forked from github/codeql
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into post-release-prep/codeql-cli-2.10.1
- Loading branch information
Showing
123 changed files
with
2,658 additions
and
293 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 44 additions & 0 deletions
44
.../experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
|
|
||
| { | ||
| SymmetricKey aesKey = new SymmetricKey(kid: "symencryptionkey"); | ||
|
|
||
| // BAD: Using the outdated client side encryption version V1_0 | ||
| BlobEncryptionPolicy uploadPolicy = new BlobEncryptionPolicy(key: aesKey, keyResolver: null); | ||
| BlobRequestOptions uploadOptions = new BlobRequestOptions() { EncryptionPolicy = uploadPolicy }; | ||
|
|
||
| MemoryStream stream = new MemoryStream(buffer); | ||
| blob.UploadFromStream(stream, length: size, accessCondition: null, options: uploadOptions); | ||
| } | ||
|
|
||
| var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions() | ||
| { | ||
| // BAD: Using an outdated SDK that does not support client side encryption version V2_0 | ||
| ClientSideEncryption = new ClientSideEncryptionOptions() | ||
| { | ||
| KeyEncryptionKey = myKey, | ||
| KeyResolver = myKeyResolver, | ||
| KeyWrapAlgorihm = myKeyWrapAlgorithm | ||
| } | ||
| }); | ||
|
|
||
| var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions() | ||
| { | ||
| // BAD: Using the outdated client side encryption version V1_0 | ||
| ClientSideEncryption = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V1_0) | ||
| { | ||
| KeyEncryptionKey = myKey, | ||
| KeyResolver = myKeyResolver, | ||
| KeyWrapAlgorihm = myKeyWrapAlgorithm | ||
| } | ||
| }); | ||
|
|
||
| var client = new BlobClient(myConnectionString, new SpecializedBlobClientOptions() | ||
| { | ||
| // GOOD: Using client side encryption version V2_0 | ||
| ClientSideEncryption = new ClientSideEncryptionOptions(ClientSideEncryptionVersion.V2_0) | ||
| { | ||
| KeyEncryptionKey = myKey, | ||
| KeyResolver = myKeyResolver, | ||
| KeyWrapAlgorihm = myKeyWrapAlgorithm | ||
| } | ||
| }); |
29 changes: 29 additions & 0 deletions
29
...perimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.qhelp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| <!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd"> | ||
| <qhelp> | ||
|
|
||
|
|
||
| <overview> | ||
| <p>Azure Storage .NET, Java, and Python SDKs support encryption on the client with a customer-managed key that is maintained in Azure Key Vault or another key store.</p> | ||
| <p>Current release versions of the Azure Storage SDKs use cipher block chaining (CBC mode) for client-side encryption (referred to as <code>v1</code>).</p> | ||
|
|
||
| </overview> | ||
| <recommendation> | ||
|
|
||
| <p>Consider switching to <code>v2</code> client-side encryption.</p> | ||
|
|
||
| </recommendation> | ||
| <example> | ||
|
|
||
| <sample src="UnsafeUsageOfClientSideEncryptionVersion.cs" /> | ||
|
|
||
| </example> | ||
| <references> | ||
| <li> | ||
| <a href="http://aka.ms/azstorageclientencryptionblog">Azure Storage Client Encryption Blog.</a> | ||
| </li> | ||
| <li> | ||
| <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30187">CVE-2022-30187</a> | ||
| </li> | ||
|
|
||
| </references> | ||
| </qhelp> |
81 changes: 81 additions & 0 deletions
81
.../experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /** | ||
| * @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187). | ||
| * @description Unsafe usage of v1 version of Azure Storage client-side encryption, please refer to http://aka.ms/azstorageclientencryptionblog | ||
| * @kind problem | ||
| * @tags security | ||
| * cryptography | ||
| * external/cwe/cwe-327 | ||
| * @id cs/azure-storage/unsafe-usage-of-client-side-encryption-version | ||
| * @problem.severity error | ||
| * @precision high | ||
| */ | ||
|
|
||
| import csharp | ||
|
|
||
| /** | ||
| * Holds if `oc` is creating an object of type `c` = `Azure.Storage.ClientSideEncryptionOptions` | ||
| * and `e` is the `version` argument to the constructor | ||
| */ | ||
| predicate isCreatingAzureClientSideEncryptionObject(ObjectCreation oc, Class c, Expr e) { | ||
| exists(Parameter p | p.hasName("version") | | ||
| c.hasQualifiedName("Azure.Storage.ClientSideEncryptionOptions") and | ||
| oc.getTarget() = c.getAConstructor() and | ||
| e = oc.getArgumentForParameter(p) | ||
| ) | ||
| } | ||
|
|
||
| /** | ||
| * Holds if `oc` is an object creation of the outdated type `c` = `Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy` | ||
| */ | ||
| predicate isCreatingOutdatedAzureClientSideEncryptionObject(ObjectCreation oc, Class c) { | ||
| c.hasQualifiedName("Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy") and | ||
| oc.getTarget() = c.getAConstructor() | ||
| } | ||
|
|
||
| /** | ||
| * Holds if the Azure.Storage assembly for `c` is a version known to support | ||
| * version 2+ for client-side encryption | ||
| */ | ||
| predicate doesAzureStorageAssemblySupportSafeClientSideEncryption(Assembly asm) { | ||
| exists(int versionCompare | | ||
| versionCompare = asm.getVersion().compareTo("12.12.0.0") and | ||
| versionCompare >= 0 | ||
| ) and | ||
| asm.getName() = "Azure.Storage.Common" | ||
| } | ||
|
|
||
| /** | ||
| * Holds if the Azure.Storage assembly for `c` is a version known to support | ||
| * version 2+ for client-side encryption and if the argument for the constructor `version` | ||
| * is set to a secure value. | ||
| */ | ||
| predicate isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(Expr versionExpr, Assembly asm) { | ||
| // Check if the Azure.Storage assembly version has the fix | ||
| doesAzureStorageAssemblySupportSafeClientSideEncryption(asm) and | ||
| // and that the version argument for the constructor is guaranteed to be Version2 | ||
| isExprAnAccessToSafeClientSideEncryptionVersionValue(versionExpr) | ||
| } | ||
|
|
||
| /** | ||
| * Holds if the expression `e` is an access to a safe version of the enum `ClientSideEncryptionVersion` | ||
| * or an equivalent numeric value | ||
| */ | ||
| predicate isExprAnAccessToSafeClientSideEncryptionVersionValue(Expr e) { | ||
| exists(EnumConstant ec | | ||
| ec.hasQualifiedName("Azure.Storage.ClientSideEncryptionVersion.V2_0") and | ||
| ec.getAnAccess() = e | ||
| ) | ||
| } | ||
|
|
||
| from Expr e, Class c, Assembly asm | ||
| where | ||
| asm = c.getLocation() and | ||
| ( | ||
| exists(Expr e2 | | ||
| isCreatingAzureClientSideEncryptionObject(e, c, e2) and | ||
| not isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(e2, asm) | ||
| ) | ||
| or | ||
| isCreatingOutdatedAzureClientSideEncryptionObject(e, c) | ||
| ) | ||
| select e, "Unsafe usage of v1 version of Azure Storage client-side encryption." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.