[Bug analyzer/106007] New: RFE: analyzer should complain about exec/system of tainted args

[Bug analyzer/106007] New: RFE: analyzer should complain about exec/system of tainted args

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106007

            Bug ID: 106007
           Summary: RFE: analyzer should complain about exec/system of
                    tainted args
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

The analyzer should complain if tainted args are passed to any of the following
without sanitization (probably not an exhaustive list):

       int execl(const char *pathname, const char *arg, ...
                       /* (char  *) NULL */);
       int execlp(const char *file, const char *arg, ...
                       /* (char  *) NULL */);
       int execle(const char *pathname, const char *arg, ...
                       /*, (char *) NULL, char * const envp[] */);
       int execv(const char *pathname, char *const argv[]);
       int execvp(const char *file, char *const argv[]);
       int execvpe(const char *file, char *const argv[],
                       char *const envp[]);


       int execve(const char *pathname, char *const argv[],
                  char *const envp[]);

       int execveat(int dirfd, const char *pathname,
                    char *const argv[], char *const envp[],
                    int flags);

       int fexecve(int fd, char *const argv[], char *const envp[]);

       int system(const char *command);

Could have/reuse an attribute for this, or hardcode it.

[Bug analyzer/106007] RFE: analyzer should complain about exec/system of tainted args

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106007

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Similarly, putenv should check for tainted string args.

[Bug analyzer/106007] RFE: analyzer should complain about exec/system of tainted args

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106007

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Currently the taint analysis only has handling for numeric arguments being
bounds-checked.

How can string arguments transition to a "sanitized" state?  Or are string
arguments always tainted once they've acquired taint?

[Bug analyzer/106007] RFE: analyzer should complain about exec/system/putenv of tainted args

[tlange at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106007

Tim Lange <tlange at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tlange at gcc dot gnu.org

--- Comment #3 from Tim Lange <tlange at gcc dot gnu.org> ---
(In reply to David Malcolm from comment #2)
> Currently the taint analysis only has handling for numeric arguments being
> bounds-checked.
> 
> How can string arguments transition to a "sanitized" state?  Or are string
> arguments always tainted once they've acquired taint?

Many papers introduce sanitizers/taint killers/... besides sources and sinks,
which are also manually-defined methods. Two prime examples in webdev are XSS
and SQL query escaping methods that do replace special characters such that the
user input is not interpreted.

I don't think you can automatically find out that a method is a sanitizer
unless you would track the interesting part of the string on a byte-level.