github / github/codeql

About c++ CWE-022 example files, CWE-022 ql file does not seem to detect vulnerabilities.

Ouverte
#14,359 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
question
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

**Description of the issue**

### << codeql version >>
CodeQL command-line toolchain release 2.14.6.

### << codeql command test context >>
(a-1) Cloning codeql 'main' branch
`git clone https://github.com/github/codeql.git codeql-main-clone`

(a-2) Use reference c file in the CWE-022 directory
`/home/junseok/workdir/codeql` is my directory path.

/home/junseok/workdir/codeql/**codeql-main-clone/cpp/ql/src/Security/CWE/CWE-022**

CWE-022 directory contains...
TaintedPath.c
TaintedPath.qhelp
TaintedPath.ql

(a-3) Add makefile to the CWE-022 directory for database creation
![image](https://github.com/github/codeql/assets/57557223/68c0394b-f433-4b20-8ce8-f9c036adf302)

<< makefile >>
```
CC = gcc
CFLAGS = -Wall

SRCS=$(wildcard *.c)

OBJS=$(SRCS:.c=.o)

all: $(OBJS)

${OBJS} : %.o: %.c Makefile
-$(CC) $(CFLAGS) -c $<
```

(b-1) database creation
```
codeql database create \
--language=cpp \
--command=make \
--source-root=/home/junseok/workdir/codeql/codeql-main-clone/cpp/ql/src/Security/CWE/CWE-022 \
--overwrite \
/home/junseok/workdir/codeql-database \
--verbosity=errors 2>&1 > build.log

```

(b-2) Print build.log (database creation log file)
```
[2023-10-03 16:08:58] [build-stdout] gcc -Wall -c TaintedPath.c
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c: In function ‘main’:
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:5:21: error: ‘FILENAME_MAX’ undeclared (first use in this function)
[2023-10-03 16:08:58] [build-stderr] char fileBuffer[FILENAME_MAX] = "/home/";
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:5:21: note: each undeclared identifier is reported only once for each function it appears in
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:7:5: error: unknown type name ‘size_t’
[2023-10-03 16:08:58] [build-stderr] size_t len = strlen(fileName);
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:7:5: warning: implicit declaration of function ‘strlen’ [-Wimplicit-function-declaration]
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:7:18: warning: incompatible implicit declaration of built-in function ‘strlen’ [enabled by default]
[2023-10-03 16:08:58] [build-stderr] size_t len = strlen(fileName);
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:8:5: warning: implicit declaration of function ‘strncat’ [-Wimplicit-function-declaration]
[2023-10-03 16:08:58] [build-stderr] strncat(fileName+len, userAndFile, FILENAME_MAX-len-1);
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:8:5: warning: incompatible implicit declaration of built-in function ‘strncat’ [enabled by default]
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:10:5: warning: implicit declaration of function ‘fopen’ [-Wimplicit-function-declaration]
[2023-10-03 16:08:58] [build-stderr] fopen(fileName, "wb+");
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:5:10: warning: unused variable ‘fileBuffer’ [-Wunused-variable]
[2023-10-03 16:08:58] [build-stderr] char fileBuffer[FILENAME_MAX] = "/home/";
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:16:5: error: unknown type name ‘size_t’
[2023-10-03 16:08:58] [build-stderr] size_t len = strlen(fileName);
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:16:18: warning: incompatible implicit declaration of built-in function ‘strlen’ [enabled by default]
[2023-10-03 16:08:58] [build-stderr] size_t len = strlen(fileName);
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:19:5: warning: incompatible implicit declaration of built-in function ‘strncat’ [enabled by default]
[2023-10-03 16:08:58] [build-stderr] strncat(fileName+len, fixed, FILENAME_MAX-len-1);
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:14:10: warning: unused variable ‘fileBuffer’ [-Wunused-variable]
[2023-10-03 16:08:58] [build-stderr] char fileBuffer[FILENAME_MAX] = "/home/";
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] TaintedPath.c:22:1: warning: control reaches end of non-void function [-Wreturn-type]
[2023-10-03 16:08:58] [build-stderr] }
[2023-10-03 16:08:58] [build-stderr] ^
[2023-10-03 16:08:58] [build-stderr] make: [TaintedPath.o] Error 1 (ignored)
```

(c) database analysis
```
codeql database analyze \
/home/junseok/workdir/codeql-database \
--format=csv \
--threads 4 \
--output=/home/junseok/workdir/cpp-ql-cwe-22-output \
/home/junseok/workdir/codeql/codeql-main-clone/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql \
--verbosity=errors

```

(d) output of database analysis
![image](https://github.com/github/codeql/assets/57557223/7b0e18d2-b23d-4c0b-8ef3-c9275131d133)

`cat cpp-ql-cwe-22-output` command shows empty results.

### << Questions >>
Why can't the ql file for CWE-022 detect vulnerabilities in c file for CWE-022?
Is it not detected due to errors that exist during the build process?

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.