gitkeep

Whitespace-only changes.

‎cpp/src/suites/cpp.qls

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- description: "GitHub's Community Packs Ruby Extended Suite"
2+
3+
- qlpack: github-queries-ruby
4+
5+
- import: codeql-suites/ruby-security-extended.qls
6+
from: codeql/ruby-queries
7+
- exclude:
8+
id:
9+
- rb/hardcoded-credentials

‎cpp/test/audit/.gitkeep

Whitespace-only changes.

‎cpp/test/qlpack.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
name: githubsecurtylab/codeql-cpp-tests
2+
groups: [cpp, test]
3+
dependencies:
4+
codeql/cpp-all: '*'
5+
codeql/cpp-queries: '*'
6+
githubsecuritylab/codeql-cpp-queries: '*'
7+
githubsecuritylab/codeql-cpp-libs: '*'
8+
extractor: cpp
9+
tests: .

‎cpp/test/security/.gitkeep

Whitespace-only changes.

0 commit comments

Comments
 (0)