新增准则:提供特定字段检测是否使用VirtualLock()函数锁定存放敏感信息的内存

sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/EncryptionAlgorithmChecker.java

@@ -59,14 +59,13 @@ public class EncryptionAlgorithmChecker extends SquidCheck<Grammar> {
                         return name != null && name.contains("password");
                     })){
                         cache.remove(varName);
-                        break;
                     }
                 }
                 next = next.getNextSibling();
             }
             cache.values().forEach(item->{
-                System.out.println("特定字段"+item.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue()+"未使用VirtualLock()函数锁定存放敏感信息的内存");
+                System.out.println("特定字段"+item.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue()+"未使用单向加密算法对口令进行加密并存储");
-                getContext().createLineViolation(this, "特定字段未使用VirtualLock()函数锁定存放敏感信息的内存", item);
+                getContext().createLineViolation(this, "单向加密算法对口令进行加密并存储", item);
             });
         }
     }

sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/VirtualLockUsageChecker.java

@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx.rules.checkers;
+
+
+import com.sonar.cxx.sslr.api.AstNode;
+import com.sonar.cxx.sslr.api.Grammar;
+import org.sonar.check.Priority;
+import org.sonar.check.Rule;
+import org.sonar.cxx.parser.CxxGrammarImpl;
+import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault;
+import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation;
+import org.sonar.cxx.squidbridge.checks.SquidCheck;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 使用VirtualLock()函数锁定存放敏感信息的内存
+ *
+ * @author WuHaoYang
+ * @date 2024/1/6
+ */
+
+@Rule(key = "VirtualLockUsageChecker", name = "使用VirtualLock()函数锁定存放敏感信息的内存", description = "使用VirtualLock()函数锁定存放敏感信息的内存", priority = Priority.INFO, tags = {"28suo"})
+@ActivatedByDefault
+@SqaleConstantRemediation("5min")
+public class VirtualLockUsageChecker extends SquidCheck<Grammar> {
+
+    private List<String> keywords = Arrays.asList("add", "keyword2", "keyword3");
+    private Map<String, Map<String, AstNode>> caches = new HashMap<>();
+
+    @Override
+    public void init() {
+        subscribeTo(CxxGrammarImpl.declarationStatement);
+    }
+
+    @Override
+    public void visitNode(AstNode astNode) {
+        String varName = astNode.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue();
+
+        for (String keyword : keywords) {
+            if (varName.contains(keyword) && (!caches.containsKey(keyword) || !caches.get(keyword).containsKey(varName))) {
+                caches.putIfAbsent(keyword, new HashMap<>());
+                caches.get(keyword).put(varName, astNode);
+                processNode(astNode, keyword);
+            }
+        }
+    }
+
+    private void processNode(AstNode astNode, String keyword) {
+        String varName = astNode.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue();
+
+        AstNode currentNode = astNode.getNextAstNode();
+        while (currentNode != null) {
+            AstNode callNode = currentNode.getFirstDescendant(CxxGrammarImpl.postfixExpression);
+            if (callNode != null && callNode.getTokenOriginalValue().equalsIgnoreCase("VirtualLock")) {
+                List<AstNode> paramList = callNode.getDescendants(CxxGrammarImpl.expressionList);
+                if (paramList.stream().anyMatch(item -> item.getTokenOriginalValue().contains(keyword))) {
+                    caches.get(keyword).remove(varName);
+                    break;
+                }
+            }
+            currentNode = currentNode.getNextSibling();
+        }
+    }
+
+    @Override
+    public void leaveFile(AstNode astNode) {
+        reportViolations();
+    }
+
+    private void reportViolations() {
+        caches.values().forEach(cache ->
+                cache.values().forEach(item -> {
+                    System.out.println("特定字段"+item.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue()+"未使用VirtualLock()函数锁定存放敏感信息的内存");
+                    getContext().createLineViolation(this, "特定字段未使用VirtualLock()函数锁定存放敏感信息的内存", item);
+                })
+        );
+        caches.clear();
+    }
+}

sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/VirtualLockUsageCheckerTest.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：C++ 信息安全性设计准则
+ * 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+package com.keyware.sonar.cxx.rules.checkers;
+
+import com.keyware.sonar.cxx.CxxFileTesterHelper;
+import org.junit.jupiter.api.Test;
+import org.sonar.cxx.CxxAstScanner;
+import org.sonar.cxx.squidbridge.api.SourceFile;
+import org.sonar.cxx.squidbridge.checks.CheckMessagesVerifier;
+
+import java.io.IOException;
+
+/**
+ * TODO VirtualLockUsageCheckerTest
+ *
+ * @author WuHaoYang
+ * @date 2024/1/15
+ */
+public class VirtualLockUsageCheckerTest {
+
+
+    @Test
+    public void checkTest() throws IOException {
+        var checker = new VirtualLockUsageChecker();
+        var tester = CxxFileTesterHelper.create("VirtualLockUsageChecker.cc");
+        SourceFile file = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker);
+        CheckMessagesVerifier.verify(file.getCheckMessages())
+                .next().atLine(8).withMessage("特定字段未使用VirtualLock()函数锁定存放敏感信息的内存")
+                .noMore();
+    }
+}

sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/VirtualLockUsageChecker.cc

@@ -0,0 +1,32 @@
+#include <windows.h>
+#include <iostream>
+#include <vector>
+using namespace std;
+
+int main() {
+
+   string add = "北京市"; //error
+
+//   string keyword2 = "北京市"; //error
+//
+//   string keyword3 = "北京市"; //error
+
+   // 利用vector<char>管理内存
+//   vector<char> addressBuffer(add.begin(), add.end());
+//
+//   addressBuffer.push_back('\0');
+//
+//   BOOL bResult = VirtualLock(addressBuffer.data(), addressBuffer.size());
+//   if (bResult == FALSE) {
+//       return 1;
+//   }
+//
+//
+//   // 解除锁定
+//   bResult = VirtualUnlock(addressBuffer.data(), addressBuffer.size());
+//   if (bResult == FALSE) {
+//       return 1;
+//   }
+//
+//   return 0;
+}