C++: Add more registry flow sources and COM-related flow summaries - #22257
Conversation
8634376 to
cbb78ca
Compare
…n target those specifically in queries.
cbb78ca to
05c6fe3
Compare
There was a problem hiding this comment.
🟡 Not ready to approve
Registry value-name flows and wide-character coverage are missing, while the unconstrained StringFromGUID model risks incorrect summaries.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Adds Windows registry-specific flow sources and COM conversion summaries to C++ data-flow modeling.
Changes:
- Introduces
WindowsRegistrySource. - Models
RegEnumValueA/Wand COM conversion flows. - Expands related data-flow tests and expectations.
File summaries
| File | Description |
|---|---|
cpp/ql/lib/ext/Windows.model.yml |
Adds registry and COM models. |
cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll |
Defines the registry source abstraction. |
cpp/ql/test/library-tests/dataflow/external-models/windows.cpp |
Adds model test cases. |
cpp/ql/test/library-tests/dataflow/external-models/steps.expected |
Records expected summary steps. |
cpp/ql/test/library-tests/dataflow/external-models/sources.expected |
Records registry source classifications. |
cpp/ql/test/library-tests/dataflow/external-models/flow.expected |
Records generated flow results. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 5
- Review effort level: Balanced
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
| - ["", "", False, "CLSIDFromProgID", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"] | ||
| - ["", "", False, "CLSIDFromString", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"] | ||
| - ["", "", False, "StringFromCLSID", "", "", "Argument[*0]", "Argument[**1]", "taint", "manual"] | ||
| - ["", "", False, "StringFromGUID", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"] |
There was a problem hiding this comment.
Fixed in 9cf4d07. I have it on good authority that this function exists. But you're right when you say that it's not public. So let's leave it out!
There was a problem hiding this comment.
Summary model is still here.
There was a problem hiding this comment.
Doh. Good catch. Actually removed in a7c1978
This PR does two mostly unrelated changes in one go:
winreg.h#22242As part of (1) I also created a subclass of local flow sources called
WindowsRegistrySourcesimilar to what C# has. This shouldn't cause any semantic breakage since they're still local flow sources.Commit-by-commit review recommended.