Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

c++ Protobuf Dataflow Interrupt #6500

Open
mrlzh opened this issue Aug 18, 2021 · 3 comments
Open

c++ Protobuf Dataflow Interrupt #6500

mrlzh opened this issue Aug 18, 2021 · 3 comments
Labels
C++ question Further information is requested

Comments

@mrlzh
Copy link

mrlzh commented Aug 18, 2021

Code demo

test.proto

syntax = "proto3";

message Test {
    string tttname = 1;
}

proto file generator cpp code by protoc version 3.5.1. Function to get tttname value like this.

inline const ::std::string& Test::tttname() const {
  // @@protoc_insertion_point(field_get:Test.tttname)
  return tttname_.GetNoArena();
}


main.cpp

#include "stdio.h"
#include "test.pb.h"

void docmd(Test ttt){
    char cmd[1024] = {0};
    snprintf(cmd, sizeof(cmd), "ls %s",ttt.tttname().c_str());
    printf("cmd: %s\n",cmd);
    system(cmd);
}

int main()
{
    Test test;
    test.set_tttname("/tmp");

    docmd(test);
    return 0;
}

QL

import cpp
import semmle.code.cpp.security.CommandExecution
import semmle.code.cpp.dataflow.TaintTracking
import DataFlow::PathGraph

predicate vInput(Parameter expr) {
  exists(Parameter v |
    v.getName() = "ttt" and
    v = expr
  )
}

class TmpRceTaint extends TaintTracking::Configuration {
  TmpRceTaint() { this = "TmpRceTaint" }

  override predicate isSource(DataFlow::Node node) { vInput(node.asParameter()) }

  override predicate isSink(DataFlow::Node node) {
    exists(string callChain | shellCommand(node.asExpr(), callChain))
  }

from TmpRceTaint config, DataFlow::PathNode req, DataFlow::PathNode cmdexec
where config.hasFlowPath(req, cmdexec)
select cmdexec.getNode(), req, cmdexec, "<message>"

Taint can not follow ”ttt.tttname().c_str()“

My question:
1.Is there a easyer way to find out where dataflow Interrupt?
2.It is difficult to confirm which nodes need to additional taint. eg:ttt to tttname()? tttname() to tttname_? tttname_ to GetNoArena()?
3.Any way to additional taint but not isAdditionalTaintStep?

thank you in advance for any help
@mrlzh mrlzh added the question Further information is requested label Aug 18, 2021
@RasmusWL RasmusWL added the C++ label Aug 18, 2021
@RasmusWL
Copy link
Member

Hi @mrlzh, I'm not an expert on the C++ libraries, so I'll just answer a few things in general:

1.Is there a easyer way to find out where dataflow Interrupt?

We have a Work-In-Progress guide for how to do this, which you can see in https://github.com/github/codeql/blob/18b82444066ec84b28cbdde71a0af2ba072fb7ab/docs/codeql/writing-codeql-queries/debugging-a-data-flow-query-using-partial-flow.rst -- please do let me know if anything in there is confusing.

3.Any way to additional taint but not isAdditionalTaintStep?

Could you highlight why you don't want to use something else? (For example, that you're writing multiple queries and want the same additional taint steps for all of them)

@mrlzh
Copy link
Author

mrlzh commented Aug 19, 2021

Hi @mrlzh, I'm not an expert on the C++ libraries, so I'll just answer a few things in general:

1.Is there a easyer way to find out where dataflow Interrupt?

We have a Work-In-Progress guide for how to do this, which you can see in https://github.com/github/codeql/blob/18b82444066ec84b28cbdde71a0af2ba072fb7ab/docs/codeql/writing-codeql-queries/debugging-a-data-flow-query-using-partial-flow.rst -- please do let me know if anything in there is confusing.

3.Any way to additional taint but not isAdditionalTaintStep?

Could you highlight why you don't want to use something else? (For example, that you're writing multiple queries and want the same additional taint steps for all of them)

Thanks for help.

About your guide

Function hasPartialFlow is efficient. It shows all sink which source could taint.

Could you highlight why you don't want to use something else?

Protobuf is public used.It is not a good idea to additional in every QL query.A global additional is more useful.
Whether I can defind a model in 'ql/src/semmle/code/cpp/models' directory to achieve？

@RasmusWL
Copy link
Member

If you're want to create a PR for us that introduces this modeling, I'm happy to ask the C++ team where this should be added. 😊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C++ question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@RasmusWL @mrlzh