Skip to content

Commit 10b7b1f

Browse files
redsun82redsun82
committed
Merge branch 'main' into redsun82/swift-file-label-caching
2 parents 5e74df3 + 4101676 commit 10b7b1f

File tree

90 files changed

+1996
-53
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

90 files changed

+1996
-53
lines changed

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.cs

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
2+
{
3+
SymmetricKey aesKey = new SymmetricKey(kid: "symencryptionkey");
4+
5+
// BAD: Using the outdated client side encryption version V1_0
6+
BlobEncryptionPolicy uploadPolicy = new BlobEncryptionPolicy(key: aesKey, keyResolver: null);
7+
BlobRequestOptions uploadOptions = new BlobRequestOptions() { EncryptionPolicy = uploadPolicy };
8+
9+
MemoryStream stream = new MemoryStream(buffer);
10+
blob.UploadFromStream(stream, length: size, accessCondition: null, options: uploadOptions);
11+
}
12+
13+
var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions()
14+
{
15+
// BAD: Using an outdated SDK that does not support client side encryption version V2_0
16+
ClientSideEncryption = new ClientSideEncryptionOptions()
17+
{
18+
KeyEncryptionKey = myKey,
19+
KeyResolver = myKeyResolver,
20+
KeyWrapAlgorihm = myKeyWrapAlgorithm
21+
}
22+
});
23+
24+
var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions()
25+
{
26+
// BAD: Using the outdated client side encryption version V1_0
27+
ClientSideEncryption = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V1_0)
28+
{
29+
KeyEncryptionKey = myKey,
30+
KeyResolver = myKeyResolver,
31+
KeyWrapAlgorihm = myKeyWrapAlgorithm
32+
}
33+
});
34+
35+
var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions()
36+
{
37+
// GOOD: Using client side encryption version V2_0
38+
ClientSideEncryption = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V2_0)
39+
{
40+
KeyEncryptionKey = myKey,
41+
KeyResolver = myKeyResolver,
42+
KeyWrapAlgorihm = myKeyWrapAlgorithm
43+
}
44+
});

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.qhelp

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
4+
5+
<overview>
6+
<p>Azure Storage .NET, Java, and Python SDKs support encryption on the client with a customer-managed key that is maintained in Azure Key Vault or another key store.</p>
7+
<p>Current release versions of the Azure Storage SDKs use cipher block chaining (CBC mode) for client-side encryption (referred to as <code>v1</code>).</p>
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>Consider switching to <code>v2</code> client-side encryption.</p>
13+
14+
</recommendation>
15+
<example>
16+
17+
<sample src="UnsafeUsageOfClientSideEncryptionVersion.cs" />
18+
19+
</example>
20+
<references>
21+
<li>
22+
<a href="http://aka.ms/azstorageclientencryptionblog">Azure Storage Client Encryption Blog.</a>
23+
</li>
24+
<li>
25+
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30187">CVE-2022-30187</a>
26+
</li>
27+
28+
</references>
29+
</qhelp>

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
/**
2+
* @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187).
3+
* @description Unsafe usage of v1 version of Azure Storage client-side encryption, please refer to http://aka.ms/azstorageclientencryptionblog
4+
* @kind problem
5+
* @tags security
6+
* cryptography
7+
* external/cwe/cwe-327
8+
* @id cs/azure-storage/unsafe-usage-of-client-side-encryption-version
9+
* @problem.severity error
10+
* @precision high
11+
*/
12+
13+
import csharp
14+
15+
/**
16+
* Holds if `oc` is creating an object of type `c` = `Azure.Storage.ClientSideEncryptionOptions`
17+
* and `e` is the `version` argument to the constructor
18+
*/
19+
predicate isCreatingAzureClientSideEncryptionObject(ObjectCreation oc, Class c, Expr e) {
20+
exists(Parameter p | p.hasName("version") |
21+
c.hasQualifiedName("Azure.Storage.ClientSideEncryptionOptions") and
22+
oc.getTarget() = c.getAConstructor() and
23+
e = oc.getArgumentForParameter(p)
24+
)
25+
}
26+
27+
/**
28+
* Holds if `oc` is an object creation of the outdated type `c` = `Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy`
29+
*/
30+
predicate isCreatingOutdatedAzureClientSideEncryptionObject(ObjectCreation oc, Class c) {
31+
c.hasQualifiedName("Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy") and
32+
oc.getTarget() = c.getAConstructor()
33+
}
34+
35+
/**
36+
* Holds if the Azure.Storage assembly for `c` is a version known to support
37+
* version 2+ for client-side encryption
38+
*/
39+
predicate doesAzureStorageAssemblySupportSafeClientSideEncryption(Assembly asm) {
40+
exists(int versionCompare |
41+
versionCompare = asm.getVersion().compareTo("12.12.0.0") and
42+
versionCompare >= 0
43+
) and
44+
asm.getName() = "Azure.Storage.Common"
45+
}
46+
47+
/**
48+
* Holds if the Azure.Storage assembly for `c` is a version known to support
49+
* version 2+ for client-side encryption and if the argument for the constructor `version`
50+
* is set to a secure value.
51+
*/
52+
predicate isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(Expr versionExpr, Assembly asm) {
53+
// Check if the Azure.Storage assembly version has the fix
54+
doesAzureStorageAssemblySupportSafeClientSideEncryption(asm) and
55+
// and that the version argument for the constructor is guaranteed to be Version2
56+
isExprAnAccessToSafeClientSideEncryptionVersionValue(versionExpr)
57+
}
58+
59+
/**
60+
* Holds if the expression `e` is an access to a safe version of the enum `ClientSideEncryptionVersion`
61+
* or an equivalent numeric value
62+
*/
63+
predicate isExprAnAccessToSafeClientSideEncryptionVersionValue(Expr e) {
64+
exists(EnumConstant ec |
65+
ec.hasQualifiedName("Azure.Storage.ClientSideEncryptionVersion.V2_0") and
66+
ec.getAnAccess() = e
67+
)
68+
}
69+
70+
from Expr e, Class c, Assembly asm
71+
where
72+
asm = c.getLocation() and
73+
(
74+
exists(Expr e2 |
75+
isCreatingAzureClientSideEncryptionObject(e, c, e2) and
76+
not isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(e2, asm)
77+
)
78+
or
79+
isCreatingOutdatedAzureClientSideEncryptionObject(e, c)
80+
)
81+
select e, "Unsafe usage of v1 version of Azure Storage client-side encryption."

‎docs/codeql/query-help/cpp.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@ CodeQL query help for C and C++
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/cpp/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/cpp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/cpp/ql/examples>`__.
79

810
.. include:: toc-cpp.rst
911

‎docs/codeql/query-help/csharp.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for C#
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/csharp/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/csharp-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/csharp/ql/examples>`__.
79

810
.. include:: toc-csharp.rst

‎docs/codeql/query-help/go.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Go
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/go/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/go-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/go/ql/examples>`__.
79

810
.. include:: toc-go.rst

‎docs/codeql/query-help/java.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Java
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/java/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/java-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/java/ql/examples>`__.
79

810
.. include:: toc-java.rst

‎docs/codeql/query-help/javascript.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for JavaScript
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/javascript/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/javascript-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/javascript/ql/examples>`__.
79

810
.. include:: toc-javascript.rst

‎docs/codeql/query-help/python.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Python
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/python/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/python-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/python/ql/examples>`__.
79

810
.. include:: toc-python.rst

‎docs/codeql/query-help/ruby.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ CodeQL query help for Ruby
33

44
.. include:: ../reusables/query-help-overview.rst
55

6-
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/main/ruby/ql/examples>`__.
6+
These queries are published in the CodeQL query pack ``codeql/ruby-queries`` (`changelog <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/src/CHANGELOG.md>`__, `source <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/src>`__).
7+
8+
For shorter queries that you can use as building blocks when writing your own queries, see the `example queries in the CodeQL repository <https://github.com/github/codeql/tree/codeql-cli/latest/ruby/ql/examples>`__.
79

810
.. include:: toc-ruby.rst

0 commit comments

Comments
 (0)