Skip to content

Commit e3be774

Browse files
geoffw0geoffw0
committed
C++: Repair the LSParser sinks.
1 parent 8852043 commit e3be774

File tree

3 files changed

+61
-14
lines changed

3 files changed

+61
-14
lines changed

‎cpp/ql/src/Security/CWE/CWE-611/XXE.ql

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,13 @@ class XercesDOMParserClass extends Class {
5757
XercesDOMParserClass() { this.hasName("XercesDOMParser") }
5858
}
5959

60+
/**
61+
* The `DOMLSParser` class.
62+
*/
63+
class DOMLSParserClass extends Class {
64+
DOMLSParserClass() { this.hasName("DOMLSParser") }
65+
}
66+
6067
/**
6168
* The `SAXParser` class.
6269
*/
@@ -217,12 +224,12 @@ class SetFeatureTranformer extends XXEFlowStateTranformer {
217224
}
218225

219226
/**
220-
* The `AbstractDOMParser.parse`, `SAXParser.parse` or `SAX2XMLReader.parse`
221-
* method.
227+
* The `AbstractDOMParser.parse`, `DOMLSParserClass.parse`, `SAXParser.parse` or `SAX2XMLReader.parse` method.
222228
*/
223229
class ParseFunction extends Function {
224230
ParseFunction() {
225231
this.getClassAndName("parse") instanceof AbstractDOMParserClass or
232+
this.getClassAndName("parse") instanceof DOMLSParserClass or
226233
this.getClassAndName("parse") instanceof SaxParserClass or
227234
this.getClassAndName("parse") instanceof Sax2XmlReader
228235
}
@@ -235,7 +242,7 @@ class ParseFunction extends Function {
235242
class CreateLSParser extends Function {
236243
CreateLSParser() {
237244
this.hasName("createLSParser") and
238-
this.getUnspecifiedType().(PointerType).getBaseType().getName() = "DOMLSParser" // returns a `DOMLSParser *`.
245+
this.getUnspecifiedType().(PointerType).getBaseType() instanceof DOMLSParserClass // returns a `DOMLSParser *`.
239246
}
240247
}
241248

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.expected

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,17 @@ edges
44
| tests3.cpp:23:21:23:53 | call to createXMLReader | tests3.cpp:25:2:25:2 | p |
55
| tests3.cpp:60:21:60:53 | call to createXMLReader | tests3.cpp:63:2:63:2 | p |
66
| tests3.cpp:67:21:67:53 | call to createXMLReader | tests3.cpp:70:2:70:2 | p |
7+
| tests5.cpp:27:25:27:38 | call to createLSParser | tests5.cpp:29:2:29:2 | p |
8+
| tests5.cpp:33:25:33:38 | call to createLSParser | tests5.cpp:36:2:36:2 | p |
9+
| tests5.cpp:40:25:40:38 | call to createLSParser | tests5.cpp:43:2:43:2 | p |
10+
| tests5.cpp:47:25:47:38 | call to createLSParser | tests5.cpp:51:2:51:2 | p |
11+
| tests5.cpp:55:25:55:38 | call to createLSParser | tests5.cpp:59:2:59:2 | p |
12+
| tests5.cpp:81:25:81:38 | call to createLSParser | tests5.cpp:83:2:83:2 | p |
13+
| tests5.cpp:81:25:81:38 | call to createLSParser | tests5.cpp:86:2:86:2 | p |
14+
| tests5.cpp:81:25:81:38 | call to createLSParser | tests5.cpp:89:2:89:2 | p |
15+
| tests5.cpp:93:25:93:38 | call to createLSParser | tests5.cpp:96:2:96:2 | p |
16+
| tests5.cpp:93:25:93:38 | call to createLSParser | tests5.cpp:99:2:99:2 | p |
17+
| tests5.cpp:93:25:93:38 | call to createLSParser | tests5.cpp:102:2:102:2 | p |
718
| tests.cpp:15:23:15:43 | XercesDOMParser output argument | tests.cpp:17:2:17:2 | p |
819
| tests.cpp:28:23:28:43 | XercesDOMParser output argument | tests.cpp:31:2:31:2 | p |
920
| tests.cpp:35:19:35:19 | VariableAddress [post update] | tests.cpp:37:2:37:2 | p |
@@ -46,6 +57,24 @@ nodes
4657
| tests4.cpp:46:34:46:68 | ... \| ... | semmle.label | ... \| ... |
4758
| tests4.cpp:77:34:77:38 | flags | semmle.label | flags |
4859
| tests4.cpp:130:39:130:55 | (int)... | semmle.label | (int)... |
60+
| tests5.cpp:27:25:27:38 | call to createLSParser | semmle.label | call to createLSParser |
61+
| tests5.cpp:29:2:29:2 | p | semmle.label | p |
62+
| tests5.cpp:33:25:33:38 | call to createLSParser | semmle.label | call to createLSParser |
63+
| tests5.cpp:36:2:36:2 | p | semmle.label | p |
64+
| tests5.cpp:40:25:40:38 | call to createLSParser | semmle.label | call to createLSParser |
65+
| tests5.cpp:43:2:43:2 | p | semmle.label | p |
66+
| tests5.cpp:47:25:47:38 | call to createLSParser | semmle.label | call to createLSParser |
67+
| tests5.cpp:51:2:51:2 | p | semmle.label | p |
68+
| tests5.cpp:55:25:55:38 | call to createLSParser | semmle.label | call to createLSParser |
69+
| tests5.cpp:59:2:59:2 | p | semmle.label | p |
70+
| tests5.cpp:81:25:81:38 | call to createLSParser | semmle.label | call to createLSParser |
71+
| tests5.cpp:83:2:83:2 | p | semmle.label | p |
72+
| tests5.cpp:86:2:86:2 | p | semmle.label | p |
73+
| tests5.cpp:89:2:89:2 | p | semmle.label | p |
74+
| tests5.cpp:93:25:93:38 | call to createLSParser | semmle.label | call to createLSParser |
75+
| tests5.cpp:96:2:96:2 | p | semmle.label | p |
76+
| tests5.cpp:99:2:99:2 | p | semmle.label | p |
77+
| tests5.cpp:102:2:102:2 | p | semmle.label | p |
4978
| tests.cpp:15:23:15:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
5079
| tests.cpp:17:2:17:2 | p | semmle.label | p |
5180
| tests.cpp:28:23:28:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
@@ -93,6 +122,17 @@ subpaths
93122
| tests4.cpp:46:34:46:68 | ... \| ... | tests4.cpp:46:34:46:68 | ... \| ... | tests4.cpp:46:34:46:68 | ... \| ... | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests4.cpp:46:34:46:68 | ... \| ... | XML parser |
94123
| tests4.cpp:77:34:77:38 | flags | tests4.cpp:77:34:77:38 | flags | tests4.cpp:77:34:77:38 | flags | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests4.cpp:77:34:77:38 | flags | XML parser |
95124
| tests4.cpp:130:39:130:55 | (int)... | tests4.cpp:130:39:130:55 | (int)... | tests4.cpp:130:39:130:55 | (int)... | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests4.cpp:130:39:130:55 | (int)... | XML parser |
125+
| tests5.cpp:29:2:29:2 | p | tests5.cpp:27:25:27:38 | call to createLSParser | tests5.cpp:29:2:29:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:27:25:27:38 | call to createLSParser | XML parser |
126+
| tests5.cpp:36:2:36:2 | p | tests5.cpp:33:25:33:38 | call to createLSParser | tests5.cpp:36:2:36:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:33:25:33:38 | call to createLSParser | XML parser |
127+
| tests5.cpp:43:2:43:2 | p | tests5.cpp:40:25:40:38 | call to createLSParser | tests5.cpp:43:2:43:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:40:25:40:38 | call to createLSParser | XML parser |
128+
| tests5.cpp:51:2:51:2 | p | tests5.cpp:47:25:47:38 | call to createLSParser | tests5.cpp:51:2:51:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:47:25:47:38 | call to createLSParser | XML parser |
129+
| tests5.cpp:59:2:59:2 | p | tests5.cpp:55:25:55:38 | call to createLSParser | tests5.cpp:59:2:59:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:55:25:55:38 | call to createLSParser | XML parser |
130+
| tests5.cpp:83:2:83:2 | p | tests5.cpp:81:25:81:38 | call to createLSParser | tests5.cpp:83:2:83:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:81:25:81:38 | call to createLSParser | XML parser |
131+
| tests5.cpp:86:2:86:2 | p | tests5.cpp:81:25:81:38 | call to createLSParser | tests5.cpp:86:2:86:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:81:25:81:38 | call to createLSParser | XML parser |
132+
| tests5.cpp:89:2:89:2 | p | tests5.cpp:81:25:81:38 | call to createLSParser | tests5.cpp:89:2:89:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:81:25:81:38 | call to createLSParser | XML parser |
133+
| tests5.cpp:96:2:96:2 | p | tests5.cpp:93:25:93:38 | call to createLSParser | tests5.cpp:96:2:96:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:93:25:93:38 | call to createLSParser | XML parser |
134+
| tests5.cpp:99:2:99:2 | p | tests5.cpp:93:25:93:38 | call to createLSParser | tests5.cpp:99:2:99:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:93:25:93:38 | call to createLSParser | XML parser |
135+
| tests5.cpp:102:2:102:2 | p | tests5.cpp:93:25:93:38 | call to createLSParser | tests5.cpp:102:2:102:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:93:25:93:38 | call to createLSParser | XML parser |
96136
| tests.cpp:17:2:17:2 | p | tests.cpp:15:23:15:43 | XercesDOMParser output argument | tests.cpp:17:2:17:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:15:23:15:43 | XercesDOMParser output argument | XML parser |
97137
| tests.cpp:31:2:31:2 | p | tests.cpp:28:23:28:43 | XercesDOMParser output argument | tests.cpp:31:2:31:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:28:23:28:43 | XercesDOMParser output argument | XML parser |
98138
| tests.cpp:39:2:39:2 | p | tests.cpp:35:23:35:43 | XercesDOMParser output argument | tests.cpp:39:2:39:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:35:23:35:43 | XercesDOMParser output argument | XML parser |

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,37 +26,37 @@ class DOMImplementationLS {
2626
void test5_1(DOMImplementationLS *impl, InputSource &data) {
2727
DOMLSParser *p = impl->createLSParser();
2828

29-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
29+
p->parse(data); // BAD (parser not correctly configured)
3030
}
3131

3232
void test5_2(DOMImplementationLS *impl, InputSource &data) {
3333
DOMLSParser *p = impl->createLSParser();
3434

3535
p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true);
36-
p->parse(data); // GOOD
36+
p->parse(data); // GOOD [FALSE POSITIVE]
3737
}
3838

3939
void test5_3(DOMImplementationLS *impl, InputSource &data) {
4040
DOMLSParser *p = impl->createLSParser();
4141

4242
p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false);
43-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
43+
p->parse(data); // BAD (parser not correctly configured)
4444
}
4545

4646
void test5_4(DOMImplementationLS *impl, InputSource &data) {
4747
DOMLSParser *p = impl->createLSParser();
4848
DOMConfiguration *cfg = p->getDomConfig();
4949

5050
cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true);
51-
p->parse(data); // GOOD
51+
p->parse(data); // GOOD [FALSE POSITIVE]
5252
}
5353

5454
void test5_5(DOMImplementationLS *impl, InputSource &data) {
5555
DOMLSParser *p = impl->createLSParser();
5656
DOMConfiguration *cfg = p->getDomConfig();
5757

5858
cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false);
59-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
59+
p->parse(data); // BAD (parser not correctly configured)
6060
}
6161

6262
DOMImplementationLS *g_impl;
@@ -80,24 +80,24 @@ void test5_6() {
8080
void test5_7(DOMImplementationLS *impl, InputSource &data) {
8181
DOMLSParser *p = impl->createLSParser();
8282

83-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
83+
p->parse(data); // BAD (parser not correctly configured)
8484

8585
p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true);
86-
p->parse(data); // GOOD
86+
p->parse(data); // GOOD [FALSE POSITIVE]
8787

8888
p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false);
89-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
89+
p->parse(data); // BAD (parser not correctly configured)
9090
}
9191

9292
void test5_8(DOMImplementationLS *impl, InputSource &data) {
9393
DOMLSParser *p = impl->createLSParser();
9494
DOMConfiguration *cfg = p->getDomConfig();
9595

96-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
96+
p->parse(data); // BAD (parser not correctly configured)
9797

9898
cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true);
99-
p->parse(data); // GOOD
99+
p->parse(data); // GOOD [FALSE POSITIVE]
100100

101101
cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false);
102-
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
102+
p->parse(data); // BAD (parser not correctly configured)
103103
}

0 commit comments

Comments
 (0)