Skip to content

Commit ecebc67

Browse files
author
Alvaro Muñoz
authored
Merge pull request #13 from GitHubSecurityLab/cpp_packs
Add cpp packs
2 parents 937b6ae + 5a3e466 commit ecebc67

24 files changed

+271
-3
lines changed

‎.github/workflows/build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
strategy:
1313
fail-fast: false
1414
matrix:
15-
language: [ 'csharp', 'go', 'java', 'python', 'ruby' ]
15+
language: [ 'cpp', 'csharp', 'go', 'java', 'python', 'ruby' ]
1616

1717
steps:
1818
- uses: actions/checkout@v3

‎.github/workflows/publish.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
strategy:
1818
fail-fast: false
1919
matrix:
20-
language: ["csharp", "go", "java", "python", "ruby"]
20+
language: ["cpp", "csharp", "go", "java", "python", "ruby"]
2121

2222
steps:
2323
- uses: actions/checkout@v3
@@ -54,7 +54,7 @@ jobs:
5454
strategy:
5555
fail-fast: false
5656
matrix:
57-
language: ["csharp", "go", "java", "python", "ruby"]
57+
language: ["cpp", "csharp", "go", "java", "python", "ruby"]
5858

5959
steps:
6060
- uses: actions/checkout@v3

‎codeql-workspace.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
provide:
2+
- cpp/**/qlpack.yml
23
- csharp/**/qlpack.yml
34
- go/**/qlpack.yml
45
- java/**/qlpack.yml

‎cpp/lib/applications/.gitkeep

Whitespace-only changes.

‎cpp/lib/codeql-pack.lock.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/cpp-all:
5+
version: 0.9.2
6+
codeql/dataflow:
7+
version: 0.0.3
8+
codeql/ssa:
9+
version: 0.1.4
10+
codeql/tutorial:
11+
version: 0.1.4
12+
codeql/util:
13+
version: 0.1.4
14+
compiled: false

‎cpp/lib/frameworks/.gitkeep

Whitespace-only changes.

‎cpp/lib/github/.gitkeep

Whitespace-only changes.

‎cpp/lib/qlpack.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
library: true
2+
name: githubsecuritylab/codeql-cpp-libs
3+
version: 0.0.1
4+
dependencies:
5+
codeql/cpp-all: '*'

‎cpp/src/CVEs/.gitkeep

Whitespace-only changes.

‎cpp/src/audit/explore/Dependencies.ql

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name External dependencies
3+
* @description Count the number of dependencies that a Java project has on external packages.
4+
* @kind treemap
5+
* @id githubsecuritylab/external-dependencies
6+
* @metricType externalDependency
7+
* @tags audit
8+
*/
9+
10+
import Metrics.Dependencies.ExternalDependencies
11+
12+
from File file, int num, string encodedDependency
13+
where encodedDependencies(file, encodedDependency, num)
14+
select encodedDependency, num order by num desc

‎cpp/src/audit/explore/Files.ql

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
/**
2+
* @name Files
3+
* @description List of all files in the repository
4+
* @kind table
5+
* @id githubsecuritylab/files
6+
* @tags audit
7+
*/
8+
9+
import cpp
10+
11+
from File f
12+
where f.getExtension() = ["c", "cpp"] and not f.getRelativePath().matches("%/test/%")
13+
select f.getRelativePath()

‎cpp/src/audit/explore/RemoteFlowSources.ql

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* @name Attack Surface
3+
* @description Application attack surface
4+
* @kind table
5+
* @id githubsecuritylab/attack-surface
6+
* @tags audit
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.models.interfaces.FlowSource
11+
12+
from RemoteFlowSourceFunction source
13+
where not source.getLocation().getFile().getRelativePath().matches("%/test/%")
14+
select source, "remote", source.getLocation().getFile().getRelativePath(),
15+
source.getLocation().getStartLine(), source.getLocation().getEndLine(),
16+
source.getLocation().getStartColumn(), source.getLocation().getEndColumn()

‎cpp/src/audit/templates/BackwardsPartialDataFlow.ql

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* @name Backwards Partial Dataflow
3+
* @description Backwards Partial Dataflow
4+
* @kind table
5+
* @id githubsecuritylab/backwards-partial-dataflow
6+
* @tags template
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.ir.dataflow.TaintTracking
11+
import PartialFlow::PartialPathGraph
12+
13+
private module MyConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) { none() }
15+
16+
predicate isSink(DataFlow::Node sink) {
17+
// Define the sink to run the backwards partial dataflow from. Eg:
18+
// exists(Call c |
19+
// c.getTarget().hasName("sink") and
20+
// c.getAnArgument() = sink.asExpr()
21+
// )
22+
none()
23+
}
24+
}
25+
26+
private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
27+
28+
int explorationLimit() { result = 10 }
29+
30+
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
32+
from PartialFlow::PartialPathNode n, int dist
33+
where PartialFlow::partialFlowRev(n, _, dist)
34+
select dist, n

‎cpp/src/audit/templates/DataFlowConfiguration.ql

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* @name DataFlow configuration
3+
* @description DataFlow TaintTracking configuration
4+
* @kind path-problem
5+
* @precision low
6+
* @problem.severity error
7+
* @id githubsecuritylab/dataflow-query
8+
* @tags template
9+
*/
10+
11+
import cpp
12+
import semmle.code.cpp.ir.dataflow.TaintTracking
13+
import MyFlow::PathGraph
14+
15+
private module MyConfig implements DataFlow::ConfigSig {
16+
predicate isSource(DataFlow::Node source) {
17+
// Define your source nodes here
18+
// exists(Call c |
19+
// c.getTarget().hasName("source") and
20+
// c = source.asExpr()
21+
// )
22+
none()
23+
}
24+
25+
predicate isSink(DataFlow::Node sink) {
26+
// Define your sink nodes here
27+
// exists(Call c |
28+
// c.getTarget().hasName("sink") and
29+
// c.getAnArgument() = sink.asExpr()
30+
// )
31+
none()
32+
}
33+
}
34+
35+
module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
36+
37+
from MyFlow::PathNode source, MyFlow::PathNode sink
38+
where MyFlow::flowPath(source, sink)
39+
select sink.getNode(), source, sink, "Sample TaintTracking query"

‎cpp/src/audit/templates/ForwardPartialDataflow.ql

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* @name Forward Partial Dataflow
3+
* @description Forward Partial Dataflow
4+
* @kind table
5+
* @id githubsecuritylab/forward-partial-dataflow
6+
* @tags template
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.ir.dataflow.TaintTracking
11+
import PartialFlow::PartialPathGraph
12+
13+
private module MyConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) {
15+
// Define the source to run the forward partial dataflow from. Eg:
16+
// exists(Call c |
17+
// c.getTarget().hasName("source") and
18+
// c = source.asExpr()
19+
// )
20+
none()
21+
}
22+
23+
predicate isSink(DataFlow::Node sink) { none() }
24+
}
25+
26+
private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
27+
28+
int explorationLimit() { result = 10 }
29+
30+
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
32+
from PartialFlow::PartialPathNode n, int dist
33+
where PartialFlow::partialFlow(_, n, dist)
34+
select dist, n

‎cpp/src/audit/templates/HoistSink.ql

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* @name Sink Hoisting to method parameter
3+
* @description Hoist a sink using partial dataflow
4+
* @kind table
5+
* @id githubsecuritylab/sink-hoister
6+
* @tags template
7+
*/
8+
9+
import cpp
10+
import semmle.code.cpp.ir.dataflow.TaintTracking
11+
import PartialFlow::PartialPathGraph
12+
13+
private module MyConfig implements DataFlow::ConfigSig {
14+
predicate isSource(DataFlow::Node source) { none() }
15+
16+
predicate isSink(DataFlow::Node sink) {
17+
// Define the sink to be hoisted here. eg:
18+
// exists(Call c |
19+
// c.getTarget().hasName("sink") and
20+
// c.getAnArgument() = sink.asExpr()
21+
// )
22+
none()
23+
}
24+
}
25+
26+
private module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
27+
28+
int explorationLimit() { result = 10 }
29+
30+
private module PartialFlow = MyFlow::FlowExploration<explorationLimit/0>;
31+
32+
from PartialFlow::PartialPathNode n, int dist
33+
where
34+
PartialFlow::partialFlowRev(n, _, dist) and
35+
n.getNode() instanceof DataFlow::ParameterNode
36+
select dist, n

‎cpp/src/codeql-pack.lock.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/cpp-all:
5+
version: 0.9.2
6+
codeql/cpp-queries:
7+
version: 0.7.4
8+
codeql/dataflow:
9+
version: 0.0.3
10+
codeql/ssa:
11+
version: 0.1.4
12+
codeql/suite-helpers:
13+
version: 0.6.4
14+
codeql/tutorial:
15+
version: 0.1.4
16+
codeql/util:
17+
version: 0.1.4
18+
compiled: false

‎cpp/src/qlpack.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
library: false
2+
name: githubsecuritylab/codeql-cpp-queries
3+
version: 0.0.1
4+
defaultSuiteFile: suites/cpp.qls
5+
dependencies:
6+
codeql/cpp-all: '*'
7+
codeql/cpp-queries: '*'
8+
githubsecuritylab/codeql-cpp-libs: 0.0.1

‎cpp/src/security/.gitkeep

Whitespace-only changes.

‎cpp/src/suites/cpp.qls

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- description: "GitHub's Community Packs Ruby Extended Suite"
2+
3+
- qlpack: github-queries-ruby
4+
5+
- import: codeql-suites/ruby-security-extended.qls
6+
from: codeql/ruby-queries
7+
- exclude:
8+
id:
9+
- rb/hardcoded-credentials

‎cpp/test/audit/.gitkeep

Whitespace-only changes.

‎cpp/test/codeql-pack.lock.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
lockVersion: 1.0.0
3+
dependencies:
4+
codeql/cpp-all:
5+
version: 0.9.2
6+
codeql/cpp-queries:
7+
version: 0.7.4
8+
codeql/dataflow:
9+
version: 0.0.3
10+
codeql/ssa:
11+
version: 0.1.4
12+
codeql/suite-helpers:
13+
version: 0.6.4
14+
codeql/tutorial:
15+
version: 0.1.4
16+
codeql/util:
17+
version: 0.1.4
18+
compiled: false

‎cpp/test/qlpack.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
name: githubsecurtylab/codeql-cpp-tests
2+
groups: [cpp, test]
3+
dependencies:
4+
codeql/cpp-all: '*'
5+
codeql/cpp-queries: '*'
6+
githubsecuritylab/codeql-cpp-queries: '*'
7+
githubsecuritylab/codeql-cpp-libs: '*'
8+
extractor: cpp
9+
tests: .

‎cpp/test/security/.gitkeep

Whitespace-only changes.

0 commit comments

Comments
 (0)