How to track all std::string values in a C++ project

[cryptomadco]

I want to know how may I have a codeql script so I can track all values belongs to std::string class

Example source codes are :

#include

int main(){
	std::string name;
	name = "Hall";
	std::cout << name << std::endl;
        name = "Hello!"
        name = "0xdeadbeef"
	return 0;
}

In the above case, I need an analysis script so it can gives me all three strings Hall , Hello and 0xdeadbeef .

Just could not find anything useful for that std::string in codeql .

Thanks!

[geoffw0]

Hi @cryptomadco,

For the examples you've given, looking for string literals that are a part of std::string expressions might suffice:

import cpp

class StdBasicString extends TemplateClass {
  StdBasicString() { this.hasQualifiedName("std", "basic_string") }
}

from Expr e, StringLiteral l
where
  (
    e.getUnspecifiedType() = any(StdBasicString s).getAnInstantiation() or
    e.getUnspecifiedType().(DerivedType).getBaseType() = any(StdBasicString s).getAnInstantiation()
  ) and
  e.getAChild*() = l
select l

You could get more results by tracking data flow from string literals to expressions of the std::string type. Take a look at the 'Upcast array used in pointer arithmetic' (cpp/upcast-array-pointer-arithmetic) query if you're interested in trying that.

[cryptomadco]

Hey @geoffw0 !

Thanks for the answer. and if we want to have all strings regarding this : std::string.compare()
Then, this will be going to be similar ?

Thanks!

[geoffw0]

Can you give an example of what you're looking for with std::string.compare()?

[cryptomadco]

Sure!

Look at this example :

#include <iostream>
#include <string>

int main ()
{
  std::string str1 ("green apple");
  std::string str2 ("red apple");
 std::string str3 ("Github thins!");

  if (str1.compare(str2) != 0)
    std::cout << str1 << " is not " << str2 << '\n';

  if (str1.compare(6,5,"apple") == 0)
    std::cout << "still, " << str1 << " is an apple\n";

  if (str2.compare(str2.size()-5,5,"apple") == 0)
    std::cout << "and " << str2 << " is also an apple\n";

  if (str1.compare(6,5,str2,4,5) == 0)
    std::cout << "therefore, both are apples\n";

  return 0;
}

Sometimes, I should limit the results to only strings when std::string.comare() is called, because for big programs it will going to be a big list of all strings related to all possible std::strings , but indeed only strings in std::string.comare() would be matter .

In this case, the str3 should not be in the results !

[geoffw0]

Then I suggest you look at the 'Upcast array used in pointer arithmetic' (cpp/upcast-array-pointer-arithmetic) query. It has a class that extends DataFlow::Configuration that you could modify to look for flows from string literals (in isSource) to calls to std::string::compare (in isSink). Alternatively, there's a class in the 'Non-constant format string' (cpp/non-constant-format) query that extends TaintTracking::Configuration - this is similar but taint tracking will produce wider results, for example strings that have been processed between the source and sink.

When developing data/taint flow queries, I always suggest testing your source and sink predicates individually before you put it all together.

Let me know if you get stuck on anything.

[jbj]

I hope you found what you were looking for. There is more help to be found on https://securitylab.github.com/.