Skip to content

Commit 75a2a82

Browse files
kdudkakdudka
committed
parser-cov: further tweaks to key event matching
Resolves: https://issues.redhat.com/browse/OSH-552
1 parent 9dbb09a commit 75a2a82

10 files changed

+187959
-16
lines changed

‎src/lib/parser-cov.cc

+27-8
Original file line numberDiff line numberDiff line change
@@ -241,26 +241,31 @@ KeyEventDigger::KeyEventDigger():
241241
d->hMap["CALL_SUPER"] .insert("missing_super_call");
242242
d->hMap["CHECKED_RETURN"] .insert("check_return");
243243
d->hMap["CHROOT"] .insert("chroot_call");
244+
d->hMap["COM.BAD_FREE"] .insert("free");
244245
d->hMap["CTOR_DTOR_LEAK"] .insert("alloc_fn");
245246
d->hMap["CTOR_DTOR_LEAK"] .insert("alloc_new");
246247
d->hMap["DEADCODE"] .insert("dead_error_begin");
247248
d->hMap["DEADCODE"] .insert("dead_error_line");
248249
d->hMap["EXPLICIT_THIS_EXPECTED"] .insert("implicit_this_used");
249-
d->hMap["HARDCODED_CREDENTIALS"] .insert("sink");
250250
d->hMap["LOCK"] .insert("double_lock");
251251
d->hMap["LOCK"] .insert("double_unlock");
252252
d->hMap["LOCK"] .insert("missing_unlock");
253253
d->hMap["LOCK_EVASION"] .insert("thread1_overwrites_value_in_field");
254254
d->hMap["LOCK_EVASION"] .insert("thread2_checks_field_early");
255+
d->hMap["LOCK_INVERSION"] .insert("lock_order");
256+
d->hMap["INFINITE_LOOP"] .insert("loop_top");
255257
d->hMap["MISSING_BREAK"] .insert("unterminated_case");
256258
d->hMap["MISSING_RESTORE"] .insert("end_of_path");
257259
d->hMap["MISSING_RESTORE"] .insert("end_of_scope");
260+
d->hMap["MISSING_RESTORE"] .insert("exception");
258261
d->hMap["MULTIPLE_INIT_SMART_PTRS"] .insert("multiple_init_smart_ptr");
259262
d->hMap["NESTING_INDENT_MISMATCH"] .insert("actual_if");
260263
d->hMap["NESTING_INDENT_MISMATCH"] .insert("multi_stmt_macro");
261264
d->hMap["NESTING_INDENT_MISMATCH"] .insert("on_same_line");
262265
d->hMap["NESTING_INDENT_MISMATCH"] .insert("uncle");
266+
d->hMap["OPEN_REDIRECT"] .insert("sink");
263267
d->hMap["ORDER_REVERSAL"] .insert("lock_order");
268+
d->hMap["OS_CMD_INJECTION"] .insert("os_cmd_sink");
264269
d->hMap["OVERLAPPING_COPY"] .insert("overlapping_assignment");
265270
d->hMap["OVERLAPPING_COPY"] .insert("overlapping_copy");
266271
d->hMap["OVERRUN_STATIC"] .insert("index_parm");
@@ -271,23 +276,20 @@ KeyEventDigger::KeyEventDigger():
271276
d->hMap["RESOURCE_LEAK"] .insert("overwrite_var");
272277
d->hMap["REVERSE_INULL"] .insert("check_after_deref");
273278
d->hMap["REVERSE_NEGATIVE"] .insert("check_after_sink");
279+
d->hMap["SENSITIVE_DATA_LEAK"] .insert("sink");
280+
d->hMap["SERVLET_ATOMICITY"] .insert("set_attribute");
274281
d->hMap["STREAM_FORMAT_STATE"] .insert("end_of_path");
275-
d->hMap["STRING_OVERFLOW"] .insert("fixed_size_dest");
276282
d->hMap["TAINTED_SCALAR"] .insert("tainted_data");
277283
d->hMap["TOCTOU"] .insert("fs_check_call");
278284
d->hMap["UNEXPECTED_CONTROL_FLOW"] .insert("continue_in_do_while_false");
279285
d->hMap["UNINIT"] .insert("uninit_use");
280286
d->hMap["UNINIT"] .insert("uninit_use_in_call");
281287
d->hMap["UNINIT_CTOR"] .insert("member_not_init_in_gen_ctor");
282288
d->hMap["UNINIT_CTOR"] .insert("uninit_member");
283-
d->hMap["UNUSED_VALUE"] .insert("assigned_pointer");
284-
d->hMap["UNUSED_VALUE"] .insert("assigned_value");
285-
d->hMap["UNUSED_VALUE"] .insert("returned_pointer");
286-
d->hMap["UNUSED_VALUE"] .insert("returned_value");
289+
d->hMap["UNLOCKED_ACCESS"] .insert("thread_unsafe_modification");
287290
d->hMap["VARARGS"] .insert("missing_va_end");
288291
d->hMap["WRAPPER_ESCAPE"] .insert("escape");
289292
d->hMap["WRAPPER_ESCAPE"] .insert("use_after_free");
290-
d->hMap["URL_MANIPULATION"] .insert("url_manipulation_sink");
291293

292294
// we use COMPILER_WARNING as checker for compiler errors/warnings
293295
d->hMap["COMPILER_WARNING"] .insert("error");
@@ -306,17 +308,27 @@ KeyEventDigger::KeyEventDigger():
306308
d->hMap["OWASP_ZAP_WARNING"] .insert("alert");
307309

308310
// list of checkers where we take the _last_ matched key event
311+
d->searchBackwards.insert("COMPILER_WARNING");
309312
d->searchBackwards.insert("CONSTANT_EXPRESSION_RESULT");
313+
d->searchBackwards.insert("DELETE_ARRAY");
310314
d->searchBackwards.insert("FORWARD_NULL");
315+
d->searchBackwards.insert("HARDCODED_CREDENTIALS");
316+
d->searchBackwards.insert("HEADER_INJECTION");
317+
d->searchBackwards.insert("INSUFFICIENT_LOGGING");
311318
d->searchBackwards.insert("LOCK");
312319
d->searchBackwards.insert("INVALIDATE_ITERATOR");
313320
d->searchBackwards.insert("NULL_RETURNS");
314321
d->searchBackwards.insert("OVERRUN");
322+
d->searchBackwards.insert("PATH_MANIPULATION");
315323
d->searchBackwards.insert("RESOURCE_LEAK");
316324
d->searchBackwards.insert("RETURN_LOCAL");
317325
d->searchBackwards.insert("UNINIT");
318326
d->searchBackwards.insert("UNINIT_CTOR");
327+
d->searchBackwards.insert("UNUSED_VALUE");
328+
d->searchBackwards.insert("URL_MANIPULATION");
319329
d->searchBackwards.insert("USE_AFTER_FREE");
330+
d->searchBackwards.insert("VOLATILE_ATOMICITY");
331+
d->searchBackwards.insert("WRITE_CONST_FIELD");
320332

321333
// events that should never be used as key events (excluding trace events)
322334
d->denyList.insert("another_instance");
@@ -409,6 +421,7 @@ bool KeyEventDigger::guessKeyEvent(Defect *def)
409421

410422
// take the first eligible key event
411423
bool valid = false;
424+
bool eligible = false;
412425
for (unsigned idx = 0; idx < evtCount; ++idx) {
413426
const DefEvent &evt = evtList[idx];
414427
if (evt.event == "#")
@@ -421,14 +434,20 @@ bool KeyEventDigger::guessKeyEvent(Defect *def)
421434
valid = true;
422435
}
423436

437+
const bool findLastMatch = d->searchBackwards.count(def->checker);
438+
if (findLastMatch && !eligible)
439+
// no eligible event yet --> select the _last_ valid event
440+
def->keyEventIdx = idx;
441+
424442
// skip trace and deny-listed events
425443
const std::string &evtName = evt.event;
426444
if (d->traceEvts.count(evtName) || d->denyList.count(evtName))
427445
continue;
428446

429447
// matched
430448
def->keyEventIdx = idx;
431-
if (!d->searchBackwards.count(def->checker))
449+
eligible = true;
450+
if (!findLastMatch)
432451
// checker not listed in d->searchBackwards --> take the first match
433452
break;
434453
}

‎tests/csdiff/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -83,5 +83,6 @@ test_csdiff(diff-misc 15-gcc-prof-filter)
8383
test_csdiff(diff-misc 16-cov-parser-key-event)
8484
test_csdiff(diff-misc 17-cov-parser-key-event)
8585
test_csdiff(diff-misc 18-cov-parser-key-event)
86+
test_csdiff(diff-misc 19-cov-parser-key-event)
8687

8788
add_subdirectory(filter-file)

‎tests/csdiff/diff-misc/19-cov-parser-key-event-add-z.err

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
2+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
3+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
4+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
5+
# 300| // don't return errors to maintain backwards compatibility
6+
# 301| }
7+
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
8+
# 303| // allow all connections by default
9+
# 304| return true

‎tests/csdiff/diff-misc/19-cov-parser-key-event-add.err

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
2+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
3+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
4+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
5+
# 300| // don't return errors to maintain backwards compatibility
6+
# 301| }
7+
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
8+
# 303| // allow all connections by default
9+
# 304| return true

‎tests/csdiff/diff-misc/19-cov-parser-key-event-fix-z.err

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
2+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
3+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
4+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
5+
# 300| // don't return errors to maintain backwards compatibility
6+
# 301| }
7+
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
8+
# 303| // allow all connections by default
9+
# 304| return true

‎tests/csdiff/diff-misc/19-cov-parser-key-event-fix.err

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Error: SOCKET_ACCEPT_ALL_ORIGINS (CWE-942):
2+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "function anonymous%1" always returns "true".
3+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: The function "Upgrader.CheckOrigin()" always returns "true" to accept requests from all origins.
4+
grafana-9.2.10/vendor/github.com/gorilla/websocket/server.go:302: go_socketio_all_origins: Modify the "Upgrader.CheckOrigin()" function to only return "true" for trusted origins, or remove the function completely since the default "Upgrader" will only create "WebSocket" connections with clients from the same origin.
5+
# 300| // don't return errors to maintain backwards compatibility
6+
# 301| }
7+
# 302|-> u.CheckOrigin = func(r *http.Request) bool {
8+
# 303| // allow all connections by default
9+
# 304| return true

0 commit comments

Comments
 (0)