cpp: model BDE bdlbb::Blob byte-buffer taint flow #22455
+183
−2
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * Added flow summaries for the BDE `bdlbb::Blob` segmented byte buffer (`BloombergLP::bdlbb`). Taint now flows from a blob to its bytes through the `Blob::buffer`/`BlobBuffer::data` accessor chain and through the `bdlbb::BlobUtil::copy` and `getContiguousRangeOrCopy` helpers, so a blob populated from untrusted input (for example a BlazingMQ message body read via `bmqa::Message::getData`) is tracked into the payload bytes. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,20 @@ | ||||||||||
| # Model of the BDE bdlbb::Blob segmented byte buffer (BloombergLP::bdlbb). | ||||||||||
| # Lets taint reach a blob's payload bytes, e.g. a message body filled by bmqa::Message::getData. | ||||||||||
| extensions: | ||||||||||
| - addsTo: | ||||||||||
| pack: codeql/cpp-all | ||||||||||
| extensible: summaryModel | ||||||||||
| data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance | ||||||||||
| # Accessor chain: a tainted blob taints its buffers, and a tainted buffer taints its bytes. | ||||||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||||
| - ["BloombergLP::bdlbb", "Blob", true, "buffer", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] | ||||||||||
| - ["BloombergLP::bdlbb", "BlobBuffer", true, "data", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] | ||||||||||
|
Contributor
There was a problem hiding this comment. I think we at least want to add |
||||||||||
| # BlobUtil read-out: the source blob (Argument[*1]) taints the destination buffer (and the | ||||||||||
| # returned contiguous range). | ||||||||||
|
Comment on lines
+11
to
+12
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||||
| - ["BloombergLP::bdlbb", "BlobUtil", true, "copy", "(char *,const Blob &,int,int)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"] | ||||||||||
| - ["BloombergLP::bdlbb", "BlobUtil", true, "getContiguousRangeOrCopy", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"] | ||||||||||
| - ["BloombergLP::bdlbb", "BlobUtil", true, "getContiguousRangeOrCopy", "", "", "Argument[*1]", "ReturnValue[*]", "taint", "manual"] | ||||||||||
| # BlobUtil write-in: the source (Argument[*2]) taints the destination blob. `copy` has two | ||||||||||
| # write-in overloads, one taking a raw byte buffer and one taking another blob as the source; | ||||||||||
| # each row pins the exact signature so the int offset/length arguments are never tainted. | ||||||||||
|
Comment on lines
+16
to
+18
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||||
| - ["BloombergLP::bdlbb", "BlobUtil", true, "copy", "(Blob *,int,const char *,int)", "", "Argument[*2]", "Argument[*0]", "taint", "manual"] | ||||||||||
| - ["BloombergLP::bdlbb", "BlobUtil", true, "copy", "(Blob *,int,const Blob &,int,int)", "", "Argument[*2]", "Argument[*0]", "taint", "manual"] | ||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
|
|
||
| // --- stub library headers --- | ||
|
|
||
| namespace bsl { | ||
| typedef unsigned long size_t; | ||
| template <class T> class allocator {}; | ||
| template<class charT> struct char_traits {}; | ||
| template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> > | ||
| class basic_string { | ||
| public: | ||
| basic_string(const charT* s, const Allocator& a = Allocator()); | ||
| const charT* data() const; | ||
| size_t size() const; | ||
| }; | ||
| typedef basic_string<char> string; | ||
| } | ||
|
|
||
| namespace BloombergLP { | ||
| namespace bdlbb { | ||
| class BlobBuffer { | ||
| public: | ||
| char *data() const; | ||
| }; | ||
|
|
||
| class Blob { | ||
| public: | ||
| const BlobBuffer &buffer(int index) const; | ||
| }; | ||
|
|
||
| struct BlobUtil { | ||
| static void copy(char *dstBuffer, const Blob &srcBlob, int position, int length); | ||
| static void copy(Blob *dstBlob, int dstOffset, const char *srcBuffer, int length); | ||
| static void copy(Blob *dstBlob, int dstOffset, const Blob &srcBlob, int srcOffset, | ||
| int length); | ||
| static char *getContiguousRangeOrCopy(char *dstBuffer, const Blob &srcBlob, int position, | ||
| int length, int alignment); | ||
| }; | ||
| } | ||
| } | ||
|
|
||
| // --- test code --- | ||
|
|
||
| char *source(); | ||
| void sink(char); | ||
|
|
||
| // A blob populated from a tainted buffer taints the bytes read back out of it. | ||
| void test_BlobUtil_copy() { | ||
| bsl::string s(source()); | ||
| BloombergLP::bdlbb::Blob blob; | ||
| BloombergLP::bdlbb::BlobUtil::copy(&blob, 0, s.data(), s.size()); | ||
| char dst[16]; | ||
| BloombergLP::bdlbb::BlobUtil::copy(dst, blob, 0, 16); | ||
| sink(*dst); // $ ir | ||
| } | ||
|
|
||
| void test_accessor_chain() { | ||
| bsl::string s(source()); | ||
| BloombergLP::bdlbb::Blob blob; | ||
| BloombergLP::bdlbb::BlobUtil::copy(&blob, 0, s.data(), s.size()); | ||
| const char *p = blob.buffer(0).data(); | ||
| sink(*p); // $ ir | ||
| } | ||
|
|
||
| void test_getContiguousRangeOrCopy() { | ||
| bsl::string s(source()); | ||
| BloombergLP::bdlbb::Blob blob; | ||
| BloombergLP::bdlbb::BlobUtil::copy(&blob, 0, s.data(), s.size()); | ||
| char dst[16]; | ||
| char *r = BloombergLP::bdlbb::BlobUtil::getContiguousRangeOrCopy(dst, blob, 0, 16, 1); | ||
| sink(*r); // $ ir | ||
| } | ||
|
|
||
| // A blob copied into another blob carries the taint across. | ||
| void test_BlobUtil_copy_blob_to_blob() { | ||
| bsl::string s(source()); | ||
| BloombergLP::bdlbb::Blob src; | ||
| BloombergLP::bdlbb::BlobUtil::copy(&src, 0, s.data(), s.size()); | ||
| BloombergLP::bdlbb::Blob dst; | ||
| BloombergLP::bdlbb::BlobUtil::copy(&dst, 0, src, 0, 16); | ||
| char out[16]; | ||
| BloombergLP::bdlbb::BlobUtil::copy(out, dst, 0, 16); | ||
| sink(*out); // $ ir | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would again shorten this.