Skip to content

Commit f9125b7

Browse files
MathiasVPMathiasVP
committed
C++: Make "windows-registry" a subkind of local flow sources so we can target those specifically in queries.
1 parent 5256b95 commit f9125b7

4 files changed

Lines changed: 38 additions & 29 deletions

File tree

‎cpp/ql/lib/ext/Windows.model.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -35,18 +35,18 @@ extensions:
3535
- ["", "", False, "HttpReceiveRequestEntityBody", "", "", "Argument[*3]", "remote", "manual"]
3636
- ["", "", False, "HttpReceiveClientCertificate", "", "", "Argument[*3]", "remote", "manual"]
3737
# winreg.h
38-
- ["", "", False, "RegQueryValueA", "", "", "Argument[*2]", "local", "manual"]
39-
- ["", "", False, "RegQueryValueExA", "", "", "Argument[*4]", "local", "manual"]
40-
- ["", "", False, "RegQueryValueW", "", "", "Argument[*2]", "local", "manual"]
41-
- ["", "", False, "RegQueryValueExW", "", "", "Argument[*4]", "local", "manual"]
42-
- ["", "", False, "RegGetValueA", "", "", "Argument[*5]", "local", "manual"]
43-
- ["", "", False, "RegGetValueW", "", "", "Argument[*5]", "local", "manual"]
38+
- ["", "", False, "RegQueryValueA", "", "", "Argument[*2]", "windows-registry", "manual"]
39+
- ["", "", False, "RegQueryValueExA", "", "", "Argument[*4]", "windows-registry", "manual"]
40+
- ["", "", False, "RegQueryValueW", "", "", "Argument[*2]", "windows-registry", "manual"]
41+
- ["", "", False, "RegQueryValueExW", "", "", "Argument[*4]", "windows-registry", "manual"]
42+
- ["", "", False, "RegGetValueA", "", "", "Argument[*5]", "windows-registry", "manual"]
43+
- ["", "", False, "RegGetValueW", "", "", "Argument[*5]", "windows-registry", "manual"]
4444
# TODO: Once we support access paths at sources we should also mark Argument[*1].Field[*ve_valueptr]
45-
- ["", "", False, "RegQueryMultipleValuesA", "", "", "Argument[*3]", "local", "manual"]
45+
- ["", "", False, "RegQueryMultipleValuesA", "", "", "Argument[*3]", "windows-registry", "manual"]
4646
# TODO: Once we support access paths at sources we should also mark Argument[*1].Field[*ve_valueptr]
47-
- ["", "", False, "RegQueryMultipleValuesW", "", "", "Argument[*3]", "local", "manual"]
48-
- ["", "", False, "RegEnumValueA", "", "", "Argument[*6]", "local", "manual"]
49-
- ["", "", False, "RegEnumValueW", "", "", "Argument[*6]", "local", "manual"]
47+
- ["", "", False, "RegQueryMultipleValuesW", "", "", "Argument[*3]", "windows-registry", "manual"]
48+
- ["", "", False, "RegEnumValueA", "", "", "Argument[*6]", "windows-registry", "manual"]
49+
- ["", "", False, "RegEnumValueW", "", "", "Argument[*6]", "windows-registry", "manual"]
5050
- addsTo:
5151
pack: codeql/cpp-all
5252
extensible: summaryModel

‎cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ abstract class RemoteFlowSource extends FlowSource { }
2020
/** A data flow source of local user input. */
2121
abstract class LocalFlowSource extends FlowSource { }
2222

23+
/** A data flow source of local user input. */
24+
abstract class WindowsRegistrySource extends LocalFlowSource { }
25+
2326
/**
2427
* A remote data flow source that is defined through a `RemoteFlowSourceFunction` model.
2528
*/
@@ -101,6 +104,12 @@ private class ExternalLocalFlowSource extends LocalFlowSource {
101104
override string getSourceType() { result = "external" }
102105
}
103106

107+
private class ExternalWindowsRegistrySource extends WindowsRegistrySource {
108+
ExternalWindowsRegistrySource() { sourceNode(this, "windows-registry") }
109+
110+
override string getSourceType() { result = "a value from the Windows registry" }
111+
}
112+
104113
/** A remote data flow sink. */
105114
abstract class RemoteFlowSink extends DataFlow::Node {
106115
/** Gets a string that describes the type of this flow sink. */

‎cpp/ql/test/library-tests/dataflow/external-models/flow.expected‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@ models
1717
| 16 | Source: ; ; false; NtReadFile; ; ; Argument[*5]; local; manual |
1818
| 17 | Source: ; ; false; ReadFile; ; ; Argument[*1]; local; manual |
1919
| 18 | Source: ; ; false; ReadFileEx; ; ; Argument[*1]; local; manual |
20-
| 19 | Source: ; ; false; RegEnumValueA; ; ; Argument[*6]; local; manual |
21-
| 20 | Source: ; ; false; RegEnumValueW; ; ; Argument[*6]; local; manual |
22-
| 21 | Source: ; ; false; RegGetValueA; ; ; Argument[*5]; local; manual |
23-
| 22 | Source: ; ; false; RegQueryMultipleValuesA; ; ; Argument[*3]; local; manual |
24-
| 23 | Source: ; ; false; RegQueryMultipleValuesW; ; ; Argument[*3]; local; manual |
25-
| 24 | Source: ; ; false; RegQueryValueA; ; ; Argument[*2]; local; manual |
26-
| 25 | Source: ; ; false; RegQueryValueExA; ; ; Argument[*4]; local; manual |
27-
| 26 | Source: ; ; false; RegQueryValueExW; ; ; Argument[*4]; local; manual |
28-
| 27 | Source: ; ; false; RegQueryValueW; ; ; Argument[*2]; local; manual |
20+
| 19 | Source: ; ; false; RegEnumValueA; ; ; Argument[*6]; windows-registry; manual |
21+
| 20 | Source: ; ; false; RegEnumValueW; ; ; Argument[*6]; windows-registry; manual |
22+
| 21 | Source: ; ; false; RegGetValueA; ; ; Argument[*5]; windows-registry; manual |
23+
| 22 | Source: ; ; false; RegQueryMultipleValuesA; ; ; Argument[*3]; windows-registry; manual |
24+
| 23 | Source: ; ; false; RegQueryMultipleValuesW; ; ; Argument[*3]; windows-registry; manual |
25+
| 24 | Source: ; ; false; RegQueryValueA; ; ; Argument[*2]; windows-registry; manual |
26+
| 25 | Source: ; ; false; RegQueryValueExA; ; ; Argument[*4]; windows-registry; manual |
27+
| 26 | Source: ; ; false; RegQueryValueExW; ; ; Argument[*4]; windows-registry; manual |
28+
| 27 | Source: ; ; false; RegQueryValueW; ; ; Argument[*2]; windows-registry; manual |
2929
| 28 | Source: ; ; false; WinHttpQueryHeaders; ; ; Argument[*3]; remote; manual |
3030
| 29 | Source: ; ; false; WinHttpQueryHeadersEx; ; ; Argument[**8]; remote; manual |
3131
| 30 | Source: ; ; false; WinHttpQueryHeadersEx; ; ; Argument[*5]; remote; manual |

‎cpp/ql/test/library-tests/dataflow/external-models/sources.expected‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@
4343
| windows.cpp:900:64:900:77 | HttpReceiveHttpRequest output argument | remote |
4444
| windows.cpp:929:70:929:75 | HttpReceiveRequestEntityBody output argument | remote |
4545
| windows.cpp:936:70:936:78 | HttpReceiveClientCertificate output argument | remote |
46-
| windows.cpp:1004:35:1004:38 | RegQueryValueA output argument | local |
47-
| windows.cpp:1011:36:1011:39 | RegQueryValueW output argument | local |
48-
| windows.cpp:1019:53:1019:56 | RegQueryValueExA output argument | local |
49-
| windows.cpp:1027:54:1027:57 | RegQueryValueExW output argument | local |
50-
| windows.cpp:1035:46:1035:49 | RegQueryMultipleValuesA output argument | local |
51-
| windows.cpp:1043:46:1043:49 | RegQueryMultipleValuesW output argument | local |
52-
| windows.cpp:1051:53:1051:56 | RegGetValueA output argument | local |
53-
| windows.cpp:1060:53:1060:56 | RegGetValueA output argument | local |
54-
| windows.cpp:1070:71:1070:74 | RegEnumValueA output argument | local |
55-
| windows.cpp:1080:71:1080:74 | RegEnumValueW output argument | local |
46+
| windows.cpp:1004:35:1004:38 | RegQueryValueA output argument | windows-registry |
47+
| windows.cpp:1011:36:1011:39 | RegQueryValueW output argument | windows-registry |
48+
| windows.cpp:1019:53:1019:56 | RegQueryValueExA output argument | windows-registry |
49+
| windows.cpp:1027:54:1027:57 | RegQueryValueExW output argument | windows-registry |
50+
| windows.cpp:1035:46:1035:49 | RegQueryMultipleValuesA output argument | windows-registry |
51+
| windows.cpp:1043:46:1043:49 | RegQueryMultipleValuesW output argument | windows-registry |
52+
| windows.cpp:1051:53:1051:56 | RegGetValueA output argument | windows-registry |
53+
| windows.cpp:1060:53:1060:56 | RegGetValueA output argument | windows-registry |
54+
| windows.cpp:1070:71:1070:74 | RegEnumValueA output argument | windows-registry |
55+
| windows.cpp:1080:71:1080:74 | RegEnumValueW output argument | windows-registry |

0 commit comments

Comments
 (0)