remove unused imports, add tests for libarchive

am0o0 · am0o0 · commit 6c97096642db · 2024-09-03T14:16:25.000+02:00
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Brotli.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import semmle.code.cpp.commons.File
 import DecompressionBomb
 
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/Bzip2.qll
@@ -4,12 +4,10 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
 import DecompressionBomb
 
 /**
- * The `BZ2_bzDecompress` function as a Flow source
+ * The `BZ2_bzDecompress` function is used in flow sink
  */
 class BZ2BzDecompressFunction extends DecompressionFunction {
   BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/LibArchive.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import DecompressionBomb
 
 /**
@@ -18,3 +17,17 @@ class Archive_read_data_block extends DecompressionFunction {
 
   override int getArchiveParameterIndex() { result = 0 }
 }
+
+/**
+ * The `archive_read_open_filename` function as a flow step.
+ */
+class ReadOpenFunction extends DecompressionFlowStep {
+  ReadOpenFunction() { this.hasGlobalName("archive_read_open_filename") }
+
+  override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    exists(FunctionCall fc | fc.getTarget() = this |
+      node1.asIndirectExpr() = fc.getArgument(1) and
+      node2.asIndirectExpr() = fc.getArgument(0)
+    )
+  }
+}
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/MiniZip.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import DecompressionBomb
 
 /**
@@ -18,7 +17,7 @@ class Mz_zip_entry extends DecompressionFunction {
 }
 
 /**
- * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow source.
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in flow sink.
  * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
  */
 class Mz_zip_reader_entry extends DecompressionFunction {
@@ -42,7 +41,7 @@ class UnzOpenFunction extends DecompressionFunction {
 }
 
 /**
- * The `mz_zip_reader_open_file` and `mz_zip_reader_open_file_in_memory` functions as a flow source.
+ * The `mz_zip_reader_open_file` and `mz_zip_reader_open_file_in_memory` functions as a flow step.
  */
 class ReaderOpenFunction extends DecompressionFlowStep {
   ReaderOpenFunction() {
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/XZ.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import DecompressionBomb
 
 /**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZSTD.qll
@@ -4,8 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
-import semmle.code.cpp.commons.File
 import DecompressionBomb
 
 /**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibGzopen.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import DecompressionBomb
 
 /**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibInflator.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import DecompressionBomb
 
 /**
diff --git a/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll b/cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll
@@ -4,7 +4,6 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
-import semmle.code.cpp.security.FlowSources
 import DecompressionBomb
 
 /**
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/libarchiveTests.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/libarchiveTests.cpp
@@ -0,0 +1,147 @@
+#define    ARCHIVE_EXTRACT_TIME            (0x0004)
+#define    ARCHIVE_EXTRACT_PERM            (0x0002)
+#define    ARCHIVE_EXTRACT_ACL                (0x0020)
+#define    ARCHIVE_EXTRACT_FFLAGS            (0x0040)
+#define    ARCHIVE_EOF      1    /* Found end of archive. */
+#define    ARCHIVE_OK      0    /* Operation was successful. */
+#define    ARCHIVE_WARN    (-20)    /* Partial success. */
+
+
+int archive_read_next_header(struct archive *a, struct archive_entry **entry) {
+    return 1;
+}
+
+static struct archive *archive_read_new() {
+    return nullptr;
+}
+
+static archive *archive_write_disk_new() {
+    return nullptr;
+}
+
+static void archive_read_support_format_all(archive *pArchive) {
+
+}
+
+static void archive_read_support_filter_all(archive *pArchive) {
+
+}
+
+static void archive_write_disk_set_options(archive *pArchive, int flags) {
+
+}
+
+static void archive_write_disk_set_standard_lookup(archive *pArchive) {
+
+}
+
+static int archive_read_open_filename(archive *pArchive, const char *filename, int i) {}
+
+static void archive_error_string(archive *pArchive) {
+
+}
+
+struct archive_entry {
+};
+
+static int archive_write_header(archive *pArchive, archive_entry *entry) {
+    return 0;
+}
+
+static int archive_entry_size(archive_entry *pEntry) {
+}
+
+typedef int size_t;
+typedef int la_int64_t;
+
+static int archive_read_data_block(archive *pArchive, const void **pVoid, size_t *pInt, la_int64_t *pInt1) {
+    return 0;
+}
+
+static int archive_write_data_block(archive *pArchive, const void *pVoid, size_t size, la_int64_t offset) {
+    return 0;
+}
+
+static int archive_write_finish_entry(archive *pArchive) {
+    return 0;
+}
+
+static void archive_read_close(archive *pArchive) {
+
+}
+
+static void archive_read_free(archive *pArchive) {
+
+}
+
+static void archive_write_close(archive *pArchive) {
+
+}
+
+static void archive_write_free(archive *pArchive) {
+
+}
+
+
+static int copy_data(struct archive *ar, struct archive *aw) {
+    int r;
+    const void *buff;
+    size_t size;
+    la_int64_t offset;
+
+    for (;;) {
+        archive_read_data_block(ar, &buff, &size, &offset);
+        if (r == ARCHIVE_EOF)
+            return (ARCHIVE_OK);
+        if (r < ARCHIVE_OK)
+            return (r);
+        archive_write_data_block(aw, buff, size, offset);
+        if (r < ARCHIVE_OK) {
+            return (r);
+        }
+    }
+}
+
+static void extract(const char *filename) {
+    struct archive *a;
+    struct archive *ext;
+    struct archive_entry *entry;
+    int flags;
+    int r;
+    /* Select which attributes we want to restore. */
+    flags = ARCHIVE_EXTRACT_TIME;
+    flags |= ARCHIVE_EXTRACT_PERM;
+    flags |= ARCHIVE_EXTRACT_ACL;
+    flags |= ARCHIVE_EXTRACT_FFLAGS;
+
+    a = archive_read_new();
+    archive_read_support_format_all(a);
+    archive_read_support_filter_all(a);
+    ext = archive_write_disk_new();
+    archive_write_disk_set_options(ext, flags);
+    archive_write_disk_set_standard_lookup(ext);
+    if ((archive_read_open_filename(a, filename, 10240)))
+        return;
+    for (;;) {
+        archive_read_next_header(a, &entry);
+        archive_write_header(ext, entry);
+        if (archive_entry_size(entry) > 0) {
+            copy_data(a, ext);
+            if (r < ARCHIVE_WARN)
+                break;
+        }
+        archive_write_finish_entry(ext);
+        if (r < ARCHIVE_WARN)
+            break;
+    }
+    archive_read_close(a);
+    archive_read_free(a);
+    archive_write_close(ext);
+    archive_write_free(ext);
+}
+
+
+int main(int argc, const char *argv[]) {
+    extract(argv[1]);
+    return 0;
+}
