parent
87e3c41f2b
commit
e6fb96d32c
@ -0,0 +1,88 @@ |
||||
/* |
||||
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||
* 项目名称：C++ 信息安全性设计准则 |
||||
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 |
||||
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||
*/ |
||||
package com.keyware.sonar.cxx.rules.checkers; |
||||
|
||||
|
||||
import com.sonar.cxx.sslr.api.AstNode; |
||||
import com.sonar.cxx.sslr.api.Grammar; |
||||
import org.sonar.check.Priority; |
||||
import org.sonar.check.Rule; |
||||
import org.sonar.cxx.parser.CxxGrammarImpl; |
||||
import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault; |
||||
import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation; |
||||
import org.sonar.cxx.squidbridge.checks.SquidCheck; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.HashMap; |
||||
import java.util.List; |
||||
import java.util.Map; |
||||
|
||||
/** |
||||
* 使用VirtualLock()函数锁定存放敏感信息的内存 |
||||
* |
||||
* @author WuHaoYang |
||||
* @date 2024/1/6 |
||||
*/ |
||||
|
||||
@Rule(key = "VirtualLockUsageChecker", name = "使用VirtualLock()函数锁定存放敏感信息的内存", description = "使用VirtualLock()函数锁定存放敏感信息的内存", priority = Priority.INFO, tags = {"28suo"}) |
||||
@ActivatedByDefault |
||||
@SqaleConstantRemediation("5min") |
||||
public class VirtualLockUsageChecker extends SquidCheck<Grammar> { |
||||
|
||||
private List<String> keywords = Arrays.asList("add", "keyword2", "keyword3"); |
||||
private Map<String, Map<String, AstNode>> caches = new HashMap<>(); |
||||
|
||||
@Override |
||||
public void init() { |
||||
subscribeTo(CxxGrammarImpl.declarationStatement); |
||||
} |
||||
|
||||
@Override |
||||
public void visitNode(AstNode astNode) { |
||||
String varName = astNode.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue(); |
||||
|
||||
for (String keyword : keywords) { |
||||
if (varName.contains(keyword) && (!caches.containsKey(keyword) || !caches.get(keyword).containsKey(varName))) { |
||||
caches.putIfAbsent(keyword, new HashMap<>()); |
||||
caches.get(keyword).put(varName, astNode); |
||||
processNode(astNode, keyword); |
||||
} |
||||
} |
||||
} |
||||
|
||||
private void processNode(AstNode astNode, String keyword) { |
||||
String varName = astNode.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue(); |
||||
|
||||
AstNode currentNode = astNode.getNextAstNode(); |
||||
while (currentNode != null) { |
||||
AstNode callNode = currentNode.getFirstDescendant(CxxGrammarImpl.postfixExpression); |
||||
if (callNode != null && callNode.getTokenOriginalValue().equalsIgnoreCase("VirtualLock")) { |
||||
List<AstNode> paramList = callNode.getDescendants(CxxGrammarImpl.expressionList); |
||||
if (paramList.stream().anyMatch(item -> item.getTokenOriginalValue().contains(keyword))) { |
||||
caches.get(keyword).remove(varName); |
||||
break; |
||||
} |
||||
} |
||||
currentNode = currentNode.getNextSibling(); |
||||
} |
||||
} |
||||
|
||||
@Override |
||||
public void leaveFile(AstNode astNode) { |
||||
reportViolations(); |
||||
} |
||||
|
||||
private void reportViolations() { |
||||
caches.values().forEach(cache -> |
||||
cache.values().forEach(item -> { |
||||
System.out.println("特定字段"+item.getFirstDescendant(CxxGrammarImpl.declaratorId).getTokenOriginalValue()+"未使用VirtualLock()函数锁定存放敏感信息的内存"); |
||||
getContext().createLineViolation(this, "特定字段未使用VirtualLock()函数锁定存放敏感信息的内存", item); |
||||
}) |
||||
); |
||||
caches.clear(); |
||||
} |
||||
} |
||||
@ -0,0 +1,35 @@ |
||||
/* |
||||
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||
* 项目名称：C++ 信息安全性设计准则 |
||||
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 |
||||
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||
*/ |
||||
package com.keyware.sonar.cxx.rules.checkers; |
||||
|
||||
import com.keyware.sonar.cxx.CxxFileTesterHelper; |
||||
import org.junit.jupiter.api.Test; |
||||
import org.sonar.cxx.CxxAstScanner; |
||||
import org.sonar.cxx.squidbridge.api.SourceFile; |
||||
import org.sonar.cxx.squidbridge.checks.CheckMessagesVerifier; |
||||
|
||||
import java.io.IOException; |
||||
|
||||
/** |
||||
* TODO VirtualLockUsageCheckerTest |
||||
* |
||||
* @author WuHaoYang |
||||
* @date 2024/1/15 |
||||
*/ |
||||
public class VirtualLockUsageCheckerTest { |
||||
|
||||
|
||||
@Test |
||||
public void checkTest() throws IOException { |
||||
var checker = new VirtualLockUsageChecker(); |
||||
var tester = CxxFileTesterHelper.create("VirtualLockUsageChecker.cc"); |
||||
SourceFile file = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker); |
||||
CheckMessagesVerifier.verify(file.getCheckMessages()) |
||||
.next().atLine(8).withMessage("特定字段未使用VirtualLock()函数锁定存放敏感信息的内存") |
||||
.noMore(); |
||||
} |
||||
} |
||||
@ -0,0 +1,32 @@ |
||||
#include <windows.h> |
||||
#include <iostream> |
||||
#include <vector> |
||||
using namespace std; |
||||
|
||||
int main() { |
||||
|
||||
string add = "北京市"; //error
|
||||
|
||||
// string keyword2 = "北京市"; //error
|
||||
//
|
||||
// string keyword3 = "北京市"; //error
|
||||
|
||||
// 利用vector<char>管理内存
|
||||
// vector<char> addressBuffer(add.begin(), add.end());
|
||||
//
|
||||
// addressBuffer.push_back('\0');
|
||||
//
|
||||
// BOOL bResult = VirtualLock(addressBuffer.data(), addressBuffer.size());
|
||||
// if (bResult == FALSE) {
|
||||
// return 1;
|
||||
// }
|
||||
//
|
||||
//
|
||||
// // 解除锁定
|
||||
// bResult = VirtualUnlock(addressBuffer.data(), addressBuffer.size());
|
||||
// if (bResult == FALSE) {
|
||||
// return 1;
|
||||
// }
|
||||
//
|
||||
// return 0;
|
||||
} |
||||
Loading…
Reference in new issue