Skip to content

Commit c19c340

Browse files
david-wiggsdavid-wiggs
authored
Merge branch 'main' into main
2 parents 3ab0472 + 2d76b41 commit c19c340

File tree

9 files changed

+586
-132
lines changed

9 files changed

+586
-132
lines changed

‎cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.

‎cpp/ql/lib/ext/Windows.model.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ extensions:
3131
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[*5]", "remote", "manual"]
3232
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[*6]", "remote", "manual"]
3333
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[**8]", "remote", "manual"]
34+
- ["", "", False, "HttpReceiveHttpRequest", "", "", "Argument[*3]", "remote", "manual"]
35+
- ["", "", False, "HttpReceiveRequestEntityBody", "", "", "Argument[*3]", "remote", "manual"]
36+
- ["", "", False, "HttpReceiveClientCertificate", "", "", "Argument[*3]", "remote", "manual"]
3437
- addsTo:
3538
pack: codeql/cpp-all
3639
extensible: summaryModel

‎cpp/ql/lib/semmle/code/cpp/models/Models.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,4 @@ private import implementations.CAtlFileMapping
5757
private import implementations.CAtlTemporaryFile
5858
private import implementations.CRegKey
5959
private import implementations.WinHttp
60+
private import implementations.Http

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Http.qll‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
private import cpp
2+
private import semmle.code.cpp.ir.dataflow.FlowSteps
3+
private import semmle.code.cpp.dataflow.new.DataFlow
4+
5+
private class HttpRequest extends Class {
6+
HttpRequest() { this.hasGlobalName("_HTTP_REQUEST_V1") }
7+
}
8+
9+
private class HttpRequestInheritingContent extends TaintInheritingContent, DataFlow::FieldContent {
10+
HttpRequestInheritingContent() {
11+
this.getAField().getDeclaringType() instanceof HttpRequest and
12+
(
13+
this.getAField().hasName("pRawUrl") and
14+
this.getIndirectionIndex() = 2
15+
or
16+
this.getAField().hasName("CookedUrl") and
17+
this.getIndirectionIndex() = 1
18+
or
19+
this.getAField().hasName("Headers") and
20+
this.getIndirectionIndex() = 1
21+
or
22+
this.getAField().hasName("pEntityChunks") and
23+
this.getIndirectionIndex() = 2
24+
or
25+
this.getAField().hasName("pSslInfo") and
26+
this.getIndirectionIndex() = 2
27+
)
28+
}
29+
}
30+
31+
private class HttpCookedUrl extends Class {
32+
HttpCookedUrl() { this.hasGlobalName("_HTTP_COOKED_URL") }
33+
}
34+
35+
private class HttpCookedUrlInheritingContent extends TaintInheritingContent, DataFlow::FieldContent {
36+
HttpCookedUrlInheritingContent() {
37+
this.getAField().getDeclaringType() instanceof HttpCookedUrl and
38+
this.getAField().hasName(["pFullUrl", "pHost", "pAbsPath", "pQueryString"]) and
39+
this.getIndirectionIndex() = 2
40+
}
41+
}
42+
43+
private class HttpRequestHeaders extends Class {
44+
HttpRequestHeaders() { this.hasGlobalName("_HTTP_REQUEST_HEADERS") }
45+
}
46+
47+
private class HttpRequestHeadersInheritingContent extends TaintInheritingContent,
48+
DataFlow::FieldContent
49+
{
50+
HttpRequestHeadersInheritingContent() {
51+
this.getAField().getDeclaringType() instanceof HttpRequestHeaders and
52+
(
53+
this.getAField().hasName("KnownHeaders") and
54+
this.getIndirectionIndex() = 1
55+
or
56+
this.getAField().hasName("pUnknownHeaders") and
57+
this.getIndirectionIndex() = 2
58+
)
59+
}
60+
}
61+
62+
private class HttpKnownHeader extends Class {
63+
HttpKnownHeader() { this.hasGlobalName("_HTTP_KNOWN_HEADER") }
64+
}
65+
66+
private class HttpKnownHeaderInheritingContent extends TaintInheritingContent,
67+
DataFlow::FieldContent
68+
{
69+
HttpKnownHeaderInheritingContent() {
70+
this.getAField().getDeclaringType() instanceof HttpKnownHeader and
71+
this.getAField().hasName("pRawValue") and
72+
this.getIndirectionIndex() = 2
73+
}
74+
}
75+
76+
private class HttpUnknownHeader extends Class {
77+
HttpUnknownHeader() { this.hasGlobalName("_HTTP_UNKNOWN_HEADER") }
78+
}
79+
80+
private class HttpUnknownHeaderInheritingContent extends TaintInheritingContent,
81+
DataFlow::FieldContent
82+
{
83+
HttpUnknownHeaderInheritingContent() {
84+
this.getAField().getDeclaringType() instanceof HttpUnknownHeader and
85+
this.getAField().hasName(["pName", "pRawValue"]) and
86+
this.getIndirectionIndex() = 2
87+
}
88+
}
89+
90+
private class HttpDataChunk extends Class {
91+
HttpDataChunk() { this.hasGlobalName("_HTTP_DATA_CHUNK") }
92+
}
93+
94+
private class HttpDataChunkInheritingContent extends TaintInheritingContent, DataFlow::FieldContent {
95+
HttpDataChunkInheritingContent() {
96+
this.getAField().getDeclaringType().(Union).getDeclaringType() instanceof HttpDataChunk and
97+
(
98+
this.getAField().hasName("FromMemory") and
99+
this.getIndirectionIndex() = 1
100+
or
101+
this.getAField().hasName("FromFileHandle") and
102+
this.getIndirectionIndex() = 1
103+
or
104+
this.getAField().hasName("FromFragmentCache") and
105+
this.getIndirectionIndex() = 1
106+
or
107+
this.getAField().hasName("FromFragmentCacheEx") and
108+
this.getIndirectionIndex() = 1
109+
or
110+
this.getAField().hasName("Trailers") and
111+
this.getIndirectionIndex() = 1
112+
)
113+
}
114+
}
115+
116+
private class FromMemory extends Class {
117+
FromMemory() {
118+
this.getDeclaringType().(Union).getDeclaringType() instanceof HttpDataChunk and
119+
this.getAField().hasName("pBuffer")
120+
}
121+
}
122+
123+
private class FromMemoryInheritingContent extends TaintInheritingContent, DataFlow::FieldContent {
124+
FromMemoryInheritingContent() {
125+
this.getAField().getDeclaringType() instanceof FromMemory and
126+
this.getAField().hasName("pBuffer") and
127+
this.getIndirectionIndex() = 2
128+
}
129+
}
130+
131+
private class FromFileHandle extends Class {
132+
FromFileHandle() {
133+
this.getDeclaringType().(Union).getDeclaringType() instanceof HttpDataChunk and
134+
this.getAField().hasName("FileHandle")
135+
}
136+
}
137+
138+
private class FromFileHandleInheritingContent extends TaintInheritingContent, DataFlow::FieldContent
139+
{
140+
FromFileHandleInheritingContent() {
141+
this.getAField().getDeclaringType() instanceof FromFileHandle and
142+
this.getIndirectionIndex() = 1 and
143+
this.getAField().hasName("FileHandle")
144+
}
145+
}
146+
147+
private class FromFragmentCacheOrCacheEx extends Class {
148+
FromFragmentCacheOrCacheEx() {
149+
this.getDeclaringType().(Union).getDeclaringType() instanceof HttpDataChunk and
150+
this.getAField().hasName("pFragmentName")
151+
}
152+
}
153+
154+
private class FromFragmentCacheInheritingContent extends TaintInheritingContent,
155+
DataFlow::FieldContent
156+
{
157+
FromFragmentCacheInheritingContent() {
158+
this.getAField().getDeclaringType() instanceof FromFragmentCacheOrCacheEx and
159+
this.getIndirectionIndex() = 2 and
160+
this.getAField().hasName("pFragmentName")
161+
}
162+
}
163+
164+
private class HttpSslInfo extends Class {
165+
HttpSslInfo() { this.hasGlobalName("_HTTP_SSL_INFO") }
166+
}
167+
168+
private class HttpSslInfoInheritingContent extends TaintInheritingContent, DataFlow::FieldContent {
169+
HttpSslInfoInheritingContent() {
170+
this.getAField().getDeclaringType() instanceof HttpSslInfo and
171+
this.getAField().hasName(["pServerCertIssuer", "pServerCertSubject", "pClientCertInfo"]) and
172+
this.getIndirectionIndex() = 2
173+
}
174+
}
175+
176+
private class HttpSslClientCertInfo extends Class {
177+
HttpSslClientCertInfo() { this.hasGlobalName("_HTTP_SSL_CLIENT_CERT_INFO") }
178+
}
179+
180+
private class HttpSslClientCertInfoInheritingContent extends TaintInheritingContent,
181+
DataFlow::FieldContent
182+
{
183+
HttpSslClientCertInfoInheritingContent() {
184+
this.getAField().getDeclaringType() instanceof HttpSslClientCertInfo and
185+
(
186+
this.getAField().hasName("pCertEncoded") and
187+
this.getIndirectionIndex() = 2
188+
or
189+
this.getAField().hasName("Token") and
190+
this.getIndirectionIndex() = 1
191+
)
192+
}
193+
}

0 commit comments

Comments
 (0)