Skip to content

Rules - file-stat-before-action c/cpp #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 21, 2024
Merged

Rules - file-stat-before-action c/cpp #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
838c1db
changes in file-access-before-action in cpp
ESS-ENN Oct 15, 2024
494c0a6
file-stat-before-action-c/cpp
ESS-ENN Oct 16, 2024
7abb5d5
changes in file-stat-before-action-c/cpp
ESS-ENN Oct 16, 2024
3e059eb
Merge branch 'main' into file-stat-before-action-c/cpp
ESS-ENN Oct 17, 2024
3176e5f
Merge branch 'main' into file-stat-before-action-c/cpp
petrisorcoderabbit Oct 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions rules/c/security/file-stat-before-action-c.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
id: file-stat-before-action-c
language: c
severity: warning
message: >-
A check is done with `stat` and then the file is used. There is no
guarantee that the status of the file has not changed since the call to
`stat` which may allow attackers to bypass permission checks.
note: >-
[CWE-367]: Time-of-check Time-of-use (TOCTOU) Race Condition
[REFERENCES]
- https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files
utils:
match_fopen_identifier:
kind: identifier
regex: unlink|fopen|freopen|remove|rename|access|open|stat|lstat|unlink|mkdir|rmdir|chdir|folly::readFile|folly::writeFile|folly::writeFileAtomic|folly::writeFileAtomicNoThrow|folly::File
all:
- inside:
kind: call_expression
inside:
stopBy: end
kind: expression_statement
inside:
kind: compound_statement
inside:
kind: if_statement
has:
stopBy: end
kind: call_expression
all:
- has:
kind: identifier
regex: ^(fstatat|_fstatat)$
- has:
stopBy: neighbor
kind: argument_list
all:
- has:
stopBy: neighbor
kind: identifier
- has:
stopBy: neighbor
kind: call_expression
all:
- has:
stopBy: neighbor
kind: field_expression
- has:
stopBy: neighbor
kind: argument_list

match_fopen_identifier_2:
kind: identifier
regex: unlink|fopen|freopen|remove|rename|access|open|stat|lstat|unlink|mkdir|rmdir|chdir|folly::readFile|folly::writeFile|folly::writeFileAtomic|folly::writeFileAtomicNoThrow|folly::File
all:
- inside:
kind: call_expression
inside:
stopBy: end
kind: expression_statement
inside:
kind: compound_statement
inside:
kind: if_statement
has:
stopBy: end
kind: call_expression
all:
- has:
stopBy: neighbor
kind: identifier
regex: "^stat|_stat|lstat|_lstat$"
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: neighbor
kind: call_expression

rule:
any:
- matches: match_fopen_identifier
- matches: match_fopen_identifier_2
82 changes: 82 additions & 0 deletions rules/cpp/security/file-stat-before-action-cpp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
id: file-stat-before-action-cpp
language: cpp
severity: warning
message: >-
A check is done with `stat` and then the file is used. There is no
guarantee that the status of the file has not changed since the call to
`stat` which may allow attackers to bypass permission checks.
note: >-
[CWE-367]: Time-of-check Time-of-use (TOCTOU) Race Condition
[REFERENCES]
- https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files
utils:
match_fopen_identifier:
kind: identifier
regex: unlink|fopen|freopen|remove|rename|access|open|stat|lstat|unlink|mkdir|rmdir|chdir|folly::readFile|folly::writeFile|folly::writeFileAtomic|folly::writeFileAtomicNoThrow|folly::File
all:
- inside:
kind: call_expression
inside:
stopBy: end
kind: expression_statement
inside:
kind: compound_statement
inside:
kind: if_statement
has:
stopBy: end
kind: call_expression
all:
- has:
kind: identifier
regex: ^(fstatat|_fstatat)$
- has:
stopBy: neighbor
kind: argument_list
all:
- has:
stopBy: neighbor
kind: identifier
- has:
stopBy: neighbor
kind: call_expression
all:
- has:
stopBy: neighbor
kind: field_expression
- has:
stopBy: neighbor
kind: argument_list

match_fopen_identifier_2:
kind: identifier
regex: unlink|fopen|freopen|remove|rename|access|open|stat|lstat|unlink|mkdir|rmdir|chdir|folly::readFile|folly::writeFile|folly::writeFileAtomic|folly::writeFileAtomicNoThrow|folly::File
all:
- inside:
kind: call_expression
inside:
stopBy: end
kind: expression_statement
inside:
kind: compound_statement
inside:
kind: if_statement
has:
stopBy: end
kind: call_expression
all:
- has:
stopBy: neighbor
kind: identifier
regex: "^stat|_stat|lstat|_lstat$"
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: neighbor
kind: call_expression

rule:
any:
- matches: match_fopen_identifier
- matches: match_fopen_identifier_2
Loading