8000 Introduce the security-experimental CodeQL suite and experimental tag by turbo · Pull Request #11702 · github/codeql · GitHub
[go: up one dir, main page]
Skip to content

Introduce the security-experimental CodeQL suite and experimental tag #11702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jan 11, 2023
Merged

Introduce the security-experimental CodeQL suite and experimental tag #11702

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4ec401a
Tag all security queries in supported languages' experimental directo…
turbo Dec 14, 2022
b35a1d4
Adjust docs referring to experimental queries to include details on n…
turbo Dec 14, 2022
5fd5ebc
Create security-experimental suite helper and all language suite impl…
turbo Dec 14, 2022
1e5426f
Create security-experimental suite helper and all language suite impl…
turbo Dec 14, 2022
b7c3373
Merge remote-tracking branch 'origin/turbo/experimental/combined' int…
turbo Dec 18, 2022
d1d4163
Exclude cpp/wrong-use-of-the-umask
turbo Dec 18, 2022
c3116b3
Merge branch 'main' into turbo/experimental/combined
turbo Jan 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ If you have an idea for a query that you would like to share with other CodeQL u

Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose.
- Experimental queries and libraries are stored in the `experimental` subdirectory within each language-specific directory in the [CodeQL repository](https://github.com/github/codeql). For example, experimental Java queries and libraries are stored in `java/ql/src/experimental` and any corresponding tests in `java/ql/test/experimental`.
- Experimental queries need to include `experimental` in their `@tags`
- The structure of an `experimental` subdirectory mirrors the structure of its parent directory.
- Select or create an appropriate directory in `experimental` based on the existing directory structure of `experimental` or its parent directory.

Expand Down
9 changes: 9 additions & 0 deletions cpp/ql/src/codeql-suites/cpp-security-experimental.qls
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
- description: Extended and experimental security queries for C and C++
- queries: .
- apply: security-experimental-selectors.yml
from: codeql/suite-helpers
- apply: codeql-suites/exclude-slow-queries.yml
# Excluding problematically slow experimental queries
- exclude:
query path:
- experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @id cpp/off-by-one-array-access
* @tags reliability
* security
* experimental
*/

import cpp
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Likely Bugs/OverrunWriteProductFlow.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @id cpp/overrun-write
* @tags reliability
* security
* experimental
* external/cwe/cwe-119
* external/cwe/cwe-131
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Likely Bugs/RedundantNullCheckParam.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
* @tags reliability
* security
* external/cwe/cwe-476
* experimental
*/

import cpp
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-20
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
* @problem.severity warning
* @security-severity 7.5
* @tags security
* experimental
* external/cwe/cwe-020
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision high
* @id cpp/wordexp-injection
* @tags security
* experimental
* external/cwe/cwe-078
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @tags correctness
* maintainability
* security
* experimental
* external/cwe/cwe-1041
*/

Expand Down
1 change: 1 addition & 0 deletions ...src/experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-1126
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @id cpp/memory-unsafe-function-scan
* @tags reliability
* security
* experimental
* external/cwe/cwe-120
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-125
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @precision low
* @tags security
* correctness
* experimental
* external/cwe/cwe-190
* external/cwe/cwe-128
* @id cpp/multiplication-overflow-in-alloc
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-190
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @id cpp/constant-array-overflow
* @tags reliability
* security
* experimental
*/

import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysis
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @id cpp/invalid-pointer-deref
* @tags reliability
* security
* experimental
* external/cwe/cwe-119
* external/cwe/cwe-125
* external/cwe/cwe-193
Expand Down
1 change: 1 addition & 0 deletions ...ql/src/experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @tags correctness
* maintainability
* security
* experimental
* external/cwe/cwe-200
* external/cwe/cwe-264
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-243
* external/cwe/cwe-252
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @tags correctness
* maintainability
* security
* experimental
* external/cwe/cwe-266
* external/cwe/cwe-264
* external/cwe/cwe-200
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-273/PrivilegeDroppingOutoforder.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @problem.severity recommendation
* @id cpp/drop-linux-privileges-outoforder
* @tags security
* experimental
* external/cwe/cwe-273
* @precision medium
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-285/PamAuthorization.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
* @problem.severity error
* @id cpp/pam-auth-bypass
* @tags security
* experimental
* external/cwe/cwe-285
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @problem.severity error
* @id cpp/private-cleartext-write
* @tags security
* experimental
* external/cwe/cwe-359
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE- 10000 362/double-fetch.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
* @problem.severity warning
* @security-severity 7.5
* @tags security
* experimental
* external/cwe/cwe-362
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-377
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-401
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-415/DoubleFree.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @problem.severity warning
* @precision medium
* @tags security
* experimental
* external/cwe/cwe-415
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-476
* external/cwe/cwe-415
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-561
* external/cwe/cwe-691
* external/cwe/cwe-478
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-670
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-675/DoubleRelease.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @problem.severity warning
* @precision medium
* @tags security
* experimental
* external/cwe/cwe-675
* external/cwe/cwe-666
*/
Expand Down
1 change: 1 addition & 0 deletions ...rimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-691
*/

Expand Down
1 change: 1 addition & 0 deletions ...erimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-691
*/

Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-703
* external/cwe/cwe-248
* external/cwe/cwe-390
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-754
* external/cwe/cwe-908
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @problem.severity warning
* @precision medium
* @tags security
* experimental
* external/cwe/cwe-758
*/

Expand Down
1 change: 1 addition & 0 deletions ...tal/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision medium
* @tags maintainability
* readability
* experimental
* external/cwe/cwe-783
* external/cwe/cwe-480
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
10000
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-783
* external/cwe/cwe-480
*/
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/src/experimental/Security/CWE/CWE-787/UnsignedToSignedPointerArith.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @problem.severity warning
* @tags reliability
* security
* experimental
* external/cwe/cwe-787
*/

Expand Down
1 change: 1 addition & 0 deletions ...rc/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision medium
* @tags correctness
* security
* experimental
* external/cwe/cwe-788
*/

Expand Down
4 changes: 4 additions & 0 deletions csharp/ql/src/codeql-suites/csharp-security-experimental.qls
< 10000 details class="js-file-header-dropdown dropdown details-overlay details-reset pr-2 pl-2">
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
- description: Extended and experimental security queries for C#
- queries: .
- apply: security-experimental-selectors.yml
from: codeql/suite-helpers
1 change: 1 addition & 0 deletions csharp/ql/src/experimental/CWE-099/TaintedWebClient.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
* @precision high
* @id cs/webclient-path-injection
* @tags security
* experimental
* external/cwe/cwe-099
* external/cwe/cwe-023
* external/cwe/cwe-036
Expand Down
1 change: 1 addition & 0 deletions csharp/ql/src/experimental/CWE-918/RequestForgery.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
* @precision high
* @id cs/request-forgery
* @tags security
* experimental
* external/cwe/cwe-918
*/

Expand Down
1 change: 1 addition & 0 deletions csharp/ql/src/experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
* @precision high
* @id cs/web/cookie-httponly-not-set
* @tags security
* experimental
* external/cwe/cwe-1004
*/

Expand Down
1 change: 1 addition & 0 deletions .../experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
* @kind problem
* @tags security
* cryptography
* experimental
* external/cwe/cwe-327
* @id cs/azure-storage/unsafe-usage-of-client-side-encryption-version
* @problem.severity error
Expand Down
1 change: 1 addition & 0 deletions csharp/ql/src/experimental/Security Features/CWE-614/CookieWithoutSecure.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* @precision high
* @id cs/web/cookie-secure-not-set
* @tags security
* experimental
* external/cwe/cwe-319
* external/cwe/cwe-614
*/
Expand Down
1 change: 10000 1 addition & 0 deletions csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
* @problem.severity error
* @id cs/hash-without-salt
* @tags security
* experimental
* external/cwe-759
*/

Expand Down
1 change: 1 addition & 0 deletions ...ecurity Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
* Higher precision version checks for exception throws, so less false positives are expected.
* @kind problem
* @tags security
* experimental
* JsonWebTokenHandler
* manual-verification-required
* @id cs/json-webtoken-handler/delegated-security-validations-always-return-true
Expand Down
1 change: 1 addition & 0 deletions ...ql/src/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
* @description Check if security sensitive token validations for `JsonWebTokenHandler` are being disabled.
* @kind problem
* @tags security
* experimental
* JsonWebTokenHandler
* manual-verification-required
* @id cs/json-webtoken-handler/security-validations-disabled
Expand Down
1 change: 1 addition & 0 deletions csharp/ql/src/experimental/Security Features/Serialization/DefiningDatasetRelatedType.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
* @problem.severity warning
* @id cs/dataset-serialization/defining-dataset-related-type
* @tags security
* experimental
*/

import csharp
Expand Down
Loading
0