[C++] CWE-020/ExternalAPIs: diff-informed + qlref tests

cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll

@@ -51,6 +51,10 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
   }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // risky since used in library: normal use in UntrustedDataToExternalApi.ql; used via ExternalApiUsedWithUntrustedData (no location) in CountUntrustedDataToExternalAPI.ql
+  }
 }
 
 module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExternalApiConfig>;

cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIsSpecific.qll

@@ -46,6 +46,10 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
+
+  predicate observeDiffInformedIncrementalMode() {
+    none() // risky since used in library: normal use in IRUntrustedDataToExternalApi.ql; used via ExternalApiUsedWithUntrustedData (no location) in IRCountUntrustedDataToExternalAPI.ql
+  }
 }
 
 module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExternalApiConfig>;

cpp/ql/test/query-tests/Security/CWE/CWE-020/CountUntrustedDataToExternalAPI.qlref

@@ -0,0 +1,4 @@
+query: Security/CWE/CWE-020/CountUntrustedDataToExternalAPI.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/query-tests/Security/CWE/CWE-020/ExternalAPISinkExample.cpp

@@ -0,0 +1,18 @@
+typedef unsigned long size_t;
+typedef size_t FILE;
+
+char *strcat(char *s1, const char *s2);
+char *fgets(char *s, int n, FILE *stream);
+char *fputs(const char *s, FILE *stream);
+
+void do_get(FILE* request, FILE* response) {
+  char page[1024];
+  fgets(page, 1024, request);
+
+  char buffer[1024];
+  strcat(buffer, "The page \"");
+  strcat(buffer, page);
+  strcat(buffer, "\" was not found.");
+
+  fputs(buffer, response);
+}

cpp/ql/test/query-tests/Security/CWE/CWE-020/ExternalAPITaintStepExample.cpp

@@ -0,0 +1,18 @@
+typedef unsigned long size_t;
+typedef size_t FILE;
+
+char *strcat(char *s1, const char *s2);
+char *fgets(char *s, int n, FILE *stream);
+char *fputs(const char *s, FILE *stream);
+
+void do_get(FILE* request, FILE* response) {
+  char user_id[1024];
+  fgets(user_id, 1024, request);
+
+  char buffer[1024];
+  strcat(buffer, "SELECT * FROM user WHERE user_id='");
+  strcat(buffer, user_id);
+  strcat(buffer, "'");
+
+  fputs(buffer, response);
+}

cpp/ql/test/query-tests/Security/CWE/CWE-020/IRCountUntrustedDataToExternalAPI.qlref

@@ -0,0 +1,4 @@
+query: Security/CWE/CWE-020/IRCountUntrustedDataToExternalAPI.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/query-tests/Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.expected

@@ -0,0 +1,4 @@
+#select
+edges
+nodes
+subpaths

cpp/ql/test/query-tests/Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.qlref

@@ -0,0 +1,4 @@
+query: Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/query-tests/Security/CWE/CWE-020/UntrustedDataToExternalAPI.expected

@@ -0,0 +1,4 @@
+#select
+edges
+nodes
+subpaths

cpp/ql/test/query-tests/Security/CWE/CWE-020/UntrustedDataToExternalAPI.qlref

@@ -0,0 +1,4 @@
+query: Security/CWE/CWE-020/UntrustedDataToExternalAPI.ql
+postprocess:
+ - utils/test/PrettyPrintModels.ql
+ - utils/test/InlineExpectationsTestQuery.ql

cpp/ql/test/query-tests/Security/CWE/CWE-020/sinks.ext..yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: sinkModel
+    data: # namespace, type, subtypes, name,    signature, ext, input,         kind,          provenance
+      - [   "",        "",   False,    "fputs", "",        "",  "Argument[0]", "remote-sink", "manual"]

cpp/ql/test/query-tests/Security/CWE/CWE-020/sources.ext.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: sourceModel
+    data: # namespace, type, subtypes, name,    signature, ext, output,        kind,     provenance
+      - [   "",        "",   False,    "fgets", "",        "",  "Argument[0]", "remote", "manual"]