C++: Fix false positives around terminal output.

Author: geoffw0

cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql

@@ -16,6 +16,7 @@ import semmle.code.cpp.security.SensitiveExprs
 import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.models.interfaces.FlowSource
+import semmle.code.cpp.commons.File
 import DataFlow::PathGraph
 
 /**
@@ -143,6 +144,13 @@ abstract class NetworkSendRecv extends FunctionCall {
           v.getTarget().getName() = ["stdin", "stdout", "stderr"] and
           g = globalValueNumber(v)
         )
+        or
+        // open of `"/dev/tty"`
+        exists(FunctionCall fc |
+          fopenCall(fc) and
+          fc.getAnArgument().getValue() = "/dev/tty" and
+          g = globalValueNumber(fc)
+        )
         // (this is not exhaustive)
       )
     )

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

@@ -90,7 +90,6 @@ edges
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:16:400:23 | password |
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:33:400:40 | password |
 | test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password |
-| test3.cpp:448:7:448:14 | password | test3.cpp:452:10:452:17 | password |
 | test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:21:48:27 | call to encrypt |
 | test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:29:48:39 | thePassword |
 | test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:21:76:27 | call to encrypt |
@@ -212,8 +211,6 @@ nodes
 | test3.cpp:400:33:400:40 | password | semmle.label | password |
 | test3.cpp:429:7:429:14 | password | semmle.label | password |
 | test3.cpp:431:8:431:15 | password | semmle.label | password |
-| test3.cpp:448:7:448:14 | password | semmle.label | password |
-| test3.cpp:452:10:452:17 | password | semmle.label | password |
 | test.cpp:41:23:41:43 | cleartext password! | semmle.label | cleartext password! |
 | test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
 | test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
@@ -245,4 +242,3 @@ subpaths
 | test3.cpp:341:4:341:7 | call to recv | test3.cpp:339:9:339:16 | password | test3.cpp:341:16:341:23 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:339:9:339:16 | password | password |
 | test3.cpp:388:3:388:6 | call to recv | test3.cpp:386:8:386:15 | password | test3.cpp:388:15:388:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:386:8:386:15 | password | password |
 | test3.cpp:431:2:431:6 | call to fgets | test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:429:7:429:14 | password | password |
-| test3.cpp:452:2:452:5 | call to recv | test3.cpp:448:7:448:14 | password | test3.cpp:452:10:452:17 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:448:7:448:14 | password | password |

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

@@ -449,5 +449,5 @@ void test_tty()
 	int f;
 
 	f = open("/dev/tty", val());
-	recv(f, password, 256, val()); // GOOD: from terminal [FALSE POSITIVE]
+	recv(f, password, 256, val()); // GOOD: from terminal
 }