Skip to content

Commit 7385649

Browse files
lcmangalagirilcmangalagiri
committed
Rust: Add command injection (CWE-078) and unsafe deserialization (CWE-502) queries
Add two new security queries for Rust: 1. Command Injection (CWE-078): - Detects user-controlled data flowing into std::process::Command and tokio::process::Command (both command name and arguments) - Includes models-as-data sinks for Command::new, .arg(), .args() - Query ID: rust/command-line-injection 2. Unsafe Deserialization (CWE-502): - Detects user-controlled data flowing into deserialization functions (serde_json, bincode, rmp_serde, ciborium, serde_yaml, toml) - Query ID: rust/unsafe-deserialization Both queries include: - Extension libraries with sources, sinks, and barriers - Query help (.qhelp) with examples - Test cases with inline expectations - Models-as-data sink definitions
1 parent c914268 commit 7385649

18 files changed

Lines changed: 561 additions & 0 deletions

‎rust/ql/lib/codeql/rust/frameworks/serde.model.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sinkModel
5+
data:
6+
# serde_json deserialization functions
7+
- ["crate::serde_json::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
8+
- ["crate::serde_json::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
9+
- ["crate::serde_json::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
10+
- ["crate::serde_json::from_value", "Argument[0]", "unsafe-deserialization", "manual"]
11+
# bincode deserialization functions
12+
- ["crate::bincode::deserialize", "Argument[0]", "unsafe-deserialization", "manual"]
13+
- ["crate::bincode::deserialize_from", "Argument[0]", "unsafe-deserialization", "manual"]
14+
# rmp_serde (MessagePack) deserialization functions
15+
- ["crate::rmp_serde::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
16+
- ["crate::rmp_serde::from_read", "Argument[0]", "unsafe-deserialization", "manual"]
17+
# ciborium (CBOR) deserialization functions
18+
- ["crate::ciborium::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
19+
# serde_yaml deserialization functions
20+
- ["crate::serde_yaml::from_str", "Argument[0]", "unsafe-deserialization", "manual"]
21+
- ["crate::serde_yaml::from_slice", "Argument[0]", "unsafe-deserialization", "manual"]
22+
- ["crate::serde_yaml::from_reader", "Argument[0]", "unsafe-deserialization", "manual"]
23+
# toml deserialization
24+
- ["crate::toml::from_str", "Argument[0]", "unsafe-deserialization", "manual"]

‎rust/ql/lib/codeql/rust/frameworks/stdlib/process.model.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sinkModel
5+
data:
6+
# std::process::Command - the command name itself
7+
- ["<std::process::Command>::new", "Argument[0]", "command-injection", "manual"]
8+
# std::process::Command - arguments passed to the command
9+
- ["<std::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
10+
- ["<std::process::Command>::args", "Argument[0]", "command-injection", "manual"]
11+
# tokio::process::Command - the command name itself
12+
- ["<tokio::process::Command>::new", "Argument[0]", "command-injection", "manual"]
13+
# tokio::process::Command - arguments passed to the command
14+
- ["<tokio::process::Command>::arg", "Argument[0]", "command-injection", "manual"]
15+
- ["<tokio::process::Command>::args", "Argument[0]", "command-injection", "manual"]

‎rust/ql/lib/codeql/rust/security/CommandInjectionExtensions.qll‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Provides classes and predicates for reasoning about command injection
3+
* vulnerabilities (CWE-078).
4+
*/
5+
6+
import rust
7+
private import codeql.rust.dataflow.DataFlow
8+
private import codeql.rust.dataflow.FlowSink
9+
private import codeql.rust.dataflow.FlowBarrier
10+
private import codeql.rust.Concepts
11+
private import codeql.rust.security.Barriers as Barriers
12+
13+
/**
14+
* Provides default sources, sinks and barriers for detecting command injection
15+
* vulnerabilities, as well as extension points for adding your own.
16+
*/
17+
module CommandInjection {
18+
/**
19+
* A data flow source for command injection vulnerabilities.
20+
*/
21+
abstract class Source extends DataFlow::Node { }
22+
23+
/**
24+
* A data flow sink for command injection vulnerabilities.
25+
*/
26+
abstract class Sink extends QuerySink::Range {
27+
override string getSinkType() { result = "CommandInjection" }
28+
}
29+
30+
/**
31+
* A barrier for command injection vulnerabilities.
32+
*/
33+
abstract class Barrier extends DataFlow::Node { }
34+
35+
/**
36+
* An active threat-model source, considered as a flow source.
37+
*/
38+
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
39+
40+
/**
41+
* A sink for command injection from model data.
42+
*/
43+
private class ModelsAsDataSink extends Sink {
44+
ModelsAsDataSink() { sinkNode(this, "command-injection") }
45+
}
46+
47+
/**
48+
* A barrier for command injection from model data.
49+
*/
50+
private class ModelsAsDataBarrier extends Barrier {
51+
ModelsAsDataBarrier() { barrierNode(this, "command-injection") }
52+
}
53+
54+
/**
55+
* A barrier for command injection vulnerabilities for nodes whose type is a
56+
* numeric type, which is unlikely to expose any vulnerability.
57+
*/
58+
private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
59+
60+
private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
61+
62+
private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
63+
{ }
64+
}

‎rust/ql/lib/codeql/rust/security/UnsafeDeserializationExtensions.qll‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Provides classes and predicates for reasoning about unsafe deserialization
3+
* vulnerabilities (CWE-502).
4+
*/
5+
6+
import rust
7+
private import codeql.rust.dataflow.DataFlow
8+
private import codeql.rust.dataflow.FlowSink
9+
private import codeql.rust.dataflow.FlowBarrier
10+
private import codeql.rust.Concepts
11+
private import codeql.rust.security.Barriers as Barriers
12+
13+
/**
14+
* Provides default sources, sinks and barriers for detecting unsafe deserialization
15+
* vulnerabilities, as well as extension points for adding your own.
16+
*/
17+
module UnsafeDeserialization {
18+
/**
19+
* A data flow source for unsafe deserialization vulnerabilities.
20+
*/
21+
abstract class Source extends DataFlow::Node { }
22+
23+
/**
24+
* A data flow sink for unsafe deserialization vulnerabilities.
25+
*/
26+
abstract class Sink extends QuerySink::Range {
27+
override string getSinkType() { result = "UnsafeDeserialization" }
28+
}
29+
30+
/**
31+
* A barrier for unsafe deserialization vulnerabilities.
32+
*/
33+
abstract class Barrier extends DataFlow::Node { }
34+
35+
/**
36+
* An active threat-model source, considered as a flow source.
37+
*/
38+
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
39+
40+
/**
41+
* A sink for unsafe deserialization from model data.
42+
*/
43+
private class ModelsAsDataSink extends Sink {
44+
ModelsAsDataSink() { sinkNode(this, "unsafe-deserialization") }
45+
}
46+
47+
/**
48+
* A barrier for unsafe deserialization from model data.
49+
*/
50+
private class ModelsAsDataBarrier extends Barrier {
51+
ModelsAsDataBarrier() { barrierNode(this, "unsafe-deserialization") }
52+
}
53+
54+
/**
55+
* A barrier for unsafe deserialization for nodes whose type is a numeric
56+
* type, which is unlikely to expose any vulnerability.
57+
*/
58+
private class NumericTypeBarrier extends Barrier instanceof Barriers::NumericTypeBarrier { }
59+
60+
private class BooleanTypeBarrier extends Barrier instanceof Barriers::BooleanTypeBarrier { }
61+
62+
private class FieldlessEnumTypeBarrier extends Barrier instanceof Barriers::FieldlessEnumTypeBarrier
63+
{ }
64+
}

‎rust/ql/src/queries/security/CWE-078/CommandInjection.qhelp‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
7+
<p>
8+
If a system command is built from user-provided data without sufficient sanitization, a user may be able to run malicious commands. An attacker can craft input to change the meaning of the command, potentially gaining control of the system.
9+
</p>
10+
11+
</overview>
12+
<recommendation>
13+
14+
<p>
15+
If possible, use hard-coded string literals for commands. If the command must be built from user-provided data, do not pass user input directly to shell commands. Instead, use APIs that accept command arguments as separate parameters (such as <code>std::process::Command</code> with individual <code>.arg()</code> calls for each argument), which avoids shell interpretation of special characters. If shell execution is necessary, validate and sanitize user input against an allowlist of permitted values.
16+
</p>
17+
18+
</recommendation>
19+
<example>
20+
21+
<p>
22+
In the following example, a command is constructed directly from user-controlled input obtained via an HTTP request. An attacker could supply a malicious value to execute arbitrary commands.
23+
</p>
24+
25+
<sample src="CommandInjectionBad.rs" />
26+
27+
<p>
28+
A safer approach uses a fixed command with validated arguments, or avoids shell interpretation entirely:
29+
</p>
30+
31+
<sample src="CommandInjectionGood.rs" />
32+
33+
</example>
34+
<references>
35+
36+
<li>OWASP: <a href="https://owasp.org/www-community/attacks/Command_Injection">Command Injection</a>.</li>
37+
<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Code_injection#Shell_injection">Shell injection</a>.</li>
38+
39+
</references>
40+
</qhelp>

‎rust/ql/src/queries/security/CWE-078/CommandInjection.ql‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* @name Uncontrolled command line
3+
* @description Using externally controlled strings in a command line may allow a malicious
4+
* user to change the meaning of the command.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @security-severity 9.8
8+
* @precision high
9+
* @id rust/command-line-injection
10+
* @tags security
11+
* external/cwe/cwe-078
12+
* external/cwe/cwe-088
13+
*/
14+
15+
import rust
16+
import codeql.rust.dataflow.DataFlow
17+
import codeql.rust.dataflow.TaintTracking
18+
import codeql.rust.security.CommandInjectionExtensions
19+
20+
/**
21+
* A taint configuration for detecting command injection vulnerabilities.
22+
*/
23+
module CommandInjectionConfig implements DataFlow::ConfigSig {
24+
import CommandInjection
25+
26+
predicate isSource(DataFlow::Node node) { node instanceof Source }
27+
28+
predicate isSink(DataFlow::Node node) { node instanceof Sink }
29+
30+
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
31+
32+
predicate observeDiffInformedIncrementalMode() { any() }
33+
}
34+
35+
module CommandInjectionFlow = TaintTracking::Global<CommandInjectionConfig>;
36+
37+
import CommandInjectionFlow::PathGraph
38+
39+
from CommandInjectionFlow::PathNode sourceNode, CommandInjectionFlow::PathNode sinkNode
40+
where CommandInjectionFlow::flowPath(sourceNode, sinkNode)
41+
select sinkNode.getNode(), sourceNode, sinkNode, "This command line depends on a $@.",
42+
sourceNode.getNode(), "user-provided value"

‎rust/ql/src/queries/security/CWE-078/CommandInjectionBad.rs‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
use std::process::Command;
2+
3+
fn handle_request(user_input: &str) {
4+
// BAD: user input is passed directly to a shell command
5+
Command::new("sh")
6+
.arg("-c")
7+
.arg(user_input)
8+
.output()
9+
.expect("failed to execute");
10+
}

‎rust/ql/src/queries/security/CWE-078/CommandInjectionGood.rs‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
use std::process::Command;
2+
3+
fn handle_request(filename: &str) {
4+
// GOOD: use a fixed command with the user input as a separate argument,
5+
// avoiding shell interpretation
6+
let allowed_names = ["report.pdf", "summary.txt", "data.csv"];
7+
if allowed_names.contains(&filename) {
8+
Command::new("cat")
9+
.arg(filename)
10+
.output()
11+
.expect("failed to execute");
12+
}
13+
}

‎rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.qhelp‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
7+
<p>
8+
Deserializing untrusted data without validation can allow an attacker to cause denial of service, consume excessive resources, or in some cases execute arbitrary code. In Rust, while memory safety mitigates some risks, deserializing untrusted data with libraries like <code>serde</code>, <code>bincode</code>, or <code>rmp-serde</code> can still lead to panics, excessive memory allocation, or logic bugs when trait objects or polymorphic types are involved.
9+
</p>
10+
11+
</overview>
12+
<recommendation>
13+
14+
<p>
15+
Avoid deserializing untrusted data with formats that allow unbounded allocation or polymorphic dispatch. Prefer formats with schema validation (like Protocol Buffers) when processing untrusted input. If using <code>serde</code>, consider:
16+
</p>
17+
<ul>
18+
<li>Validating input size before deserialization.</li>
19+
<li>Using <code>#[serde(deny_unknown_fields)]</code> to reject unexpected data.</li>
20+
<li>Avoiding <code>#[typetag]</code> or trait object deserialization with untrusted input.</li>
21+
<li>Using bounded containers (e.g., limiting <code>Vec</code> length via custom deserializers).</li>
22+
</ul>
23+
24+
</recommendation>
25+
<example>
26+
27+
<p>
28+
In the following example, data from an HTTP request is directly deserialized without any validation. An attacker could send a crafted payload that causes excessive memory allocation or other unintended behavior.
29+
</p>
30+
31+
<sample src="UnsafeDeserializationBad.rs" />
32+
33+
<p>
34+
A safer approach validates the input size and uses strict deserialization settings:
35+
</p>
36+
37+
<sample src="UnsafeDeserializationGood.rs" />
38+
39+
</example>
40+
<references>
41+
42+
<li>OWASP: <a href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/16-Testing_for_HTTP_Incoming_Requests">Deserialization of untrusted data</a>.</li>
43+
<li>CWE-502: <a href="https://cwe.mitre.org/data/definitions/502.html">Deserialization of Untrusted Data</a>.</li>
44+
45+
</references>
46+
</qhelp>

‎rust/ql/src/queries/security/CWE-502/UnsafeDeserialization.ql‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* @name Deserialization of user-controlled data
3+
* @description Deserializing user-controlled data may allow an attacker to trigger unexpected
4+
* code execution, denial of service, or other harmful effects.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @security-severity 9.8
8+
* @precision high
9+
* @id rust/unsafe-deserialization
10+
* @tags security
11+
* external/cwe/cwe-502
12+
*/
13+
14+
import rust
15+
import codeql.rust.dataflow.DataFlow
16+
import codeql.rust.dataflow.TaintTracking
17+
import codeql.rust.security.UnsafeDeserializationExtensions
18+
19+
/**
20+
* A taint configuration for detecting unsafe deserialization vulnerabilities.
21+
*/
22+
module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
23+
import UnsafeDeserialization
24+
25+
predicate isSource(DataFlow::Node node) { node instanceof Source }
26+
27+
predicate isSink(DataFlow::Node node) { node instanceof Sink }
28+
29+
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof Barrier }
30+
31+
predicate observeDiffInformedIncrementalMode() { any() }
32+
}
33+
34+
module UnsafeDeserializationFlow = TaintTracking::Global<UnsafeDeserializationConfig>;
35+
36+
import UnsafeDeserializationFlow::PathGraph
37+
38+
from UnsafeDeserializationFlow::PathNode sourceNode, UnsafeDeserializationFlow::PathNode sinkNode
39+
where UnsafeDeserializationFlow::flowPath(sourceNode, sinkNode)
40+
select sinkNode.getNode(), sourceNode, sinkNode,
41+
"This deserialization operation processes $@ without validation.", sourceNode.getNode(),
42+
"user-provided data"

0 commit comments

Comments
 (0)