Skip to content

Commit 18f80eb

Browse files
geoffw0geoffw0
committed
C++: Loosen a few constraints slightly.
1 parent 850646b commit 18f80eb

File tree

3 files changed

+11
-5
lines changed

3 files changed

+11
-5
lines changed

‎cpp/ql/lib/semmle/code/cpp/security/PrivateData.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ private string privateNames() {
1818
[
1919
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
2020
// Government identifiers, such as Social Security Numbers
21-
"%social%security%number%",
21+
"%social%security%",
2222
// Contact information, such as home addresses and telephone numbers
2323
"%postcode%", "%zipcode%", "%telephone%",
2424
// Geographic location - where the user is (or was)
2525
"%latitude%", "%longitude%",
2626
// Financial data - such as credit card numbers, salary, bank accounts, and debts
27-
"%creditcard%", "%salary%", "%bankaccount%",
27+
"%credit%card%", "%salary%", "%bank%account%",
2828
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
2929
"%email%", "%mobile%", "%employer%",
3030
// Health - medical conditions, insurance status, prescription records

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,10 +224,13 @@ nodes
224224
| test3.cpp:429:7:429:14 | password | semmle.label | password |
225225
| test3.cpp:431:8:431:15 | password | semmle.label | password |
226226
| test3.cpp:507:18:507:39 | social_security_number | semmle.label | social_security_number |
227+
| test3.cpp:508:18:508:33 | socialSecurityNo | semmle.label | socialSecurityNo |
227228
| test3.cpp:509:18:509:29 | homePostCode | semmle.label | homePostCode |
228229
| test3.cpp:511:18:511:26 | telephone | semmle.label | telephone |
229230
| test3.cpp:512:18:512:36 | mobile_phone_number | semmle.label | mobile_phone_number |
230231
| test3.cpp:513:18:513:22 | email | semmle.label | email |
232+
| test3.cpp:514:18:514:38 | my_credit_card_number | semmle.label | my_credit_card_number |
233+
| test3.cpp:515:18:515:35 | my_bank_account_no | semmle.label | my_bank_account_no |
231234
| test3.cpp:516:18:516:29 | employerName | semmle.label | employerName |
232235
| test3.cpp:517:18:517:29 | medical_info | semmle.label | medical_info |
233236
| test3.cpp:526:44:526:54 | my_latitude | semmle.label | my_latitude |
@@ -268,10 +271,13 @@ subpaths
268271
| test3.cpp:420:3:420:6 | call to recv | test3.cpp:420:17:420:24 | password | test3.cpp:420:17:420:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:420:17:420:24 | password | password |
269272
| test3.cpp:431:2:431:6 | call to fgets | test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:429:7:429:14 | password | password |
270273
| test3.cpp:507:2:507:5 | call to send | test3.cpp:507:18:507:39 | social_security_number | test3.cpp:507:18:507:39 | social_security_number | This operation transmits 'social_security_number', which may contain unencrypted sensitive data from $@ | test3.cpp:507:18:507:39 | social_security_number | social_security_number |
274+
| test3.cpp:508:2:508:5 | call to send | test3.cpp:508:18:508:33 | socialSecurityNo | test3.cpp:508:18:508:33 | socialSecurityNo | This operation transmits 'socialSecurityNo', which may contain unencrypted sensitive data from $@ | test3.cpp:508:18:508:33 | socialSecurityNo | socialSecurityNo |
271275
| test3.cpp:509:2:509:5 | call to send | test3.cpp:509:18:509:29 | homePostCode | test3.cpp:509:18:509:29 | homePostCode | This operation transmits 'homePostCode', which may contain unencrypted sensitive data from $@ | test3.cpp:509:18:509:29 | homePostCode | homePostCode |
272276
| test3.cpp:511:2:511:5 | call to send | test3.cpp:511:18:511:26 | telephone | test3.cpp:511:18:511:26 | telephone | This operation transmits 'telephone', which may contain unencrypted sensitive data from $@ | test3.cpp:511:18:511:26 | telephone | telephone |
273277
| test3.cpp:512:2:512:5 | call to send | test3.cpp:512:18:512:36 | mobile_phone_number | test3.cpp:512:18:512:36 | mobile_phone_number | This operation transmits 'mobile_phone_number', which may contain unencrypted sensitive data from $@ | test3.cpp:512:18:512:36 | mobile_phone_number | mobile_phone_number |
274278
| test3.cpp:513:2:513:5 | call to send | test3.cpp:513:18:513:22 | email | test3.cpp:513:18:513:22 | email | This operation transmits 'email', which may contain unencrypted sensitive data from $@ | test3.cpp:513:18:513:22 | email | email |
279+
| test3.cpp:514:2:514:5 | call to send | test3.cpp:514:18:514:38 | my_credit_card_number | test3.cpp:514:18:514:38 | my_credit_card_number | This operation transmits 'my_credit_card_number', which may contain unencrypted sensitive data from $@ | test3.cpp:514:18:514:38 | my_credit_card_number | my_credit_card_number |
280+
| test3.cpp:515:2:515:5 | call to send | test3.cpp:515:18:515:35 | my_bank_account_no | test3.cpp:515:18:515:35 | my_bank_account_no | This operation transmits 'my_bank_account_no', which may contain unencrypted sensitive data from $@ | test3.cpp:515:18:515:35 | my_bank_account_no | my_bank_account_no |
275281
| test3.cpp:516:2:516:5 | call to send | test3.cpp:516:18:516:29 | employerName | test3.cpp:516:18:516:29 | employerName | This operation transmits 'employerName', which may contain unencrypted sensitive data from $@ | test3.cpp:516:18:516:29 | employerName | employerName |
276282
| test3.cpp:517:2:517:5 | call to send | test3.cpp:517:18:517:29 | medical_info | test3.cpp:517:18:517:29 | medical_info | This operation transmits 'medical_info', which may contain unencrypted sensitive data from $@ | test3.cpp:517:18:517:29 | medical_info | medical_info |
277283
| test3.cpp:527:3:527:6 | call to send | test3.cpp:526:44:526:54 | my_latitude | test3.cpp:527:15:527:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:526:44:526:54 | my_latitude | my_latitude |

‎cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -505,14 +505,14 @@ void tests2(person_info *pi)
505505
{
506506
// direct cases
507507
send(val(), pi->social_security_number, strlen(pi->social_security_number), val()); // BAD
508-
send(val(), pi->socialSecurityNo, strlen(pi->socialSecurityNo), val()); // BAD [NOT DETECTED]
508+
send(val(), pi->socialSecurityNo, strlen(pi->socialSecurityNo), val()); // BAD
509509
send(val(), pi->homePostCode, strlen(pi->homePostCode), val()); // BAD
510510
send(val(), pi->my_zip_code, strlen(pi->my_zip_code), val()); // BAD [NOT DETECTED]
511511
send(val(), pi->telephone, strlen(pi->telephone), val()); // BAD
512512
send(val(), pi->mobile_phone_number, strlen(pi->mobile_phone_number), val()); // BAD
513513
send(val(), pi->email, strlen(pi->email), val()); // BAD
514-
send(val(), pi->my_credit_card_number, strlen(pi->my_credit_card_number), val()); // BAD [NOT DETECTED]
515-
send(val(), pi->my_bank_account_no, strlen(pi->my_bank_account_no), val()); // BAD [NOT DETECTED]
514+
send(val(), pi->my_credit_card_number, strlen(pi->my_credit_card_number), val()); // BAD
515+
send(val(), pi->my_bank_account_no, strlen(pi->my_bank_account_no), val()); // BAD
516516
send(val(), pi->employerName, strlen(pi->employerName), val()); // BAD
517517
send(val(), pi->medical_info, strlen(pi->medical_info), val()); // BAD
518518
send(val(), pi->license_key, strlen(pi->license_key), val()); // BAD [NOT DETECTED]

0 commit comments

Comments
 (0)