Skip to content

Commit 5a97a16

Browse files
geoffw0geoffw0
committed
CPP: Autoformat.
1 parent 7b0e83f commit 5a97a16

File tree

3 files changed

+557
-599
lines changed

3 files changed

+557
-599
lines changed

‎cpp/ql/src/Likely Bugs/Protocols/boostorg/TlsSettingsMisconfiguration.ql‎

Lines changed: 95 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -11,114 +11,109 @@ import cpp
1111
import semmle.code.cpp.security.boostorg.asio.protocols
1212

1313
class ExistsAnyFlowConfig extends DataFlow::Configuration {
14-
ExistsAnyFlowConfig() {
15-
this = "ExistsAnyFlowConfig"
16-
}
14+
ExistsAnyFlowConfig() { this = "ExistsAnyFlowConfig" }
1715

18-
override predicate isSource(DataFlow::Node source) {
19-
any()
20-
}
21-
22-
override predicate isSink(DataFlow::Node sink) {
23-
any()
24-
}
16+
override predicate isSource(DataFlow::Node source) { any() }
17+
18+
override predicate isSink(DataFlow::Node sink) { any() }
2519
}
26-
27-
bindingset[flag]
28-
predicate isOptionSet( ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
29-
exists( BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig, Expr optionsSink |
30-
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
31-
exists( VariableAccess contextSetOptions |
32-
testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
33-
(
34-
exists( BoostorgAsio::SslSetOptionsFunction f |
35-
f.getACallToThisFunction() = fcSetOptions |
36-
contextSetOptions = fcSetOptions.getQualifier() and
37-
forall( Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig, Expr optionArgumentSource |
38-
optionArgument = fcSetOptions.getArgument(0) and
39-
optionArgConfig.hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument)) |
40-
optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
41-
)
42-
)
43-
)
20+
21+
bindingset[flag]
22+
predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
23+
exists(
24+
BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig,
25+
Expr optionsSink
26+
|
27+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
28+
exists(VariableAccess contextSetOptions |
29+
testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
30+
exists(BoostorgAsio::SslSetOptionsFunction f | f.getACallToThisFunction() = fcSetOptions |
31+
contextSetOptions = fcSetOptions.getQualifier() and
32+
forall(
33+
Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
34+
Expr optionArgumentSource
35+
|
36+
optionArgument = fcSetOptions.getArgument(0) and
37+
optionArgConfig
38+
.hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
39+
|
40+
optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
4441
)
42+
)
4543
)
44+
)
4645
}
4746

48-
bindingset[flag]
49-
predicate isOptionNotSet( ConstructorCall cc, int flag ) {
50-
not exists( BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig, Expr optionsSink |
51-
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
52-
exists( VariableAccess contextSetOptions |
53-
testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
54-
(
55-
exists( FunctionCall fcSetOptions, BoostorgAsio::SslSetOptionsFunction f |
56-
f.getACallToThisFunction() = fcSetOptions |
57-
contextSetOptions = fcSetOptions.getQualifier() and
58-
forall( Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig, Expr optionArgumentSource |
59-
optionArgument = fcSetOptions.getArgument(0) and
60-
optionArgConfig.hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument)) |
61-
optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
62-
)
63-
)
64-
)
47+
bindingset[flag]
48+
predicate isOptionNotSet(ConstructorCall cc, int flag) {
49+
not exists(
50+
BoostorgAsio::SslContextFlowsToSetOptionConfig config, ExistsAnyFlowConfig testConfig,
51+
Expr optionsSink
52+
|
53+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
54+
exists(VariableAccess contextSetOptions |
55+
testConfig.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(contextSetOptions)) and
56+
exists(FunctionCall fcSetOptions, BoostorgAsio::SslSetOptionsFunction f |
57+
f.getACallToThisFunction() = fcSetOptions
58+
|
59+
contextSetOptions = fcSetOptions.getQualifier() and
60+
forall(
61+
Expr optionArgument, BoostorgAsio::SslOptionConfig optionArgConfig,
62+
Expr optionArgumentSource
63+
|
64+
optionArgument = fcSetOptions.getArgument(0) and
65+
optionArgConfig
66+
.hasFlow(DataFlow::exprNode(optionArgumentSource), DataFlow::exprNode(optionArgument))
67+
|
68+
optionArgument.getValue().toInt().bitShiftRight(16).bitAnd(flag) = flag
6569
)
70+
)
6671
)
72+
)
6773
}
6874

69-
from
70-
BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor,
71-
BoostorgAsio::SslContextFlowsToSetOptionConfig config,
72-
Expr protocolSource, Expr protocolSink,
73-
ConstructorCall cc,
74-
Expr e, string msg
75-
where
76-
configConstructor.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
77-
cc.getArgument(0)= protocolSink and (
78-
(
79-
BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
80-
not exists( Expr optionsSink |
81-
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
82-
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3(), _) and
83-
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
84-
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
85-
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())
86-
)
87-
) or
88-
(
89-
BoostorgAsio::isExprTlsBoostProtocol(protocolSource) and
90-
not BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
91-
not exists( Expr optionsSink |
92-
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
93-
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
94-
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
95-
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())
96-
)
97-
)
98-
) and (
99-
(
100-
BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
101-
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3()) and
102-
e =cc and
103-
msg = "no_sslv3 has not been set"
104-
) or
105-
(
106-
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1()) and
107-
e =cc and
108-
msg = "no_tlsv1 has not been set"
109-
) or
110-
(
111-
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1()) and
112-
e =cc and
113-
msg = "no_tlsv1_1 has not been set"
114-
) or
115-
(
116-
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2(), e) and
117-
msg = "no_tlsv1_2 was set"
118-
)
75+
from
76+
BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor,
77+
BoostorgAsio::SslContextFlowsToSetOptionConfig config, Expr protocolSource, Expr protocolSink,
78+
ConstructorCall cc, Expr e, string msg
79+
where
80+
configConstructor.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
81+
cc.getArgument(0) = protocolSink and
82+
(
83+
BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
84+
not exists(Expr optionsSink |
85+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
86+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3(), _) and
87+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
88+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
89+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())
90+
)
91+
or
92+
BoostorgAsio::isExprTlsBoostProtocol(protocolSource) and
93+
not BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
94+
not exists(Expr optionsSink |
95+
config.hasFlow(DataFlow::exprNode(cc), DataFlow::exprNode(optionsSink)) and
96+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1(), _) and
97+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1(), _) and
98+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2())
11999
)
120-
select cc, "Usage of $@ with protocol $@ is not configured correctly: The option $@.",
121-
cc, "boost::asio::ssl::context::context",
122-
protocolSource, protocolSource.toString(),
123-
e, msg
124-
100+
) and
101+
(
102+
BoostorgAsio::isExprSslV23BoostProtocol(protocolSource) and
103+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoSsl3()) and
104+
e = cc and
105+
msg = "no_sslv3 has not been set"
106+
or
107+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1()) and
108+
e = cc and
109+
msg = "no_tlsv1 has not been set"
110+
or
111+
isOptionNotSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_1()) and
112+
e = cc and
113+
msg = "no_tlsv1_1 has not been set"
114+
or
115+
isOptionSet(cc, BoostorgAsio::getShiftedSslOptionsNoTls1_2(), e) and
116+
msg = "no_tlsv1_2 was set"
117+
)
118+
select cc, "Usage of $@ with protocol $@ is not configured correctly: The option $@.", cc,
119+
"boost::asio::ssl::context::context", protocolSource, protocolSource.toString(), e, msg

‎cpp/ql/src/Likely Bugs/Protocols/boostorg/UseOfDeprecatedHardcodedProtocol.ql‎

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -6,28 +6,22 @@
66
* @id cpp/boost/use-of-deprecated-hardcoded-security-protocol
77
* @tags security
88
*/
9-
9+
1010
import cpp
1111
import semmle.code.cpp.security.boostorg.asio.protocols
1212

13-
from
14-
BoostorgAsio::SslContextCallConfig config,
15-
Expr protocolSource, Expr protocolSink, ConstructorCall cc
16-
where
17-
config.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
18-
not exists( BoostorgAsio::SslContextCallTlsProtocolConfig tlsConfig |
19-
tlsConfig.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink))
20-
) and
21-
cc.getArgument(0) = protocolSink and
22-
(
23-
exists( BoostorgAsio::SslContextCallBannedProtocolConfig bannedConfig |
24-
bannedConfig.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink))
25-
)
26-
)
27-
select
28-
protocolSink,
29-
"Usage of $@ specifying a deprecated hardcoded protocol $@ in function $@.",
30-
cc, "boost::asio::ssl::context::context",
31-
protocolSource, protocolSource.toString(),
32-
cc.getEnclosingFunction(), cc.getEnclosingFunction().toString()
33-
13+
from
14+
BoostorgAsio::SslContextCallConfig config, Expr protocolSource, Expr protocolSink,
15+
ConstructorCall cc
16+
where
17+
config.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink)) and
18+
not exists(BoostorgAsio::SslContextCallTlsProtocolConfig tlsConfig |
19+
tlsConfig.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink))
20+
) and
21+
cc.getArgument(0) = protocolSink and
22+
exists(BoostorgAsio::SslContextCallBannedProtocolConfig bannedConfig |
23+
bannedConfig.hasFlow(DataFlow::exprNode(protocolSource), DataFlow::exprNode(protocolSink))
24+
)
25+
select protocolSink, "Usage of $@ specifying a deprecated hardcoded protocol $@ in function $@.",
26+
cc, "boost::asio::ssl::context::context", protocolSource, protocolSource.toString(),
27+
cc.getEnclosingFunction(), cc.getEnclosingFunction().toString()

0 commit comments

Comments
 (0)