Skip to content

Commit 94afc82

Browse files
committed
Rust: Fix an issue with the local flow.
1 parent a3ed83b commit 94afc82

File tree

4 files changed

+8
-15
lines changed

4 files changed

+8
-15
lines changed

rust/ql/lib/codeql/rust/security/InsecureCookieExtensions.qll

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,13 @@ module InsecureCookie {
6969
// check if the argument is always `true`
7070
(
7171
if
72-
forex(DataFlow::Node argSourceNode | DataFlow::localFlow(argSourceNode, argNode) |
73-
argSourceNode.asExpr().getExpr().(BooleanLiteralExpr).getTextValue() = "true"
72+
forex(DataFlow::Node argSourceNode, BooleanLiteralExpr argSourceValue |
73+
DataFlow::localFlow(argSourceNode, argNode) and
74+
argSourceValue = argSourceNode.asExpr().getExpr() |
75+
argSourceValue.getTextValue() = "true"
7476
)
75-
then value = true // `true` flow to here
76-
else value = false // `false` or unknown
77+
then value = true // `true` flows to here
78+
else value = false // `false`, unknown, or multiple values
7779
) and
7880
// and find the node where this happens
7981
(

rust/ql/test/query-tests/security/CWE-614/CookieSet.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
| main.rs:12:19:12:50 | ...::build(...) | secure | true |
33
| main.rs:20:5:20:36 | ...::build(...) | secure | false |
44
| main.rs:21:5:21:36 | ...::build(...) | secure | false |
5-
| main.rs:24:5:24:36 | ...::build(...) | secure | false |
5+
| main.rs:24:5:24:36 | ...::build(...) | secure | true |
66
| main.rs:25:5:25:36 | ...::build(...) | secure | false |
77
| main.rs:26:5:26:36 | ...::build(...) | secure | false |
88
| main.rs:27:5:27:36 | ...::build(...) | secure | false |

rust/ql/test/query-tests/security/CWE-614/InsecureCookie.expected

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
| main.rs:20:56:20:60 | build | main.rs:20:5:20:36 | ...::build(...) | main.rs:20:56:20:60 | build | Cookie attribute 'Secure' is not set to true. |
77
| main.rs:21:57:21:61 | build | main.rs:21:5:21:17 | ...::build | main.rs:21:57:21:61 | build | Cookie attribute 'Secure' is not set to true. |
88
| main.rs:21:57:21:61 | build | main.rs:21:5:21:36 | ...::build(...) | main.rs:21:57:21:61 | build | Cookie attribute 'Secure' is not set to true. |
9-
| main.rs:24:53:24:57 | build | main.rs:24:5:24:17 | ...::build | main.rs:24:53:24:57 | build | Cookie attribute 'Secure' is not set to true. |
10-
| main.rs:24:53:24:57 | build | main.rs:24:5:24:36 | ...::build(...) | main.rs:24:53:24:57 | build | Cookie attribute 'Secure' is not set to true. |
119
| main.rs:25:54:25:58 | build | main.rs:25:5:25:17 | ...::build | main.rs:25:54:25:58 | build | Cookie attribute 'Secure' is not set to true. |
1210
| main.rs:25:54:25:58 | build | main.rs:25:5:25:36 | ...::build(...) | main.rs:25:54:25:58 | build | Cookie attribute 'Secure' is not set to true. |
1311
| main.rs:26:52:26:56 | build | main.rs:26:5:26:17 | ...::build | main.rs:26:52:26:56 | build | Cookie attribute 'Secure' is not set to true. |
@@ -91,9 +89,6 @@ edges
9189
| main.rs:21:5:21:17 | ...::build | main.rs:21:5:21:36 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
9290
| main.rs:21:5:21:36 | ...::build(...) | main.rs:21:5:21:55 | ... .secure(...) | provenance | MaD:41 |
9391
| main.rs:21:5:21:55 | ... .secure(...) | main.rs:21:57:21:61 | build | provenance | MaD:2 Sink:MaD:2 |
94-
| main.rs:24:5:24:17 | ...::build | main.rs:24:5:24:36 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
95-
| main.rs:24:5:24:36 | ...::build(...) | main.rs:24:5:24:51 | ... .secure(...) | provenance | MaD:41 |
96-
| main.rs:24:5:24:51 | ... .secure(...) | main.rs:24:53:24:57 | build | provenance | MaD:2 Sink:MaD:2 |
9792
| main.rs:25:5:25:17 | ...::build | main.rs:25:5:25:36 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
9893
| main.rs:25:5:25:36 | ...::build(...) | main.rs:25:5:25:52 | ... .secure(...) | provenance | MaD:41 |
9994
| main.rs:25:5:25:52 | ... .secure(...) | main.rs:25:54:25:58 | build | provenance | MaD:2 Sink:MaD:2 |
@@ -374,10 +369,6 @@ nodes
374369
| main.rs:21:5:21:36 | ...::build(...) | semmle.label | ...::build(...) |
375370
| main.rs:21:5:21:55 | ... .secure(...) | semmle.label | ... .secure(...) |
376371
| main.rs:21:57:21:61 | build | semmle.label | build |
377-
| main.rs:24:5:24:17 | ...::build | semmle.label | ...::build |
378-
| main.rs:24:5:24:36 | ...::build(...) | semmle.label | ...::build(...) |
379-
| main.rs:24:5:24:51 | ... .secure(...) | semmle.label | ... .secure(...) |
380-
| main.rs:24:53:24:57 | build | semmle.label | build |
381372
| main.rs:25:5:25:17 | ...::build | semmle.label | ...::build |
382373
| main.rs:25:5:25:36 | ...::build(...) | semmle.label | ...::build(...) |
383374
| main.rs:25:5:25:52 | ... .secure(...) | semmle.label | ... .secure(...) |

rust/ql/test/query-tests/security/CWE-614/main.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ fn test_cookie(sometimes: bool) {
2121
Cookie::build(("name", "value")).secure(!sometimes).build(); // $ Alert[rust/insecure-cookie]
2222

2323
// with data flow on the "secure" value
24-
Cookie::build(("name", "value")).secure(always).build(); // $ SPURIOUS: Alert[rust/insecure-cookie]
24+
Cookie::build(("name", "value")).secure(always).build(); // good
2525
Cookie::build(("name", "value")).secure(!always).build(); // $ Alert[rust/insecure-cookie]
2626
Cookie::build(("name", "value")).secure(never).build(); // $ Alert[rust/insecure-cookie]
2727
Cookie::build(("name", "value")).secure(!never).build(); // $ SPURIOUS: Alert[rust/insecure-cookie]

0 commit comments

Comments
 (0)