dont-call-system-cpp

ESS-ENN · ESS-ENN · commit 783bde67a2d7 · 2025-02-07T14:14:49.000+05:30
diff --git a/rules/cpp/dont-call-system-cpp.yml b/rules/cpp/dont-call-system-cpp.yml
@@ -0,0 +1,61 @@
+id: dont-call-system-cpp
+language: cpp
+severity: warning
+message: >-
+  Don't call `system`. It's a high-level wrapper that allows for stacking
+  multiple commands. Always prefer a more restrictive API such as calling
+  `execve` from the `exec` family.
+note: >-
+  [CWE-78] Improper Neutralization of Special Elements used in an OS
+          Command ('OS Command Injection').
+  [REFERENCES]
+      - https://owasp.org/Top10/A03_2021-Injection
+
+ast-grep-essentials: true
+
+utils:
+  PATTERN_SYSTEM_INSIDE_IF_STATEMENT:
+    kind: call_expression
+    all:
+      - has:
+          stopBy: neighbor
+          kind: identifier
+          regex: '^system$'
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+      - inside:
+          stopBy: end
+          kind: parenthesized_expression
+          inside:
+            kind: if_statement
+  PATTERN_SYSTEM:
+    any:
+    - kind: expression_statement
+    - kind: return_statement
+    - kind: field_declaration
+    has:
+      stopBy: neighbor
+      kind: call_expression
+      all:
+      - has:
+          stopBy: neighbor
+          kind: identifier
+          regex: '^system$'
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+rule:
+  any:
+  - matches: PATTERN_SYSTEM_INSIDE_IF_STATEMENT
+  - matches: PATTERN_SYSTEM
+  not:
+    all:
+      - has:
+          stopBy: end
+          kind: ERROR
+      - inside:
+          has:
+            stopBy: end
+            kind: ERROR
+
diff --git a/tests/__snapshots__/dont-call-system-cpp-snapshot.yml b/tests/__snapshots__/dont-call-system-cpp-snapshot.yml
@@ -0,0 +1,45 @@
+id: dont-call-system-cpp
+snapshots:
+  ? |
+    void test_002(const char *input)
+    {
+    char cmdbuf[BUFFERSIZE];
+    int len_wanted = snprintf(cmdbuf, BUFFERSIZE,
+                              "any_cmd '%s'", input);
+    system(cmdbuf);
+    }
+    void test_001(const char *input)
+    {
+    char cmdbuf[BUFFERSIZE];
+    int len_wanted = snprintf(cmdbuf, BUFFERSIZE,
+                              "any_cmd '%s'", input);
+    if (len_wanted >= BUFFERSIZE)
+    {
+        /* Handle error */
+    }
+    else if (len_wanted < 0)
+    {
+        /* Handle error */
+    }
+    else if (system(cmdbuf) == -1)
+    {
+        /* Handle error */
+    }
+    }
+  : labels:
+    - source: system(cmdbuf);
+      style: primary
+      start: 156
+      end: 171
+    - source: system
+      style: secondary
+      start: 156
+      end: 162
+    - source: (cmdbuf)
+      style: secondary
+      start: 162
+      end: 170
+    - source: system(cmdbuf)
+      style: secondary
+      start: 156
+      end: 170
diff --git a/tests/cpp/dont-call-system-cpp-test.yml b/tests/cpp/dont-call-system-cpp-test.yml
@@ -0,0 +1,34 @@
+id: dont-call-system-cpp
+valid:
+  - |
+   void test_003(const char *input)
+   {
+    storer->store_binary(Clocks->system());
+   }
+invalid:
+  - |
+    void test_002(const char *input)
+    {
+    char cmdbuf[BUFFERSIZE];
+    int len_wanted = snprintf(cmdbuf, BUFFERSIZE,
+                              "any_cmd '%s'", input);
+    system(cmdbuf);
+    }
+    void test_001(const char *input)
+    {
+    char cmdbuf[BUFFERSIZE];
+    int len_wanted = snprintf(cmdbuf, BUFFERSIZE,
+                              "any_cmd '%s'", input);
+    if (len_wanted >= BUFFERSIZE)
+    {
+        /* Handle error */
+    }
+    else if (len_wanted < 0)
+    {
+        /* Handle error */
+    }
+    else if (system(cmdbuf) == -1)
+    {
+        /* Handle error */
+    }
+    }
