Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions cpp/lib/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,10 +1,28 @@
---
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.22
codeql/cpp-all:
version: 0.6.1
version: 6.1.3
codeql/dataflow:
version: 2.0.22
codeql/mad:
version: 1.0.38
codeql/quantum:
version: 0.0.16
codeql/rangeanalysis:
version: 1.0.38
codeql/ssa:
version: 0.0.14
version: 2.0.14
codeql/tutorial:
version: 0.0.7
version: 1.0.38
codeql/typeflow:
version: 1.0.38
codeql/typetracking:
version: 2.0.22
codeql/util:
version: 2.0.25
codeql/xml:
version: 1.0.38
compiled: false
24 changes: 14 additions & 10 deletions cpp/src/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,24 +1,28 @@
---
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.22
codeql/cpp-all:
version: 3.0.0
version: 6.1.3
codeql/dataflow:
version: 1.1.7
version: 2.0.22
codeql/mad:
version: 1.0.13
version: 1.0.38
codeql/quantum:
version: 0.0.16
codeql/rangeanalysis:
version: 1.0.13
version: 1.0.38
codeql/ssa:
version: 1.0.13
version: 2.0.14
codeql/tutorial:
version: 1.0.13
version: 1.0.38
codeql/typeflow:
version: 1.0.13
version: 1.0.38
codeql/typetracking:
version: 1.0.13
version: 2.0.22
codeql/util:
version: 2.0.0
version: 2.0.25
codeql/xml:
version: 1.0.13
version: 1.0.38
compiled: false
24 changes: 14 additions & 10 deletions cpp/test/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,24 +1,28 @@
---
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.22
codeql/cpp-all:
version: 3.0.0
version: 6.1.3
codeql/dataflow:
version: 1.1.7
version: 2.0.22
codeql/mad:
version: 1.0.13
version: 1.0.38
codeql/quantum:
version: 0.0.16
codeql/rangeanalysis:
version: 1.0.13
version: 1.0.38
codeql/ssa:
version: 1.0.13
version: 2.0.14
codeql/tutorial:
version: 1.0.13
version: 1.0.38
codeql/typeflow:
version: 1.0.13
version: 1.0.38
codeql/typetracking:
version: 1.0.13
version: 2.0.22
codeql/util:
version: 2.0.0
version: 2.0.25
codeql/xml:
version: 1.0.13
version: 1.0.38
compiled: false
20 changes: 12 additions & 8 deletions go/src/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,20 +1,24 @@
---
lockVersion: 1.0.0
dependencies:
codeql/concepts:
version: 0.0.12
codeql/controlflow:
version: 2.0.22
codeql/dataflow:
version: 1.1.7
version: 2.0.22
codeql/go-all:
version: 3.0.0
version: 5.0.5
codeql/mad:
version: 1.0.13
version: 1.0.38
codeql/ssa:
version: 1.0.13
version: 2.0.14
codeql/threat-models:
version: 1.0.13
version: 1.0.38
codeql/tutorial:
version: 1.0.13
version: 1.0.38
codeql/typetracking:
version: 1.0.13
version: 2.0.22
codeql/util:
version: 2.0.0
version: 2.0.25
compiled: false
16 changes: 12 additions & 4 deletions go/src/security/MissingMinVersionTLS/MissingMinVersionTLS.ql
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,12 @@ module TlsConfigCreationConfig implements DataFlow::ConfigSig {
/**
* Holds if it is TLS.Config instance (a Variable).
*/
predicate isSink(DataFlow::Node sink) { exists(Variable v | sink.asExpr() = v.getAReference()) }
predicate isSink(DataFlow::Node sink) {
exists(Variable v |
sink.asExpr() = v.getAReference() or
sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr() = v.getAReference()
)
}

/**
* Holds if TLS.Config literal is saved in a structure's field
Expand All @@ -87,13 +92,13 @@ predicate configOrConfigPointer(Type t) {
or
exists(Type tp |
tp.hasQualifiedName("crypto/tls", "Config") and
t.(NamedType).getUnderlyingType().(StructType).hasField(_, tp)
t.(DefinedType).getUnderlyingType().(StructType).hasField(_, tp)
)
or
exists(Type tp, Type tp2 |
tp.hasQualifiedName("crypto/tls", "Config") and
tp2 = tp.getPointerType+() and
t.(NamedType).getUnderlyingType().(StructType).hasField(_, tp2)
t.(DefinedType).getUnderlyingType().(StructType).hasField(_, tp2)
)
}

Expand Down Expand Up @@ -225,7 +230,10 @@ where
// find tls.Config structures with MinVersion not set on the structure initialization
(
TlsConfigCreationFlow::flow(source, sink) and
sink.asExpr() = v.getAReference() and
(
sink.asExpr() = v.getAReference() or
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's challenging that this logic is duplicated in two places. That also made this fix especially hard to track down because the Variable here has to stay in sync with the Variable in isSink 😕.

I can think of a number of improvements here, but I'll save those for a separate PR and another day. Particularly, I would think that this query should be a path-problem query and all the conditions in the where clause should instead be located in the dataflow ConfigSig 🤷‍♂️. Using characteristic predicates for the source/StructLit and sink/Variable may also clear things up.

sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr() = v.getAReference()
) and
source.asExpr() = configStruct
) and
// only explicitely defined, e.g., skip function arguments
Expand Down
20 changes: 12 additions & 8 deletions go/test/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,20 +1,24 @@
---
lockVersion: 1.0.0
dependencies:
codeql/concepts:
version: 0.0.12
codeql/controlflow:
version: 2.0.22
codeql/dataflow:
version: 1.1.7
version: 2.0.22
codeql/go-all:
version: 3.0.0
version: 5.0.5
codeql/mad:
version: 1.0.13
version: 1.0.38
codeql/ssa:
version: 1.0.13
version: 2.0.14
codeql/threat-models:
version: 1.0.13
version: 1.0.38
codeql/tutorial:
version: 1.0.13
version: 1.0.38
codeql/typetracking:
version: 1.0.13
version: 2.0.22
codeql/util:
version: 2.0.0
version: 2.0.25
compiled: false
28 changes: 16 additions & 12 deletions java/src/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,28 +1,32 @@
---
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.22
codeql/dataflow:
version: 1.1.5
version: 2.0.22
codeql/java-all:
version: 4.2.0
version: 7.8.2
codeql/mad:
version: 1.0.11
version: 1.0.38
codeql/quantum:
version: 0.0.16
codeql/rangeanalysis:
version: 1.0.11
version: 1.0.38
codeql/regex:
version: 1.0.11
version: 1.0.38
codeql/ssa:
version: 1.0.11
version: 2.0.14
codeql/threat-models:
version: 1.0.11
version: 1.0.38
codeql/tutorial:
version: 1.0.11
version: 1.0.38
codeql/typeflow:
version: 1.0.11
version: 1.0.38
codeql/typetracking:
version: 1.0.11
version: 2.0.22
codeql/util:
version: 1.0.11
version: 2.0.25
codeql/xml:
version: 1.0.11
version: 1.0.38
compiled: false
28 changes: 16 additions & 12 deletions java/test/codeql-pack.lock.yml
Original file line number Diff line number Diff line change
@@ -1,28 +1,32 @@
---
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.22
codeql/dataflow:
version: 1.1.5
version: 2.0.22
codeql/java-all:
version: 4.2.0
version: 7.8.2
codeql/mad:
version: 1.0.11
version: 1.0.38
codeql/quantum:
version: 0.0.16
codeql/rangeanalysis:
version: 1.0.11
version: 1.0.38
codeql/regex:
version: 1.0.11
version: 1.0.38
codeql/ssa:
version: 1.0.11
version: 2.0.14
codeql/threat-models:
version: 1.0.11
version: 1.0.38
codeql/tutorial:
version: 1.0.11
version: 1.0.38
codeql/typeflow:
version: 1.0.11
version: 1.0.38
codeql/typetracking:
version: 1.0.11
version: 2.0.22
codeql/util:
version: 1.0.11
version: 2.0.25
codeql/xml:
version: 1.0.11
version: 1.0.38
compiled: false