Analyzing data flow in C and C++¶

You can use data flow analysis to track the flow of potentially malicious or insecure data that can cause vulnerabilities in your codebase.

About this article¶

This article describes how data flow analysis is implemented in the CodeQL libraries for C/C++ and includes examples to help you write your own data flow queries. The following sections describe how to use the libraries for local data flow, global data flow, and taint tracking.

Note

The modular API for data flow described here is available from CodeQL 2.13.0. The legacy library is deprecated and will be removed in December 2024. For information about how the library has changed and how to migrate any existing queries to the modular API, see New dataflow API for CodeQL query writing.

About data flow¶

Data flow analysis computes the possible values that a variable can hold at various points in a program, determining how those values propagate through the program, and where they are used. In CodeQL, you can model both local data flow and global data flow. For a more general introduction to modeling data flow, see “About data flow analysis.”

Local data flow¶

Local data flow is data flow within a single function. Local data flow is usually easier, faster, and more precise than global data flow, and is sufficient for many queries.

Using local data flow¶

The local data flow library is in the module DataFlow, which defines the class Node denoting any element that data can flow through. Nodes are divided into expression nodes (ExprNode, IndirectExprNode) and parameter nodes (ParameterNode, IndirectParameterNode). The indirect nodes represent expressions or parameters after a fixed number of pointer dereferences.

It is possible to map between data flow nodes and expressions or parameters using the member predicates asExpr, asIndirectExpr, and asParameter:

class Node {
  /**
   * Gets the expression corresponding to this node, if any.
   */
  Expr asExpr() { ... }

  /**
   * Gets the expression corresponding to a node that is obtained after dereferencing
   * the expression `index` times, if any.
   */
  Expr asIndirectExpr(int index) { ... }

  /**
   * Gets the parameter corresponding to this node, if any.
   */
  Parameter asParameter() { ... }

  /**
   * Gets the parameter corresponding to a node that is obtained after dereferencing
   * the parameter `index` times.
   */
  Parameter asParameter(int index) { ... }

  ...
}

The predicate localFlowStep(Node nodeFrom, Node nodeTo) holds if there is an immediate data flow edge from the node nodeFrom to the node nodeTo. The predicate can be applied recursively (using the + and * operators), or through the predefined recursive predicate localFlow, which is equivalent to localFlowStep*.

For example, finding flow from a parameter source to an expression sink in zero or more local steps can be achieved as follows, where nodeFrom and nodeTo are of type DataFlow::Node:

nodeFrom.asParameter() = source and
nodeTo.asExpr() = sink and
DataFlow::localFlow(nodeFrom, nodeTo)

Using local taint tracking¶

Local taint tracking extends local data flow by including non-value-preserving flow steps. For example:

int i = tainted_user_input();
some_big_struct *array = malloc(i * sizeof(some_big_struct));

In this case, the argument to malloc is tainted.

The local taint tracking library is in the module TaintTracking. Like local data flow, a predicate localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) holds if there is an immediate taint propagation edge from the node nodeFrom to the node nodeTo. The predicate can be applied recursively (using the + and * operators), or through the predefined recursive predicate localTaint, which is equivalent to localTaintStep*.

For example, finding taint propagation from a parameter source to an expression sink in zero or more local steps can be achieved as follows, where nodeFrom and nodeTo are of type DataFlow::Node:

nodeFrom.asParameter() = source and
nodeTo.asExpr() = sink and
TaintTracking::localTaint(nodeFrom, nodeTo)

Examples¶

The following query finds the filename passed to fopen:

import cpp

from Function fopen, FunctionCall fc
where
  fopen.hasGlobalName("fopen") and
  fc.getTarget() = fopen
select fc.getArgument(0)

However, this will only give the expression in the argument, not the values which could be passed to it. Instead we can use local data flow to find all expressions that flow into the argument, where we use asIndirectExpr(1). This is because we are interested in the value of the string passed to fopen, not the pointer pointing to it:

import cpp
import semmle.code.cpp.dataflow.new.DataFlow

from Function fopen, FunctionCall fc, Expr src, DataFlow::Node source, DataFlow::Node sink
where
  fopen.hasGlobalName("fopen") and
  fc.getTarget() = fopen and
  source.asIndirectExpr(1) = src and
  sink.asIndirectExpr(1) = fc.getArgument(0) and
  DataFlow::localFlow(source, sink)
select src

Then we can vary the source and, for example, use the parameter of a function. The following query finds where a parameter is used when opening a file:

import cpp
import semmle.code.cpp.dataflow.new.DataFlow

from Function fopen, FunctionCall fc, Parameter p, DataFlow::Node source, DataFlow::Node sink
where
  fopen.hasGlobalName("fopen") and
  fc.getTarget() = fopen and
  source.asParameter(1) = p and
  sink.asIndirectExpr(1) = fc.getArgument(0) and
  DataFlow::localFlow(source, sink)
select p

The following example finds calls to formatting functions where the format string is not hard-coded.

import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.commons.Printf

from FormattingFunction format, FunctionCall call, Expr formatString, DataFlow::Node sink
where
  call.getTarget() = format and
  call.getArgument(format.getFormatParameterIndex()) = formatString and
  sink.asIndirectExpr(1) = formatString and
  not exists(DataFlow::Node source |
    DataFlow::localFlow(source, sink) and
    source.asIndirectExpr(1) instanceof StringLiteral
  )
select call, "Argument to " + format.getQualifiedName() + " isn't hard-coded."

Exercises¶

Exercise 1: Write a query that finds all hard-coded strings used to create a host_ent via gethostbyname, using local data flow. (Answer)

Global data flow¶

Global data flow tracks data flow throughout the entire program, and is therefore more powerful than local data flow. However, global data flow is less precise than local data flow, and the analysis typically requires significantly more time and memory to perform.

Note

You can model data flow paths in CodeQL by creating path queries. To view data flow paths generated by a path query in CodeQL for VS Code, you need to make sure that it has the correct metadata and select clause. For more information, see Creating path queries.

Using global data flow¶

We can use the global data flow library by implementing the signature DataFlow::ConfigSig and applying the module DataFlow::Global<ConfigSig>:

import semmle.code.cpp.dataflow.new.DataFlow

module MyFlowConfiguration implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) {
    ...
  }

  predicate isSink(DataFlow::Node sink) {
    ...
  }
}