Skip to content

Commit d0b3dd5

Browse files
kumarakkumarak
committed
fix(cpp): correct protobuf string parse models and expand test coverage
1 parent 5f0b3df commit d0b3dd5

5 files changed

Lines changed: 233 additions & 90 deletions

File tree

‎cpp/ql/lib/ext/Protobuf.model.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,18 @@ extensions:
99
# File-descriptor variants (`{Parse,Serialize}*FromFileDescriptor`) are intentionally omitted:
1010
# the descriptor is an `int`, not a data buffer, so there is no buffer argument to model.
1111

12-
# Deserialization: the encoded input (`Argument[*0]`) taints the message (`this`).
13-
- ["google::protobuf", "MessageLite", True, "ParseFromString", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
14-
- ["google::protobuf", "MessageLite", True, "ParsePartialFromString", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
15-
- ["google::protobuf", "MessageLite", True, "MergeFromString", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
16-
- ["google::protobuf", "MessageLite", True, "MergePartialFromString", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
12+
# Deserialization: the encoded input taints the message (`this`). The `*FromString` methods each
13+
# have a `string_view` overload (the buffer is the by-value argument, so `Argument[0]`) and a
14+
# `const Cord &` overload (the buffer is behind a reference, so `Argument[*0]`). The remaining
15+
# inputs below are pointers or references, so they take `Argument[*0]`.
16+
- ["google::protobuf", "MessageLite", True, "ParseFromString", "(string_view)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
17+
- ["google::protobuf", "MessageLite", True, "ParseFromString", "(const Cord &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
18+
- ["google::protobuf", "MessageLite", True, "ParsePartialFromString", "(string_view)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
19+
- ["google::protobuf", "MessageLite", True, "ParsePartialFromString", "(const Cord &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
20+
- ["google::protobuf", "MessageLite", True, "MergeFromString", "(string_view)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
21+
- ["google::protobuf", "MessageLite", True, "MergeFromString", "(const Cord &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
22+
- ["google::protobuf", "MessageLite", True, "MergePartialFromString", "(string_view)", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
23+
- ["google::protobuf", "MessageLite", True, "MergePartialFromString", "(const Cord &)", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
1724
- ["google::protobuf", "MessageLite", True, "ParseFromArray", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
1825
- ["google::protobuf", "MessageLite", True, "ParsePartialFromArray", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
1926
- ["google::protobuf", "MessageLite", True, "ParseFromCord", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]

‎cpp/ql/test/library-tests/dataflow/external-models/flow.expected‎

Lines changed: 34 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,8 @@ models
9797
| 96 | Summary: Azure; Nullable; true; Value; ; ; Argument[-1]; ReturnValue[*]; taint; manual |
9898
| 97 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
9999
| 98 | Summary: google::protobuf; MessageLite; true; ParseFromArray; ; ; Argument[*0]; Argument[-1]; taint; manual |
100-
| 99 | Summary: google::protobuf; MessageLite; true; ParseFromString; ; ; Argument[*0]; Argument[-1]; taint; manual |
101-
| 100 | Summary: google::protobuf; MessageLite; true; SerializeAsString; ; ; Argument[-1]; ReturnValue; taint; manual |
102-
| 101 | Summary: google::protobuf; MessageLite; true; SerializeToArray; ; ; Argument[-1]; Argument[*0]; taint; manual |
100+
| 99 | Summary: google::protobuf; MessageLite; true; SerializeAsString; ; ; Argument[-1]; ReturnValue; taint; manual |
101+
| 100 | Summary: google::protobuf; MessageLite; true; SerializeToArray; ; ; Argument[-1]; Argument[*0]; taint; manual |
103102
edges
104103
| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:56 |
105104
| asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | recv_buffer | provenance | Src:MaD:56 Sink:MaD:4 |
@@ -148,26 +147,21 @@ edges
148147
| azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance | |
149148
| azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance | |
150149
| azure.cpp:295:10:295:20 | contentType | azure.cpp:295:10:295:20 | contentType | provenance | |
151-
| protobuf.cpp:75:33:75:40 | call to source | protobuf.cpp:76:22:76:25 | *data | provenance | TaintFunction |
152-
| protobuf.cpp:76:2:76:4 | ParseFromString output argument | protobuf.cpp:78:2:78:4 | *msg | provenance | |
153-
| protobuf.cpp:76:22:76:25 | *data | protobuf.cpp:76:2:76:4 | ParseFromString output argument | provenance | MaD:99 |
154-
| protobuf.cpp:78:2:78:4 | *msg | protobuf.cpp:78:23:78:25 | SerializeToArray output argument | provenance | MaD:101 |
155-
| protobuf.cpp:78:23:78:25 | SerializeToArray output argument | protobuf.cpp:79:7:79:10 | * ... | provenance | |
156-
| protobuf.cpp:84:33:84:40 | call to source | protobuf.cpp:85:21:85:31 | *call to data | provenance | TaintFunction |
157-
| protobuf.cpp:85:2:85:4 | ParseFromArray output argument | protobuf.cpp:87:2:87:4 | *msg | provenance | |
158-
| protobuf.cpp:85:21:85:31 | *call to data | protobuf.cpp:85:2:85:4 | ParseFromArray output argument | provenance | MaD:98 |
159-
| protobuf.cpp:87:2:87:4 | *msg | protobuf.cpp:87:23:87:25 | SerializeToArray output argument | provenance | MaD:101 |
160-
| protobuf.cpp:87:23:87:25 | SerializeToArray output argument | protobuf.cpp:88:7:88:10 | * ... | provenance | |
161-
| protobuf.cpp:95:33:95:40 | call to source | protobuf.cpp:96:22:96:25 | *data | provenance | TaintFunction |
162-
| protobuf.cpp:96:2:96:4 | ParseFromString output argument | protobuf.cpp:98:23:98:25 | *msg | provenance | |
163-
| protobuf.cpp:96:22:96:25 | *data | protobuf.cpp:96:2:96:4 | ParseFromString output argument | provenance | MaD:99 |
164-
| protobuf.cpp:98:2:98:5 | ParseFromString output argument | protobuf.cpp:100:2:100:5 | *msg2 | provenance | |
165-
| protobuf.cpp:98:23:98:25 | *msg | protobuf.cpp:98:27:98:43 | call to SerializeAsString | provenance | MaD:100 |
166-
| protobuf.cpp:98:23:98:45 | call to SerializeAsString | protobuf.cpp:98:2:98:5 | ParseFromString output argument | provenance | MaD:99 |
167-
| protobuf.cpp:98:27:98:43 | call to SerializeAsString | protobuf.cpp:98:23:98:45 | call to SerializeAsString | provenance | |
168-
| protobuf.cpp:98:27:98:43 | call to SerializeAsString | protobuf.cpp:98:27:98:43 | call to SerializeAsString | provenance | |
169-
| protobuf.cpp:100:2:100:5 | *msg2 | protobuf.cpp:100:24:100:26 | SerializeToArray output argument | provenance | MaD:101 |
170-
| protobuf.cpp:100:24:100:26 | SerializeToArray output argument | protobuf.cpp:101:7:101:10 | * ... | provenance | |
150+
| protobuf.cpp:140:33:140:40 | call to source | protobuf.cpp:141:21:141:31 | *call to data | provenance | TaintFunction |
151+
| protobuf.cpp:141:2:141:4 | ParseFromArray output argument | protobuf.cpp:143:2:143:4 | *msg | provenance | |
152+
| protobuf.cpp:141:21:141:31 | *call to data | protobuf.cpp:141:2:141:4 | ParseFromArray output argument | provenance | MaD:98 |
153+
| protobuf.cpp:143:2:143:4 | *msg | protobuf.cpp:143:23:143:25 | SerializeToArray output argument | provenance | MaD:100 |
154+
| protobuf.cpp:143:23:143:25 | SerializeToArray output argument | protobuf.cpp:144:7:144:10 | * ... | provenance | |
155+
| protobuf.cpp:151:33:151:40 | call to source | protobuf.cpp:152:21:152:31 | *call to data | provenance | TaintFunction |
156+
| protobuf.cpp:152:2:152:4 | ParseFromArray output argument | protobuf.cpp:153:18:153:20 | *msg | provenance | |
157+
| protobuf.cpp:152:21:152:31 | *call to data | protobuf.cpp:152:2:152:4 | ParseFromArray output argument | provenance | MaD:98 |
158+
| protobuf.cpp:153:18:153:20 | *msg | protobuf.cpp:153:22:153:38 | call to SerializeAsString | provenance | MaD:99 |
159+
| protobuf.cpp:153:22:153:38 | call to SerializeAsString | protobuf.cpp:153:22:153:38 | call to SerializeAsString | provenance | |
160+
| protobuf.cpp:153:22:153:38 | call to SerializeAsString | protobuf.cpp:155:22:155:29 | *call to data | provenance | TaintFunction |
161+
| protobuf.cpp:155:2:155:5 | ParseFromArray output argument | protobuf.cpp:157:2:157:5 | *msg2 | provenance | |
162+
| protobuf.cpp:155:22:155:29 | *call to data | protobuf.cpp:155:2:155:5 | ParseFromArray output argument | provenance | MaD:98 |
163+
| protobuf.cpp:157:2:157:5 | *msg2 | protobuf.cpp:157:24:157:26 | SerializeToArray output argument | provenance | MaD:100 |
164+
| protobuf.cpp:157:24:157:26 | SerializeToArray output argument | protobuf.cpp:158:7:158:10 | * ... | provenance | |
171165
| test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance | |
172166
| test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance | |
173167
| test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:48 |
@@ -556,29 +550,23 @@ nodes
556550
| azure.cpp:295:10:295:20 | contentType | semmle.label | contentType |
557551
| azure.cpp:295:10:295:20 | contentType | semmle.label | contentType |
558552
| azure.cpp:295:10:295:20 | contentType | semmle.label | contentType |
559-
| protobuf.cpp:75:33:75:40 | call to source | semmle.label | call to source |
560-
| protobuf.cpp:76:2:76:4 | ParseFromString output argument | semmle.label | ParseFromString output argument |
561-
| protobuf.cpp:76:22:76:25 | *data | semmle.label | *data |
562-
| protobuf.cpp:78:2:78:4 | *msg | semmle.label | *msg |
563-
| protobuf.cpp:78:23:78:25 | SerializeToArray output argument | semmle.label | SerializeToArray output argument |
564-
| protobuf.cpp:79:7:79:10 | * ... | semmle.label | * ... |
565-
| protobuf.cpp:84:33:84:40 | call to source | semmle.label | call to source |
566-
| protobuf.cpp:85:2:85:4 | ParseFromArray output argument | semmle.label | ParseFromArray output argument |
567-
| protobuf.cpp:85:21:85:31 | *call to data | semmle.label | *call to data |
568-
| protobuf.cpp:87:2:87:4 | *msg | semmle.label | *msg |
569-
| protobuf.cpp:87:23:87:25 | SerializeToArray output argument | semmle.label | SerializeToArray output argument |
570-
| protobuf.cpp:88:7:88:10 | * ... | semmle.label | * ... |
571-
| protobuf.cpp:95:33:95:40 | call to source | semmle.label | call to source |
572-
| protobuf.cpp:96:2:96:4 | ParseFromString output argument | semmle.label | ParseFromString output argument |
573-
| protobuf.cpp:96:22:96:25 | *data | semmle.label | *data |
574-
| protobuf.cpp:98:2:98:5 | ParseFromString output argument | semmle.label | ParseFromString output argument |
575-
| protobuf.cpp:98:23:98:25 | *msg | semmle.label | *msg |
576-
| protobuf.cpp:98:23:98:45 | call to SerializeAsString | semmle.label | call to SerializeAsString |
577-
| protobuf.cpp:98:27:98:43 | call to SerializeAsString | semmle.label | call to SerializeAsString |
578-
| protobuf.cpp:98:27:98:43 | call to SerializeAsString | semmle.label | call to SerializeAsString |
579-
| protobuf.cpp:100:2:100:5 | *msg2 | semmle.label | *msg2 |
580-
| protobuf.cpp:100:24:100:26 | SerializeToArray output argument | semmle.label | SerializeToArray output argument |
581-
| protobuf.cpp:101:7:101:10 | * ... | semmle.label | * ... |
553+
| protobuf.cpp:140:33:140:40 | call to source | semmle.label | call to source |
554+
| protobuf.cpp:141:2:141:4 | ParseFromArray output argument | semmle.label | ParseFromArray output argument |
555+
| protobuf.cpp:141:21:141:31 | *call to data | semmle.label | *call to data |
556+
| protobuf.cpp:143:2:143:4 | *msg | semmle.label | *msg |
557+
| protobuf.cpp:143:23:143:25 | SerializeToArray output argument | semmle.label | SerializeToArray output argument |
558+
| protobuf.cpp:144:7:144:10 | * ... | semmle.label | * ... |
559+
| protobuf.cpp:151:33:151:40 | call to source | semmle.label | call to source |
560+
| protobuf.cpp:152:2:152:4 | ParseFromArray output argument | semmle.label | ParseFromArray output argument |
561+
| protobuf.cpp:152:21:152:31 | *call to data | semmle.label | *call to data |
562+
| protobuf.cpp:153:18:153:20 | *msg | semmle.label | *msg |
563+
| protobuf.cpp:153:22:153:38 | call to SerializeAsString | semmle.label | call to SerializeAsString |
564+
| protobuf.cpp:153:22:153:38 | call to SerializeAsString | semmle.label | call to SerializeAsString |
565+
| protobuf.cpp:155:2:155:5 | ParseFromArray output argument | semmle.label | ParseFromArray output argument |
566+
| protobuf.cpp:155:22:155:29 | *call to data | semmle.label | *call to data |
567+
| protobuf.cpp:157:2:157:5 | *msg2 | semmle.label | *msg2 |
568+
| protobuf.cpp:157:24:157:26 | SerializeToArray output argument | semmle.label | SerializeToArray output argument |
569+
| protobuf.cpp:158:7:158:10 | * ... | semmle.label | * ... |
582570
| test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | semmle.label | *ymlStepGenerated_with_body |
583571
| test.cpp:7:47:7:52 | value2 | semmle.label | value2 |
584572
| test.cpp:7:64:7:69 | value2 | semmle.label | value2 |

0 commit comments

Comments
 (0)